Edit tour

Windows Analysis Report
fxsound_setup.exe

Overview

General Information

Sample Name:	fxsound_setup.exe
Analysis ID:	1346523
MD5:	9ea725e3e3bc82249957cc00b74c4882
SHA1:	3291c62ff7f044dabe2809317df09ae451384cd1
SHA256:	3541df625affa384feacf3cd3d64c47d2372eab9a2055d57dde08afe7f85862c
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	50
Range:	0 - 100

Signatures

Found evasive API chain (may stop execution after checking mutex)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to open files direct via NTFS file id

Contains functionality to detect sleep reduction / modifications

Creates files inside the driver directory

Drops certificate files (DER)

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Stores files to the Windows start menu directory

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Creates driver files

Binary contains a suspicious time stamp

Creates a start menu entry (Start Menu\Programs\Startup)

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

PE file contains sections with non-standard names

Queries device information via Setup API

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Sample file is different than original file name gathered from version info

Enables driver privileges

Enables security privileges

Contains functionality to read device registry values (via SetupAPI)

Creates or modifies windows services

Classification

Process Tree

System is w10x64

fxsound_setup.exe (PID: 6596 cmdline: C:\Users\user\Desktop\fxsound_setup.exe MD5: 9EA725E3E3BC82249957CC00B74C4882)

msiexec.exe (PID: 7276 cmdline: C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\fxsound_setup.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700670463 " AI_EUIMSI=" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7180 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7224 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 79E6DEEDE54CC17CA7037B4F320F9C61 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7356 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 0C65C1CCF681D8CA1F2AEB8ADA388D35 MD5: 9D09DC1EDA745A5F87553048E57620CF)

fxdevcon64.exe (PID: 7676 cmdline: "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12 MD5: 87EAD9C6CD7486421E3142B2A6480F8E)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DfxSetupDrv.exe (PID: 7776 cmdline: "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check MD5: EFE3CF96899C9D9CC25815F88E9466E2)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fxdevcon64.exe (PID: 7824 cmdline: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf MD5: 87EAD9C6CD7486421E3142B2A6480F8E)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8036 cmdline: schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FxSound.exe (PID: 8084 cmdline: "C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @ MD5: 0A1E1E6B90FE62B9011393501BEF58D7)

svchost.exe (PID: 7896 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 7932 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\fxvad.inf" "9" "4143399a7" "000000000000016C" "WinSta0\Default" "00000000000000C4" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 7976 cmdline: DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "000000000000016C" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

updater.exe (PID: 8124 cmdline: "C:\Program Files\FxSound LLC\FxSound\updater.exe" /silent MD5: BC7B29CD513AEC979CEFBF30E6D68A01)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: fxsound_setup.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 45.79.74.123:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.79.74.123:443 -> 192.168.2.4:49733 version: TLS 1.2

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\FxSound.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Apps	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\updater.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvadntx86.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvadntamd64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvadntx86.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\2.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\3.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\4.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\5.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\6.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\7.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\8.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\9.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Bold.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Medium.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Regular.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Bold.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Medium.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Regular.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Bold.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Medium.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Regular.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Medium.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Regular.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\updater.ini	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FxSound 1.1.20.0

Jump to behavior

PE / OLE file has a valid certificate

Source: fxsound_setup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: fxsound_setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: fxsound_setup.exe, 00000000.00000003.1668153416.000000000552D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\Release\fxdevcon32.pdb" source: fxdevcon32.exe.1.dr
Source:	Binary string: C:\Users\Vijay\Documents\Projects\FxSound\fxsound-driver\fxvad\pcmex\Release\fxvad.pdb source: fxvad.sys2.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Updater.pdb source: updater.exe, 00000012.00000002.1859837140.00000000001D4000.00000002.00000001.01000000.0000000E.sdmp, updater.exe, 00000012.00000000.1821729596.00000000001D4000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\code32\Mains\DfxSetupDrv\Release\DfxSetupDrv.pdbNN(GCTL source: DfxSetupDrv.exe, 00000008.00000002.1744326725.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe, 00000008.00000000.1728417446.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe.1.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Project\x64\Release\App\FxSound.pdb source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb? source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\Release\fxdevcon32.pdb source: fxdevcon32.exe.1.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\x64\Release\fxdevcon64.pdb source: fxdevcon64.exe, 00000006.00000000.1725646207.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000002.1787250018.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000000.1744778421.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: wininet.pdbUGP source: fxsound_setup.exe, 00000000.00000003.1668153416.000000000552D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\code32\Mains\DfxSetupDrv\Release\DfxSetupDrv.pdb source: DfxSetupDrv.exe, 00000008.00000002.1744326725.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe, 00000008.00000000.1728417446.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe.1.dr
Source:	Binary string: C:\Users\Vijay\Documents\Projects\FxSound\fxsound-driver\fxvad\pcmex\x64\Release\fxvad.pdb source: drvinst.exe, 0000000D.00000003.1765962497.0000023D636B3000.00000004.00000020.00020000.00000000.sdmp, fxvad.sys1.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: fxsound_setup.exe
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\x64\Release\fxdevcon64.pdb source: fxdevcon64.exe, 00000006.00000000.1725646207.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000002.1787250018.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000000.1744778421.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdbo source: fxsound_setup.exe, fxsound.x64.msi.0.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010D9310 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_010D9310

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010D0640 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_010D0640
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010AB1B0 FindFirstFileW,GetLastError,FindClose,	0_2_010AB1B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010DA4B0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_010DA4B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010AA850 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_010AA850
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010DA8B0 FindFirstFileW,FindClose,	0_2_010DA8B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010B8F30 FindFirstFileW,FindClose,FindClose,	0_2_010B8F30
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0108FE80 FindFirstFileW,FindNextFileW,FindClose,	0_2_0108FE80
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E07117C0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00007FF7E07117C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0012E2C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	18_2_0012E2C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001B400D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_001B400D

Networking

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: http://Locationftp:juceftp://https://GetAdaptersAddressesiphlpapi.dllhttps:
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrus
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.di
Source: fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: DfxSetupDrv.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: updater.exe, 00000012.00000003.1844172601.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1844277230.0000000000827000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co?
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, fxvadntx86.cat0.1.dr, DfxSetupDrv.exe.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, DfxSetupDrv.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: http://t2.symcb.com0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: http://tl.symcd.com0&
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, FxSound.exe.1.dr, fxdevcon32.exe.1.dr, fxvadntx86.cat0.1.dr, DfxSetupDrv.exe.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: fxdevcon64.exe, 0000000A.00000002.1786670412.0000026492D45000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1753079231.0000026492D3B000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785091901.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786670412.0000026492D30000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1746456930.0000026492CD9000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785554355.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1745440876.0000026492CA4000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1750468970.0000026492CF6000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754124511.0000026492D30000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1750364754.0000026492CF6000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754969063.0000026492D30000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1752277277.0000026492D3D000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786448508.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1759276637.0000023D635A8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762206072.0000023D635AA000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762304235.0000023D63653000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762320499.0000023D6359B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1760450193.0000023D635A5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762453362.0000023D63659000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757848935.0000023D6359B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757965297.0000023D635A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fxsound.com
Source: fxdevcon64.exe, 0000000A.00000003.1746508721.0000026492CC3000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785091901.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1752231616.0000026492D54000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1746442059.0000026492CE2000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786953682.0000026494A4D000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786953682.0000026494A40000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1753955898.0000026492D57000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754884252.0000026492CC8000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1750364754.0000026492CC8000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754439022.0000026492CC5000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786670412.0000026492D53000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785299209.0000026492CC8000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785628821.0000026492D52000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1745440876.0000026492CAA000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786953682.0000026494A53000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754686909.0000026492D53000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1752711142.0000026492D54000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1766071983.0000023D63633000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757965297.0000023D635A9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1769785529.0000023D63633000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757770641.0000023D635A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fxsound.comd
Source: updater.exe, 00000012.00000002.1860559394.00000000007BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/
Source: updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858258759.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/fxsoundlatest
Source: updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/fxsoundlatestoad
Source: fxsound_setup.exe, 00000000.00000003.1667845398.00000000065B7000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1662154560.0000000000CB2000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1828414418.0000000002630000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007BD000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp, MSIccd31.LOG.1.dr	String found in binary or memory: https://download.fxsound.com/updates
Source: updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/updatesB
Source: updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/updatesE
Source: fxsound_setup.exe, 00000000.00000003.1824233531.0000000006557000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000002.1829373659.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/updatesc
Source: updater.exe, 00000012.00000002.1860559394.0000000000778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.com/updatester
Source: updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.fxsound.comK
Source: updater.exe, 00000012.00000003.1859200242.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858157638.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858258759.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://downloads3.fxsound.com/fxsound/2/fxsound_setup.exe
Source: updater.exe, 00000012.00000002.1860559394.00000000007BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://downloads3.fxsound.com/fxsound/2/fxsound_setup.exeIE5
Source: updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.fxsound.com/
Source: updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.fxsound.com/B
Source: updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.fxsound.com/J
Source: updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.fxsound.com/cs/sgMPaBYtQvliu88/downloads3.fxsound.com/fxsound/1.1.20.0/updates.txt/dow
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://forms.gle/ATx1ayXDWRaMdiR59
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://forms.gle/ATx1ayXDWRaMdiR59:Take
Source: MSIccd31.LOG.1.dr	String found in binary or memory: https://forum.fxsound.com
Source: fxsound_setup.exe, 00000000.00000003.1823613645.000000000659E000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1827593471.00000000065A6000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825157251.000000000659E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forum.fxsound.comD
Source: fxsound_setup.exe, 00000000.00000003.1823613645.000000000657B000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1827057502.0000000006585000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1824180068.0000000006583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forum.fxsound.comto
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://james722808.typeform.com/to/QfEP5QrP
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://james722808.typeform.com/to/QfEP5QrPSupporthttps://www.fxsound.com/learning-centerChangelog;
Source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://juce.com
Source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://postman-echo.com
Source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://postman-echo.comdaveHttpClient
Source: fxsound_setup.exe, 00000000.00000003.1667845398.00000000065B7000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1828414418.0000000002630000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp, MSIccd31.LOG.1.dr	String found in binary or memory: https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txt
Source: fxsound_setup.exe, 00000000.00000003.1663699741.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1663666127.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txt)c.
Source: fxsound_setup.exe, 00000000.00000003.1824233531.0000000006557000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txtO
Source: FxSound.exe.1.dr	String found in binary or memory: https://sketch.com
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: fxvadntx86.cat0.1.dr, fxvad.sys2.1.dr, fxvad.sys1.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: fxsound_setup.exe, 00000000.00000003.1663748027.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000002.1828323288.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1663666127.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/blog/fxsound-is-now-completely-free
Source: fxsound_setup.exe, 00000000.00000003.1667889626.00000000065A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/blog/fxsound-is-now-completely-freeu
Source: MSIccd31.LOG.1.dr	String found in binary or memory: https://www.fxsound.com/changelog
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.fxsound.com/changelog.Click
Source: fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/changelog335
Source: fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/changelog340
Source: fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/changelogION#
Source: fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/changelogIONw
Source: fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/changelogenter
Source: fxsound_setup.exe, 00000000.00000003.1663748027.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/changelognJ
Source: MSIccd31.LOG.1.dr	String found in binary or memory: https://www.fxsound.com/learning-center
Source: FxSound.exe, 00000011.00000003.2149211092.000001E91B4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fxsound.com/learning-center/installation-troubleshooting
Source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.fxsound.com/learning-center/installation-troubleshootingFXSOUND_Oops
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.fxsound.com/learning-center/no-sound-with-fxsound-realtek
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.fxsound.com/learning-center/no-sound-with-fxsound-realtekPreset
Source: fxsound.x64.msi.0.dr	String found in binary or memory: https://www.fxsound.com/learning-centerARPNOMODIFYEnableUserControlARPNOREPAIRARPSYSTEMCOMPONENTARPU
Source: FxSound.exe.1.dr	String found in binary or memory: https://www.fxsound.com/presets
Source: FxSound.exe, 00000011.00000002.2916156691.000001E918F7D000.00000004.00000020.00020000.00000000.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.fxsound.com/support
Source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.paypal.com/donate/?hosted_button_id=JVNQGYXCQ2GPG
Source: FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	String found in binary or memory: https://www.paypal.com/donate/?hosted_button_id=JVNQGYXCQ2GPG1.1.20.0
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown

DNS traffic detected: queries for: download.fxsound.com

Source: C:\Program Files\FxSound LLC\FxSound\updater.exe

Code function: 18_2_0014D1F0 GetLastError,ResetEvent,InternetQueryDataAvailable,GetLastError,GetLastError,Sleep,WaitForSingleObject,SetEvent,ResetEvent,InternetReadFile,GetLastError,GetLastError,Sleep,WaitForSingleObject,SetEvent,WriteFile,Sleep,GetFileSize,GetLastError,CloseHandle,DeleteFileW,MoveFileW,CopyFileW,GetLastError,DeleteFileW,CloseHandle,

18_2_0014D1F0

Source: global traffic	HTTP traffic detected: GET /updates HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: download.fxsound.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cs/sgMPaBYtQvliu88/downloads3.fxsound.com/fxsound/1.1.20.0/updates.txt/download HTTP/1.1Accept: /User-Agent: AdvancedInstallerConnection: Keep-AliveCache-Control: no-cacheHost: drive.fxsound.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: fxsound_setup.exe, 00000000.00000000.1651091172.00000000011C9000.00000002.00000001.01000000.00000003.sdmp, fxsound_setup.exe, 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: FlashWindowExFlashWindowGetPackagePathKernel32.dllhttp://www.google.comTESTtin9999.tmphttp://www.yahoo.comhttp://www.example.com.partGET "filenameattachment=123POSTcharsetDLDISO-8859-1US-ASCIIutf-8utf-16FTP Server/AdvancedInstallerLocal Network ServerIf-Modified-Since: %s equals www.yahoo.com (Yahoo)
Source: fxsound_setup.exe	String found in binary or memory: TFlashWindowExFlashWindowGetPackagePathKernel32.dllhttp://www.google.comTESTtin9999.tmphttp://www.yahoo.comhttp://www.example.com.partGET "filenameattachment=123POSTcharsetDLDISO-8859-1US-ASCIIutf-8utf-16FTP Server/AdvancedInstallerLocal Network ServerIf-Modified-Since: %s equals www.yahoo.com (Yahoo)

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 45.79.74.123:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.79.74.123:443 -> 192.168.2.4:49733 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	File created: C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDD9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF03A.tmp	Jump to dropped file
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	File created: (copy)	Jump to dropped file

System Summary

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010C4CA0	0_2_010C4CA0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FB8080	0_2_00FB8080
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010FC010	0_2_010FC010
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FBC127	0_2_00FBC127
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FBC116	0_2_00FBC116
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FB4200	0_2_00FB4200
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010045B0	0_2_010045B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00F945FE	0_2_00F945FE
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_01154860	0_2_01154860
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FAEAF0	0_2_00FAEAF0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0115CBBA	0_2_0115CBBA
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0108AA20	0_2_0108AA20
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010BCFD0	0_2_010BCFD0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0114CEC0	0_2_0114CEC0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00F93010	0_2_00F93010
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FBF4E0	0_2_00FBF4E0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FBB461	0_2_00FBB461
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0115F711	0_2_0115F711
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_01161639	0_2_01161639
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FBDAC0	0_2_00FBDAC0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_01167AA7	0_2_01167AA7
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06F5950	6_2_00007FF7E06F5950
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E07131F8	6_2_00007FF7E07131F8
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E0704B10	6_2_00007FF7E0704B10
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06F1370	6_2_00007FF7E06F1370
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E070EBEC	6_2_00007FF7E070EBEC
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06F2340	6_2_00007FF7E06F2340
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E0710B3C	6_2_00007FF7E0710B3C
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E07094BC	6_2_00007FF7E07094BC
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06F5630	6_2_00007FF7E06F5630
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E07117C0	6_2_00007FF7E07117C0
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E0714728	6_2_00007FF7E0714728
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E0704FEC	6_2_00007FF7E0704FEC
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E070A794	6_2_00007FF7E070A794
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E07058FA	6_2_00007FF7E07058FA
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E0710078	6_2_00007FF7E0710078
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: 8_2_003539B0	8_2_003539B0
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: 8_2_00356350	8_2_00356350
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001820D0	18_2_001820D0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00198810	18_2_00198810
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0015A830	18_2_0015A830
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00152B00	18_2_00152B00
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00177300	18_2_00177300
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001776A0	18_2_001776A0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00159970	18_2_00159970
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0017C110	18_2_0017C110
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00146430	18_2_00146430
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00154510	18_2_00154510
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0013A570	18_2_0013A570
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001B2629	18_2_001B2629
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001A88C0	18_2_001A88C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001BC8C0	18_2_001BC8C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00168AF0	18_2_00168AF0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0012EB60	18_2_0012EB60
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001ACF5A	18_2_001ACF5A
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001A4FC5	18_2_001A4FC5
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00189050	18_2_00189050
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_00133060	18_2_00133060
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001B10B0	18_2_001B10B0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001332C0	18_2_001332C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001A5353	18_2_001A5353
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0012F470	18_2_0012F470
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001678E0	18_2_001678E0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001B7971	18_2_001B7971
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0017DB80	18_2_0017DB80

Tries to load missing DLLs

Source: C:\Users\user\Desktop\fxsound_setup.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\fxsound_setup.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Creates driver files

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys

Jump to behavior

Uses 32bit PE files

Source: fxsound_setup.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSICFD1.tmp

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\4cce4a.msi

Jump to behavior

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: String function: 00F992A0 appears 55 times
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: String function: 00F97160 appears 50 times
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: String function: 00F99800 appears 58 times
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: String function: 00F97D00 appears 342 times
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: String function: 00351DE0 appears 54 times
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: String function: 00356330 appears 117 times
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: String function: 00124580 appears 31 times
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: String function: 00123660 appears 181 times
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: String function: 00122670 appears 157 times
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: String function: 0019D660 appears 55 times
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: String function: 001237D0 appears 195 times
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: String function: 001280D0 appears 35 times

Contains functionality to call native functions

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010EF0D0 NtdllDefWindowProc_W,	0_2_010EF0D0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_01067A10 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,	0_2_01067A10
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0104C330 NtdllDefWindowProc_W,	0_2_0104C330
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FB2390 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_00FB2390
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FA44A0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00FA44A0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FAE540 NtdllDefWindowProc_W,	0_2_00FAE540
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FAE6B0 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00FAE6B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FA4BC0 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	0_2_00FA4BC0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FA7190 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_00FA7190
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010010D0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_010010D0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FA5220 NtdllDefWindowProc_W,	0_2_00FA5220
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FC58F0 NtdllDefWindowProc_W,	0_2_00FC58F0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FA78B0 NtdllDefWindowProc_W,	0_2_00FA78B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FB7AC0 NtdllDefWindowProc_W,	0_2_00FB7AC0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FA7E70 NtdllDefWindowProc_W,	0_2_00FA7E70

Sample file is different than original file name gathered from version info

Source: fxsound_setup.exe, 00000000.00000003.1668153416.000000000552D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs fxsound_setup.exe
Source: fxsound_setup.exe	Binary or memory string: OriginalFilenameviewer.exeF vs fxsound_setup.exe
Source: fxsound_setup.exe	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs fxsound_setup.exe
Source: fxsound_setup.exe	Binary or memory string: OriginalFilenameAICustAct.dllF vs fxsound_setup.exe
Source: fxsound_setup.exe	Binary or memory string: OriginalFilenamePrereq.dllF vs fxsound_setup.exe

Enables driver privileges

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Process token adjusted: Load Driver

Jump to behavior

Enables security privileges

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Jump to behavior

Source: fxsound_setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FxSound.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files\FxSound LLC\FxSound\FxSound.exe
Source: Check for FxSound updates.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files\FxSound LLC\FxSound\updater.exe
Source: FxSound.lnk0.1.dr	LNK file: ..\..\..\..\..\..\Program Files\FxSound LLC\FxSound\FxSound.exe
Source: FxSound.lnk1.1.dr	LNK file: ..\..\..\Program Files\FxSound LLC\FxSound\FxSound.exe

Source: C:\Users\user\Desktop\fxsound_setup.exe

File created: C:\Users\user\AppData\Roaming\FxSound LLC

Jump to behavior

Source: classification engine

Classification label: mal42.evad.winEXE@28/103@2/1

Source: C:\Users\user\Desktop\fxsound_setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010AE5B0 FormatMessageW,GetLastError,

0_2_010AE5B0

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_00F99160 LoadResource,LockResource,SizeofResource,

0_2_00F99160

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\FxSound LLC

Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

File read: C:\Users\user\Desktop\fxsound_setup.exe

Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fxsound_setup.exe C:\Users\user\Desktop\fxsound_setup.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 79E6DEEDE54CC17CA7037B4F320F9C61 C
Source: C:\Users\user\Desktop\fxsound_setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\fxsound_setup.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700670463 " AI_EUIMSI="
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0C65C1CCF681D8CA1F2AEB8ADA388D35
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\fxvad.inf" "9" "4143399a7" "000000000000016C" "WinSta0\Default" "00000000000000C4" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "000000000000016C"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\FxSound.exe "C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @
Source: unknown	Process created: C:\Program Files\FxSound LLC\FxSound\updater.exe "C:\Program Files\FxSound LLC\FxSound\updater.exe" /silent
Source: C:\Users\user\Desktop\fxsound_setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\fxsound_setup.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700670463 " AI_EUIMSI="	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 79E6DEEDE54CC17CA7037B4F320F9C61 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0C65C1CCF681D8CA1F2AEB8ADA388D35	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\FxSound.exe "C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\fxvad.inf" "9" "4143399a7" "000000000000016C" "WinSta0\Default" "00000000000000C4" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "000000000000016C"	Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

File created: C:\Users\user\AppData\Local\Temp\MSICA43.tmp

Jump to behavior

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Code function: 6_2_00007FF7E06F5950 CoCreateInstance,SysAllocString,SysFreeString,CoSetProxyBlanket,SysFreeString,SysFreeString,VariantInit,VariantClear,

6_2_00007FF7E06F5950

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010DB860 GetDiskFreeSpaceExW,

0_2_010DB860

Source: fxsound_setup.exe, 00000000.00000003.1667845398.00000000065B7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT * FROM `Property` WHERE `Property` = 'ALLUSERS'(;

Source: C:\Program Files\FxSound LLC\FxSound\updater.exe

Code function: 18_2_00192F80 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,GetWindowThreadProcessId,GetWindowTextW,GetWindowLongW,GetWindowLongW,GetWindowLongW,GetWindowLongW,

18_2_00192F80

Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{E498B5A6-FA64-40c6-9327-9E6F15FF6546}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Program Files\FxSound LLC\FxSound\FxSound.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\juceAppLock_FxSound
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03

Source: C:\Program Files\FxSound LLC\FxSound\updater.exe

Command line argument: RICHED20.DLL

18_2_0018CA40

Source: updater.exe	String found in binary or memory: -startminimized
Source: updater.exe	String found in binary or memory: /install
Source: updater.exe	String found in binary or memory: -startappfirst
Source: updater.exe	String found in binary or memory: -installready
Source: updater.exe	String found in binary or memory: /installservice
Source: fxsound_setup.exe	String found in binary or memory: INSERT INTO `` (`Property`, `Order`, `Value`, `Text`) VALUES (?,?,?,?) TEMPORARYComboBoxListBoxSELECT * FROM `%s` WHERE `Property`='%s' AND `Value`='%s'SELECT * FROM `%s` WHERE `Property`='%s'EditSELECT `Message` FROM `Error` WHERE `Error` = %sSELECT `Text` FROM `UIText` WHERE `Key` = '%s'tmpALLUSERS = 1ALLUSERS = 2MSIINSTALLPERUSER = 1AI_PACKAGE_TYPE = "x64"AI_PACKAGE_TYPE = "Intel64"SELECT * FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'SELECT `Attributes` FROM `Control` WHERE `Dialog_` = '%s' AND `Control` = '%s'$=3WS_BORDERWS_CAPTIONWS_CHILDWS_CHILDWINDOWWS_CLIPCHILDRENWS_CLIPSIBLINGSWS_DISABLEDWS_DLGFRAMEWS_GROUPWS_HSCROLLWS_ICONICWS_SIZEBOXWS_SYSMENUWS_TABSTOPWS_THICKFRAMEWS_VISIBLEWS_VSCROLLWS_MAXIMIZEBOXWS_MAXIMIZEWS_MINIMIZEBOXWS_MINIMIZEWS_OVERLAPPEDWINDOWWS_OVERLAPPEDWS_POPUPWINDOWWS_POPUPWS_TILEDWINDOWWS_TILEDWS_EX_ACCEPTFILESWS_EX_APPWINDOWWS_EX_CLIENTEDGEWS_EX_CONTEXTHELPWS_EX_CONTROLPARENTWS_EX_DLGMODALFRAMEWS_EX_LEFTWS_EX_LEFTSCROLLBARWS_EX_LTRREADINGWS_EX_MDICHILDWS_EX_NOPARENTNOTIFYWS_EX_OVERLAPPEDWINDOWWS_EX_PALETTEWINDOWWS_EX_RTLREADINGWS_EX_STATICEDGEWS_EX_TOOLWINDOWWS_EX_TOPMOSTWS_EX_TRANSPARENTWS_EX_WINDOWEDGEWS_EX_RIGHTSCROLLBARWS_EX_RIGHTWS_EX_LAYEREDWS_EX_NOACTIVATEWS_EX_NOINHERITLAYOUTWS_EX_LAYOUTRTLWS_EX_COMPOSITEDWS_EXAI_TRIAL_MESSAGE_BODYAI_MSM_TRIAL_MESSAGE_BODYAI_APP_FILEAI_README_FILEAI_APP_ARGSAI_RUN_AS_ADMINMsiLogFileLocation[ProgramFilesFolder][LocalAppDataFolder]Programs\[ProgramFiles64Folder][CommonFilesFolder][LocalAppDataFolder]Programs\Common\[CommonFiles64Folder][WindowsFolder][LocalAppDataFolder][SystemFolder][WindowsVolume][ProgramMenuFolder][DesktopFolder][StartupFolder][TemplateFolder][AdminToolsFolder][AI_UserProgramFiles][WindowsVolume]Program Files (x86)\[AI_ProgramFiles][WindowsVolume]Program Files\MIGRATEFindRelatedProductsMigrateFeatureStatesAI_SETMIXINSTLOCATIONAPPDIRAI_RESTORE_LOCATIONSELECT `ActionProperty` FROM `Upgrade`ActionTarget`Action`='SET_APPDIR' OR `Action`='SET_SHORTCUTDIR'CustomActionSET_APPDIRSET_SHORTCUTDIRSHORTCUTDIRProgramMenuFolderAI_SH_INITEDBrowseDlgCancelDlgDiskCostDlgExitDialogMsiRMFilesInUseOutOfDiskDlgOutOfRbDiskDlgDialog_Control_(`Control_` = 'Next' OR `Control_` = 'Install') AND `Event` = 'EndDialog' AND `Argument` = 'Return'ControlEventAI_INSTALLPERUSER = "0"ALLUSERSVersionMsi >= "5.0"2MSIINSTALLPERUSERAI_NEWINSTProductLanguageAI_INTANCE_LOCATIONAI_UPGRADENoLanguageVersionStringInstallLocationAI_REPLACE_PRODUCTSAI_Replaced_Versions_ListAI_Upgrade_Replace_Question_YesBackUp_AI_Upgrade_Question_YesAI_Upgrade_Question_YesAI_Upgrade_Replace_Question_NoBackUp_AI_Upgrade_Question_NoAI_Upgrade_Question_NoYesDELETE FROM `Shortcut` WHERE `Shortcut`.`Directory_`='%s'DELETE FROM `IniFile` WHERE `IniFile`.`Section`='InternetShortcut' AND`IniFile`.`DirProperty`='%s'SELECT * FROM `%s`ShortcutIniFileAI_DESKTOP_SH0AI_STARTMENU_SHAI_QUICKLAUNCH_SHAI_STARTUP_SHAI_SHORTCUTSREGNot InstalledDesktopFolderQuickLaunch_DirStartupFolderAI_SH_DIRProductNameRiched20.dll -user -mach

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files\FxSound LLC\FxSound\updater.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE file has a big code size

Source: fxsound_setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\FxSound.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Apps	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\updater.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvadntx86.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvadntamd64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvadntx86.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\2.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\3.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\4.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\5.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\6.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\7.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\8.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\Factsoft\9.fac	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Bold.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Medium.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Regular.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Bold.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Medium.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Regular.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Bold.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Medium.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Regular.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Medium.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Regular.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\FxSound LLC\FxSound\updater.ini	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FxSound 1.1.20.0

Jump to behavior

Submission file is bigger than most known malware samples

Source: fxsound_setup.exe

Static file information: File size 46914960 > 1048576

PE / OLE file has a valid certificate

Source: fxsound_setup.exe

Static PE information: certificate valid

PE file has a big raw section

Source: fxsound_setup.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x237c00

PE file contains a mix of data directories often seen in goodware

Source: fxsound_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: fxsound_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: fxsound_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: fxsound_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: fxsound_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: fxsound_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: fxsound_setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: fxsound_setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: fxsound_setup.exe, 00000000.00000003.1668153416.000000000552D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\Release\fxdevcon32.pdb" source: fxdevcon32.exe.1.dr
Source:	Binary string: C:\Users\Vijay\Documents\Projects\FxSound\fxsound-driver\fxvad\pcmex\Release\fxvad.pdb source: fxvad.sys2.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Updater.pdb source: updater.exe, 00000012.00000002.1859837140.00000000001D4000.00000002.00000001.01000000.0000000E.sdmp, updater.exe, 00000012.00000000.1821729596.00000000001D4000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\code32\Mains\DfxSetupDrv\Release\DfxSetupDrv.pdbNN(GCTL source: DfxSetupDrv.exe, 00000008.00000002.1744326725.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe, 00000008.00000000.1728417446.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe.1.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Project\x64\Release\App\FxSound.pdb source: FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb? source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\Release\fxdevcon32.pdb source: fxdevcon32.exe.1.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\x64\Release\fxdevcon64.pdb source: fxdevcon64.exe, 00000006.00000000.1725646207.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000002.1787250018.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000000.1744778421.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: wininet.pdbUGP source: fxsound_setup.exe, 00000000.00000003.1668153416.000000000552D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\code32\Mains\DfxSetupDrv\Release\DfxSetupDrv.pdb source: DfxSetupDrv.exe, 00000008.00000002.1744326725.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe, 00000008.00000000.1728417446.000000000035A000.00000002.00000001.01000000.0000000A.sdmp, DfxSetupDrv.exe.1.dr
Source:	Binary string: C:\Users\Vijay\Documents\Projects\FxSound\fxsound-driver\fxvad\pcmex\x64\Release\fxvad.pdb source: drvinst.exe, 0000000D.00000003.1765962497.0000023D636B3000.00000004.00000020.00020000.00000000.sdmp, fxvad.sys1.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: fxsound_setup.exe
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: fxsound_setup.exe, fxsound.x64.msi.0.dr
Source:	Binary string: C:\Users\vijay\Documents\Projects\FxSound\repo\fxsound\FxSound\Installer\DfxInstall\x64\Release\fxdevcon64.pdb source: fxdevcon64.exe, 00000006.00000000.1725646207.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000002.1787250018.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp, fxdevcon64.exe, 0000000A.00000000.1744778421.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdbo source: fxsound_setup.exe, fxsound.x64.msi.0.dr

PE file contains a valid data directory to section mapping

Source: fxsound_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: fxsound_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: fxsound_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: fxsound_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: fxsound_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C252C4 push ecx; retn 0000h	0_3_00C252D6
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C214C5 push cs; retn 0010h	0_3_00C2150A
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C276C8 push eax; ret	0_3_00C276F2
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F8DB push cs; ret	0_3_00C2F8E2
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C23CE1 push eax; ret	0_3_00C23CE2
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C23CE9 push edx; ret	0_3_00C23CEA
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C1ECF8 push cs; ret	0_3_00C1ED02
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C276F8 push eax; ret	0_3_00C276F2
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C25280 push ecx; retn 0000h	0_3_00C25286
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C1EE83 push cs; ret	0_3_00C1EEAA
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C276B0 push cs; ret	0_3_00C276C2
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C252B9 push edx; retn 0000h	0_3_00C252BA
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C21615 push ss; retn 0000h	0_3_00C21616
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C23631 push ecx; ret	0_3_00C23642
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C25FEA pushad ; retn 0000h	0_3_00C25FFA
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C27980 push ecx; ret	0_3_00C27992
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C29989 pushfd ; retn 0000h	0_3_00C2998A
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F544 push edx; ret	0_3_00C2F54E
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F54F push edx; ret	0_3_00C2F552
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F751 push cs; ret	0_3_00C2F752
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F555 push ebx; ret	0_3_00C2F556
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F559 push ebx; ret	0_3_00C2F55A
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F55D push ebx; ret	0_3_00C2F55E
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F561 push edx; ret	0_3_00C2F562
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F567 push eax; ret	0_3_00C2F56A
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F565 push eax; ret	0_3_00C2F566
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C25309 push edx; retn 0000h	0_3_00C2530A
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C1ED15 push ecx; ret	0_3_00C1ED1A
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_3_00C2F528 push edx; ret	0_3_00C2F542
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_011451AE push ecx; ret	0_2_011451C1
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0108B3E0 push ecx; mov dword ptr [esp], 3F800000h	0_2_0108B516

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010AE740 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_010AE740

Binary contains a suspicious time stamp

Source: shiCBDA.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

PE file contains sections with non-standard names

Source: shiCBDA.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shiCBDA.tmp.0.dr	Static PE information: section name: .didat
Source: FxSound.exe.1.dr	Static PE information: section name: _RDATA
Source: fxdevcon64.exe.1.dr	Static PE information: section name: _RDATA
Source: fxdevcon64.exe0.1.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0E0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID5C4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID090.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys	Jump to dropped file
Source: C:\Users\user\Desktop\fxsound_setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSICC49.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys	Jump to dropped file
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	File created: C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDFA.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\fxsound_setup.exe	File created: C:\Users\user\AppData\Local\Temp\shiCBDA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\FxSound.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID11F.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF05B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID030.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID06F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0E0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID5C4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID090.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID11F.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF05B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID030.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID06F.tmp	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f

Stores files to the Windows start menu directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FxSound	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FxSound.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FxSound\Check for FxSound updates.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FxSound\FxSound.lnk	Jump to behavior

Creates a start menu entry (Start Menu\Programs\Startup)

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FxSound.lnk

Jump to behavior

Creates or modifies windows services

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FXVAD

Hooking and other Techniques for Hiding and Protection

Tries to open files direct via NTFS file id

Source: C:\Windows\System32\drvinst.exe	File opened: C:\Windows\System32\drivers
Source: C:\Windows\System32\drvinst.exe	File opened: C:\Windows\System32\drivers
Source: C:\Windows\System32\drvinst.exe	File opened: C:\Windows\System32\drivers

Source: C:\Users\user\Desktop\fxsound_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FxSound LLC\FxSound\FxSound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FxSound LLC\FxSound\FxSound.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Contains functionality to detect sleep reduction / modifications

Source: C:\Program Files\FxSound LLC\FxSound\updater.exe

Code function: 18_2_0013F5F0

18_2_0013F5F0

Found large amount of non-executed APIs

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	API coverage: 4.8 %
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	API coverage: 5.5 %

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Program Files\FxSound LLC\FxSound\updater.exe

Code function: 18_2_0013F5F0

18_2_0013F5F0

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID0E0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\fxsound_setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiCBDA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID11F.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF05B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID030.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID06F.tmp	Jump to dropped file
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDFA.tmp	Jump to dropped file

Contains functionality to read device registry values (via SetupAPI)

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Code function: 6_2_00007FF7E06F8C60 SetupDiGetClassDevsW,SetupDiEnumDeviceInfo,SetupDiGetDeviceRegistryPropertyW,SetupDiEnumDeviceInfo,SetupDiDestroyDeviceInfoList,SetupDiRemoveDevice,SetupDiDestroyDeviceInfoList,

6_2_00007FF7E06F8C60

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010D9310 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_010D9310

Source: updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_011419D1 VirtualQuery,GetSystemInfo,

0_2_011419D1

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010D0640 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_010D0640
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010AB1B0 FindFirstFileW,GetLastError,FindClose,	0_2_010AB1B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010DA4B0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_010DA4B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010AA850 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_010AA850
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010DA8B0 FindFirstFileW,FindClose,	0_2_010DA8B0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_010B8F30 FindFirstFileW,FindClose,FindClose,	0_2_010B8F30
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0108FE80 FindFirstFileW,FindNextFileW,FindClose,	0_2_0108FE80
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E07117C0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00007FF7E07117C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0012E2C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	18_2_0012E2C0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001B400D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_001B400D

Source: C:\Users\user\Desktop\fxsound_setup.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fxsound_setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fxsound_setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fxsound_setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fxsound_setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Anti Debugging

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010AE740 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_010AE740

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_011441D9 mov esi, dword ptr fs:[00000030h]	0_2_011441D9
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0115E93F mov eax, dword ptr fs:[00000030h]	0_2_0115E93F
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0115E8FB mov eax, dword ptr fs:[00000030h]	0_2_0115E8FB
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_0114FDF7 mov ecx, dword ptr fs:[00000030h]	0_2_0114FDF7
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001AA021 mov ecx, dword ptr fs:[00000030h]	18_2_001AA021
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0019B4B4 mov esi, dword ptr fs:[00000030h]	18_2_0019B4B4
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001B3D58 mov eax, dword ptr fs:[00000030h]	18_2_001B3D58

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files\FxSound LLC\FxSound\FxSound.exe "C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_01149913 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_01149913

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010DD260 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

0_2_010DD260

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_01144245 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_01144245

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FCAEA0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00FCAEA0
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_01144CCD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01144CCD
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_01149913 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01149913
Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: 0_2_00FCD8C0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00FCD8C0
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06FD168 SetUnhandledExceptionFilter,	6_2_00007FF7E06FD168
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E0702AA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7E0702AA8
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06FC4D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF7E06FC4D8
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: 6_2_00007FF7E06FCFC0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7E06FCFC0
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: 8_2_00358C17 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00358C17
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: 8_2_00359074 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00359074
Source: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	Code function: 8_2_003591D6 SetUnhandledExceptionFilter,	8_2_003591D6
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0019CC13 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0019CC13
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0019D270 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_0019D270
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_0019D403 SetUnhandledExceptionFilter,	18_2_0019D403
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: 18_2_001A1813 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_001A1813

HIPS / PFW / Operating System Protection Evasion

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\fxsound_setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\fxsound llc\fxsound 1.1.20.0\install\fxsound.x64.msi" ai_setupexepath=c:\users\user\desktop\fxsound_setup.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1700670463 " ai_euimsi="
Source: C:\Users\user\Desktop\fxsound_setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\fxsound llc\fxsound 1.1.20.0\install\fxsound.x64.msi" ai_setupexepath=c:\users\user\desktop\fxsound_setup.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1700670463 " ai_euimsi="			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f	Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010ACF90 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,FindCloseChangeNotification,

0_2_010ACF90

Source: C:\Program Files\FxSound LLC\FxSound\updater.exe

Code function: 18_2_0014DE30 LocalFree,LocalFree,LocalFree,GetLastError,SetEntriesInAclW,LocalAlloc,GetLastError,InitializeSecurityDescriptor,GetLastError,LocalFree,SetSecurityDescriptorDacl,GetLastError,LocalFree,CreateFileW,SetFilePointer,LocalFree,LocalFree,LocalFree,

18_2_0014DE30

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\fxsound_setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	0_2_010D30D0
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00007FF7E0715180
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: GetLocaleInfoW,	6_2_00007FF7E07153CC
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00007FF7E0714CCC
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: GetLocaleInfoW,	6_2_00007FF7E070C430
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: GetLocaleInfoW,	6_2_00007FF7E07155D4
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00007FF7E0715524
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00007FF7E0715700
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: EnumSystemLocalesW,	6_2_00007FF7E070BFF0
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: EnumSystemLocalesW,	6_2_00007FF7E07150E8
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Code function: EnumSystemLocalesW,	6_2_00007FF7E0715018
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: EnumSystemLocalesW,	18_2_001B01BA
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetLocaleInfoW,	18_2_001B0664
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: EnumSystemLocalesW,	18_2_001B6A1E
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: EnumSystemLocalesW,	18_2_001B6A69
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: EnumSystemLocalesW,	18_2_001B6B04
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_001B6B8F
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetLocaleInfoW,	18_2_001B6DE2
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_001B6F0B
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetLocaleInfoW,	18_2_001B7011
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_001B70E0
Source: C:\Program Files\FxSound LLC\FxSound\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	18_2_0012B6B0

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\fxsound_setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	Queries volume information: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\fxvadNTAMD64.cat VolumeInformation	Jump to behavior

Queries device information via Setup API

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

6_2_00007FF7E06F8C60

Contains functionality to query CPU information (cpuid)

Source: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Code function: 6_2_00007FF7E07111E0 cpuid

6_2_00007FF7E07111E0

Source: C:\Users\user\Desktop\fxsound_setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010DD180 GetLocalTime,

0_2_010DD180

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010E81C0 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,RegDeleteValueW,RegCloseKey,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegCloseKey,RegDeleteKeyW,RegCloseKey,RegDeleteValueW,RegCloseKey,

0_2_010E81C0

Source: C:\Users\user\Desktop\fxsound_setup.exe

Code function: 0_2_010E98C0 CreateNamedPipeW,CreateFileW,

0_2_010E98C0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Replication Through Removable Media	11 Native API	1 LSASS Driver	1 LSASS Driver	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	13 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Scheduled Task/Job	21 Windows Service	21 Windows Service	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	1 Scheduled Task/Job	12 Process Injection	1 Timestomp	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	46 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 File Deletion	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Masquerading	DCSync	141 Security Software Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fxsound_setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\FxSound.exe	0%	ReversingLabs
C:\Program Files\FxSound LLC\FxSound\updater.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSICC49.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shiCBDA.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDFA.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICFD1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID030.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID06F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID090.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID0BF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID0E0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID11F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID5C4.tmp	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF05B.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://sketch.com	0%	URL Reputation	safe
https://forms.gle/ATx1ayXDWRaMdiR59	0%	Avira URL Cloud	safe
https://download.fxsound.comK	0%	Avira URL Cloud	safe
http://microsoft.co?	0%	Avira URL Cloud	safe
https://forum.fxsound.comto	0%	Avira URL Cloud	safe
https://forms.gle/ATx1ayXDWRaMdiR59:Take	0%	Avira URL Cloud	safe
https://forum.fxsound.comD	0%	Avira URL Cloud	safe
http://crl3.di	0%	Avira URL Cloud	safe
http://crl3.digi	0%	Avira URL Cloud	safe
https://postman-echo.comdaveHttpClient	0%	Avira URL Cloud	safe
http://www.fxsound.comd	0%	Avira URL Cloud	safe
http://Locationftp:juceftp://https://GetAdaptersAddressesiphlpapi.dllhttps:	0%	Avira URL Cloud	safe
https://postman-echo.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
download.fxsound.com	45.79.74.123	true	false		high
drive.fxsound.com	45.79.74.123	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://drive.fxsound.com/cs/sgMPaBYtQvliu88/downloads3.fxsound.com/fxsound/1.1.20.0/updates.txt/download	false		high
https://download.fxsound.com/updates	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.fxsound.com/learning-center	MSIccd31.LOG.1.dr	false		high
http://www.fxsound.com	fxdevcon64.exe, 0000000A.00000002.1786670412.0000026492D45000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1753079231.0000026492D3B000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785091901.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786670412.0000026492D30000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1746456930.0000026492CD9000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785554355.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1745440876.0000026492CA4000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1750468970.0000026492CF6000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754124511.0000026492D30000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1750364754.0000026492CF6000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754969063.0000026492D30000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1752277277.0000026492D3D000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786448508.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1759276637.0000023D635A8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762206072.0000023D635AA000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762304235.0000023D63653000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762320499.0000023D6359B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1760450193.0000023D635A5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1762453362.0000023D63659000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757848935.0000023D6359B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757965297.0000023D635A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://downloads3.fxsound.com/fxsound/2/fxsound_setup.exeIE5	updater.exe, 00000012.00000002.1860559394.00000000007BD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.fxsound.com/changelogION#	fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.fxsound.com/learning-center/installation-troubleshootingFXSOUND_Oops	FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
http://crl3.di	fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fxsound.com/learning-centerARPNOMODIFYEnableUserControlARPNOREPAIRARPSYSTEMCOMPONENTARPU	fxsound.x64.msi.0.dr	false		high
https://downloads3.fxsound.com/fxsound/2/fxsound_setup.exe	updater.exe, 00000012.00000003.1859200242.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858157638.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858258759.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://forms.gle/ATx1ayXDWRaMdiR59:Take	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://sketch.com	FxSound.exe.1.dr	false	URL Reputation: safe	unknown
https://www.fxsound.com/presets	FxSound.exe.1.dr	false		high
http://crl3.digi	fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fxsound.com/learning-center/no-sound-with-fxsound-realtek	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://www.fxsound.com/changelog340	fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txt)c.	fxsound_setup.exe, 00000000.00000003.1663699741.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1663666127.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.fxsound.com/cs/sgMPaBYtQvliu88/downloads3.fxsound.com/fxsound/1.1.20.0/updates.txt/dow	updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.fxsound.com/J	updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://james722808.typeform.com/to/QfEP5QrPSupporthttps://www.fxsound.com/learning-centerChangelog;	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://www.fxsound.com/support	FxSound.exe, 00000011.00000002.2916156691.000001E918F7D000.00000004.00000020.00020000.00000000.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://james722808.typeform.com/to/QfEP5QrP	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://www.fxsound.com/blog/fxsound-is-now-completely-freeu	fxsound_setup.exe, 00000000.00000003.1667889626.00000000065A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.fxsound.com/B	updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.paypal.com/donate/?hosted_button_id=JVNQGYXCQ2GPG	FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://www.fxsound.com/blog/fxsound-is-now-completely-free	fxsound_setup.exe, 00000000.00000003.1663748027.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000002.1828323288.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1826659710.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1822558492.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825332773.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1663666127.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.fxsound.com/updatester	updater.exe, 00000012.00000002.1860559394.0000000000778000.00000004.00000020.00020000.00000000.sdmp	false		high
https://forum.fxsound.com	MSIccd31.LOG.1.dr	false		high
https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txtO	fxsound_setup.exe, 00000000.00000003.1824233531.0000000006557000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.fxsound.com/fxsoundlatest	updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858258759.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://forms.gle/ATx1ayXDWRaMdiR59	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://download.fxsound.com/	updater.exe, 00000012.00000002.1860559394.00000000007BD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.fxsound.com/updatesc	fxsound_setup.exe, 00000000.00000003.1824233531.0000000006557000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000002.1829373659.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.fxsound.com/learning-center/no-sound-with-fxsound-realtekPreset	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://www.fxsound.com/changelogIONw	fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://forum.fxsound.comD	fxsound_setup.exe, 00000000.00000003.1823613645.000000000659E000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1827593471.00000000065A6000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1825157251.000000000659E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fxsound.com/changelog	MSIccd31.LOG.1.dr	false		high
https://www.fxsound.com/changelognJ	fxsound_setup.exe, 00000000.00000003.1663748027.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.fxsound.com/	updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.fxsound.comK	updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fxsound.com/changelog.Click	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
http://microsoft.co?	updater.exe, 00000012.00000003.1844172601.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858511359.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1858202660.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1844277230.0000000000827000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/cps0/	fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	false		high
https://www.fxsound.com/changelogenter	fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.paypal.com/donate/?hosted_button_id=JVNQGYXCQ2GPG1.1.20.0	FxSound.exe, 00000011.00000000.1802280251.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe, 00000011.00000002.2917820911.00007FF604A2B000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
http://www.fxsound.comd	fxdevcon64.exe, 0000000A.00000003.1746508721.0000026492CC3000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785091901.0000026492CBB000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1752231616.0000026492D54000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1746442059.0000026492CE2000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786953682.0000026494A4D000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786953682.0000026494A40000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1753955898.0000026492D57000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754884252.0000026492CC8000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1750364754.0000026492CC8000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754439022.0000026492CC5000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786670412.0000026492D53000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785299209.0000026492CC8000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1785628821.0000026492D52000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1745440876.0000026492CAA000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000002.1786953682.0000026494A53000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1754686909.0000026492D53000.00000004.00000020.00020000.00000000.sdmp, fxdevcon64.exe, 0000000A.00000003.1752711142.0000026492D54000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1766071983.0000023D63633000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757965297.0000023D635A9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1769785529.0000023D63633000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1757770641.0000023D635A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/repository0W	fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	false		high
https://download.fxsound.com/updatesB	updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.fxsound.com/fxsoundlatestoad	updater.exe, 00000012.00000002.1860559394.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://forum.fxsound.comto	fxsound_setup.exe, 00000000.00000003.1823613645.000000000657B000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1827057502.0000000006585000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1824180068.0000000006583000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.advancedinstaller.com	fxsound_setup.exe, fxsound.x64.msi.0.dr, MSICC49.tmp.0.dr	false		high
https://www.fxsound.com/learning-center/installation-troubleshooting	FxSound.exe, 00000011.00000003.2149211092.000001E91B4E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.fxsound.com/updatesE	updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txt	fxsound_setup.exe, 00000000.00000003.1667845398.00000000065B7000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000012.00000003.1828414418.0000000002630000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000012.00000002.1860559394.0000000000781000.00000004.00000020.00020000.00000000.sdmp, MSIccd31.LOG.1.dr	false		high
https://juce.com	FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false		high
https://postman-echo.comdaveHttpClient	FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fxsound.com/changelog335	fxsound_setup.exe, 00000000.00000003.1826942285.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, fxsound_setup.exe, 00000000.00000003.1823035243.00000000065AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Locationftp:juceftp://https://GetAdaptersAddressesiphlpapi.dllhttps:	FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false	Avira URL Cloud: safe	low
https://postman-echo.com	FxSound.exe, 00000011.00000002.2917820911.00007FF604A54000.00000002.00000001.01000000.0000000B.sdmp, FxSound.exe.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.79.74.123	download.fxsound.com	United States		63949	LINODE-APLinodeLLCUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1346523
Start date and time:	2023-11-22 17:29:38 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	fxsound_setup.exe
Detection:	MAL
Classification:	mal42.evad.winEXE@28/103@2/1
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target FxSound.exe, PID 8084 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: fxsound_setup.exe

Simulations

Behavior and APIs

Time	Type	Description
16:30:44	Task Scheduler	Run new task: Update path: "C:\Program Files\FxSound LLC\FxSound\updater.exe" s>/silent

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	BEM00263.docx	Get hash	malicious	FormBook	Browse	45.33.6.223
	009c487a.exe	Get hash	malicious	FormBook	Browse	45.33.6.223
	Rgi3BxJNQJ.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig, zgRAT	Browse	139.162.232.28
	U6SJBLxT2Z.exe	Get hash	malicious	FormBook, GuLoader	Browse	45.33.23.183
	http://www.propertynoise.co.nz	Get hash	malicious	Unknown	Browse	172.105.178.19
	https://playervisual.com/tom/?37915841	Get hash	malicious	Unknown	Browse	45.79.7.19
	https://playervisual.com/tom/?37915841	Get hash	malicious	Unknown	Browse	45.79.7.19
	https://playervisual.com/tom/?37915841	Get hash	malicious	Unknown	Browse	45.79.7.19
	PGeBff2Pio.exe	Get hash	malicious	Sodinokibi, TrojanRansom	Browse	45.33.30.174
	GoogleCrashHandler64.exe	Get hash	malicious	Nanominer, Xmrig	Browse	172.105.211.250
	GoogleCrashHandler64.exe	Get hash	malicious	Nanominer, Xmrig	Browse	172.105.211.250
	SecuriteInfo.com.Win32.RATX-gen.10863.32284.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Trojan.Inject4.59820.15812.20006.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	137-AGROCHLOPECKI_OFFER_list.xls	Get hash	malicious	FormBook	Browse	45.33.6.223
	https://app.box.com/s/66xk2tdm22emcw1byhrb0qse73en82rp	Get hash	malicious	HTMLPhisher	Browse	50.116.10.131
	approval_order_PO.docx.doc	Get hash	malicious	Remcos	Browse	45.33.42.226
	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=gweninglis.com.au/hsg/dlajklshj/ukjwyskw02#d29qY2llY2gudXJiYW5jenlrQGtnaG0uY29t	Get hash	malicious	HTMLPhisher	Browse	172.104.63.236
	https://brelif.net/acd/ab4/tac.php	Get hash	malicious	Unknown	Browse	139.162.78.222
	SecuriteInfo.com.Win32.PWSX-gen.1807.23407.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	rRFQ0588904.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.79.74.123
	file.exe	Get hash	malicious	Vidar	Browse	45.79.74.123
	justificante_de_pago.exe	Get hash	malicious	FormBook, GuLoader	Browse	45.79.74.123
	psHlH7cF5E.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse	45.79.74.123
	123.ps1	Get hash	malicious	Unknown	Browse	45.79.74.123
	file.exe	Get hash	malicious	Vidar	Browse	45.79.74.123
	file.exe	Get hash	malicious	Vidar	Browse	45.79.74.123
	file.exe	Get hash	malicious	Vidar	Browse	45.79.74.123
	11_23_Helion_AM_Ersatzspeditionsauftrag.exe	Get hash	malicious	GuLoader, Remcos	Browse	45.79.74.123
	Informazione_Agenzia.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	Informa_Agenzia_Entrate.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	info_agenzia.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	45.79.74.123
	A_E_direzion.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	Agenzia_delle_Entrate.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	AE_inform.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	Agenzia_control.exe	Get hash	malicious	Remcos	Browse	45.79.74.123
	file.exe	Get hash	malicious	DarkTortilla, Djvu, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar	Browse	45.79.74.123
	New_Square_Document#46788%678.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.79.74.123
	Important_Document@#$%.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.79.74.123

Dropped Files

⊘No context

Created / dropped Files

(copy)

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
File Type:	data
Category:	dropped
Size (bytes):	10590
Entropy (8bit):	7.254430659006022
Encrypted:	false
SSDEEP:	192:1OgjZ7OPJCbngEw9JPgXkhYCClQBcA5E8qnajEzHbC:18UuLh3Cl+x5E8l4zu
MD5:	ACDAAE5D1219E7703285C42F774BE54D
SHA1:	47DF82D8C843BF1ADC098A26E9E3E27217B3104D
SHA-256:	25C8DAE186155D20F74FEEDEFB4F84161E4215925B8FD0C898F68F3E50EBCD7D
SHA-512:	83B663222FB22B1760EA8551D19557F3F2905BFAC205B380B23DD7F2A65A37B851A3C3C345E4A768B76700BB891B97C96A0DBBB58D81358993293AD1EB3E300A
Malicious:	false
Preview:	0.)Z...H........)K0.)G...1.0...`.H.e......0.....+.....7......0...0...+.....7.....7.M&...A.f..B....210319161347Z0...+.....7.....0..?0....#..6yS{.I..^o.Q{.A.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0.... Kt=..].....&...m.ng..,.....Q...\|1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Kt=..].....&...m.ng..,.....Q...\|0... ..\...{...p$..B.F.C8..C.p....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..\...{...*p$..B.F.C8..C.p....0.....w7=-{x\|<....8....O.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s......C0..?0....+.....7......0.....S.u.

C:\Config.Msi\4cce4c.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	19455
Entropy (8bit):	5.805768256272565
Encrypted:	false
SSDEEP:	384:UZsrtD0eThIJrhyKcHZbjrmlVk9FEk9FA9/0:U2rh0eThIJrY9MVk96k9Gc
MD5:	6205B541349D70CDF003D09F6493AECC
SHA1:	57421FEFD355047DF8507D822DE05679D4C12360
SHA-256:	8BD9311D99F88734288829C71EFA0E7294CD25DD70569A79DDA77EB5B2DE6EC3
SHA-512:	3229557F65D889E38C2ABA6A291849C89515396AEA1B8A037273C74F3C7052000AF9609DDA22F3CA69B2822BD8DDF34962EAF8A91029AD19EB5BB9DB9B8E00C0
Malicious:	false
Preview:	...@IXOS.@.....@.vW.@.....@.....@.....@.....@.....@......&.{14600665-0165-49E8-8017-D1BD6A290335}..FxSound..fxsound.x64.msi.@.....@.....@.....@......fxsound.exe..&.{D5DE046A-A59D-4852-B552-7C613C8DBEAF}.....@.....@.....@.....@.......@.....@.....@.......@......FxSound......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{215927B7-6543-4106-B941-F33B96B65E3B}&.{14600665-0165-49E8-8017-D1BD6A290335}.@......&.{82E872A6-8D59-4785-92C3-8BBFF79EB0E4}&.{14600665-0165-49E8-8017-D1BD6A290335}.@......&.{E6F40D13-6200-4931-A7A2-6142F7821778}&.{14600665-0165-49E8-8017-D1BD6A290335}.@......&.{EE536E27-12E6-4F20-A3E7-6A073AED85CB}&.{14600665-0165-49E8-8017-D1BD6A290335}.@......&.{FF4D6223-08FD-4830-A07F-C3307A8FA1B5}&.{14600665-0165-49E8-8017-D1BD6A290335}.@......&.{F8459A73-F385-4ED6-809A-50204A74B04F}&.{14600665-0165-49E8-8017-D1BD6A290335}.@......&.{D56B8D69-2366-40AF-BA27-0E50E5434C55}&.{14600665-0165-49

C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128920
Entropy (8bit):	6.533310057171278
Encrypted:	false
SSDEEP:	3072:u2XK2Ncn8sLtc666YCM/QVMmFbeN/dor5jwMLhynDU:NcttcyYP4tEor2ehynQ
MD5:	4EF82B076F26BBCEB356A3E226CF5238
SHA1:	525D5CA0001909F576120ADC8926B8C12A6106C7
SHA-256:	8A43BCC9DC92D121EF173D728F68BC77C937A0A136C949FD85802C6E0CD26879
SHA-512:	D849F895F8C41D28FF85BE5B8F3DC4E70F35A4289B91728D60C155DC53D855C6C4BE881C6B18C02C9D6A21A7C2116CE6674C09F61F1B97964895E30C9EB538F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................>......>......>........................................e..................Rich...........PE..L......e...........!...$.4...................P............................... ............@....................................x........................)..............p...........................H...@............P...............................text...\|3.......4.................. ..`.rdata...q...P...r...8..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66968
Entropy (8bit):	6.423656272557826
Encrypted:	false
SSDEEP:	1536:z9XQDo3evkZGiX4WU5LraxxpHC2F6oDE6496io2lcefUKIto2qfAF0EaFY2yOFa5:hXWo3e8wiX4WU5LraTpHC2F6oDR491o3
MD5:	EFE3CF96899C9D9CC25815F88E9466E2
SHA1:	1EC6B385A1F142C6AD7E92FFB8CFA8CF9FC7E415
SHA-256:	F29777FE088459C3F5B96384590FD0E1A2F3D947FB19ED866FB8F28F7D954143
SHA-512:	8544A35F70461C30A5C5004CB469315FAFB2DD17034AEE41F7127E3010703008ACAA78FBF26DD02E748A88BB39AEB41154F84CA10F6530FB032A7B536DE0335E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........'.j.t.j.t.j.t../t.j.t.4.u.j.t.4.u.j.t.4.u.j.t.4.u.j.t\4.u.j.t...u.j.t...u.j.t...u.j.t.j.tEj.t\4.u.j.t\4Ct.j.t\4.u.j.tRich.j.t........................PE..L.....&`....................."......S.............@.......................................@.....................................@........................)..........`...p...............................@............................................text............................... ..`.rdata...=.......>..................@..@.data...x...........................@....gfids..P...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209896
Entropy (8bit):	6.180609423723243
Encrypted:	false
SSDEEP:	3072:+ug+dP/Gc/vj7lxXdE/WgetVLFWPLFKmTRY81WVdSWRWiBQ:+6P/BzzC+getVLFWPZQlc
MD5:	B94BDE258AFA7DA0A9CD3FEB22A64EDD
SHA1:	D3867CEF5939CF4F73EAEC32EBD72D354C40B534
SHA-256:	3C44390B0C3CA51707EB977373788C155AF5F8197E3CE6D61F2775AF5B204FFF
SHA-512:	A74B6754544C6A188D59A24449271DF2519A7E54AD88F55F7CBDC50D8B7F2FE24297D0E84A39AA6E6CB3607926D9C49293B0F4092E3158E2353AE4C308EEBB8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.w...w...w..Q....w..Q...{w..Q....w......w......w......w......w..8.(..w...w..Aw......w......w...wt..w...*...w..Rich.w..........................PE..L......^.............................G............@..................................u....@..................................7..x........................#...`.......(..p............................)..@............................................text............................... ..`.rdata..............................@..@.data...03...P.......8..............@....gfids...............D..............@..@.rsrc................F..............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	239592
Entropy (8bit):	6.003536434480152
Encrypted:	false
SSDEEP:	3072:fWGh+NCEVePaUS11HF7isSN1W1q7KZXB/W5Sho8VRnK/qZWRWf:+tNCOrUS17VSNwqOnK/du
MD5:	4EAC440540483593DB5EDE2F7203417B
SHA1:	9C09D1CF19C6B7AED59D263EC560460475AEAA5D
SHA-256:	0DC27FF7BFB0D75FC6FCE439BC1AF557E68A18DED441DDEA8705DB6BF8DF9A4F
SHA-512:	874FD7A73226D74D5EE664FEAFBF29BB0DDF474891D43BB8CBE397CF9751A53CFECC1A981D3E39E25DA7228E0089B28170E603F14DE6455F9FFFFF0B4729CD68
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=v^.S%^.S%^.S%.~.%[.S%.~.%..S%.~.%S.S%=.P$V.S%=.V$x.S%=.W$K.S%0.V$U.S%...%Q.S%^.R%..S%0.Z$V.S%0..%_.S%^..%_.S%0.Q$_.S%Rich^.S%................PE..d..."..^.........."..................N.........@....................................L.....`.....................................................x....0...................#..............p...........................0................................................text............................... ..`.rdata..\|...........................@..@.data....=..........................@....pdata..............................@..@.gfids....... ......................@..@.rsrc........0......................@..@.reloc...............\|..............@..B........................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	269720
Entropy (8bit):	6.3385709845453615
Encrypted:	false
SSDEEP:	6144:wrRV8AjsaX6xJMmp/LyFEJ3tI8TD9BTzxlKohK4z+5AtH:C/OTMuTyeJGI9Bpso8KH
MD5:	87EAD9C6CD7486421E3142B2A6480F8E
SHA1:	64A7C04194E6CB5D467FFDD95A7E5BF25A6FD814
SHA-256:	52298E9EE19A8DF4BA59DFE89B7A51D6424DBA73B0FC2622D07FC6E7B9112681
SHA-512:	1F551258D8F538F6AE69125D724D905A2A00AE84900AFDA83299159AF008F1A6252B1A2CD005523BADA669B3677C7E8C6B44E3BF2DD6CFA63996DD047E354D96
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n............}......}.....w.....w......w.....}.b...}.......A..Hv....Hv....Hv=....Hv.....Rich...........................PE..d.....b.........."......\|..........D..........@.............................P......}e....`.........................................................0..........4#.......)...@.......o..p...........................Pn..@............................................text....z.......\|.................. ..`.rdata...........0..................@..@.data....*..........................@....pdata..4#.......$..................@..@_RDATA..\.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628759224235533
Encrypted:	false
SSDEEP:	96:3q9BSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3qzSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	328087CAF99B50D988A304BEEEA3FCE8
SHA1:	23FFEF913679537BB049008F5E6F8E517BB24192
SHA-256:	BA175CFDDD91B87BDDA3F1DF2A70249E1742E846B843381EB0438B70F91A110A
SHA-512:	D006E8DE0F9258A3EE75723E458D635586040702C1357630F199CF5740C7E29D87FEFD4B869A897BDD26B67FAD134E6BF35A2C01C3A00ACC8BF20181D7DA1AA3
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/17/2021,14.1.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	2.91036654915667
Encrypted:	false
SSDEEP:	768:3Ft4aLqpAogNTiqwu2CvcCjikibqqqqqqqqqqqqqqqqqqqaFgNj////////////l:T45A/N8Cfjik6scccoFtr
MD5:	EAF913C1DE47C2421669B662EDAA5A6A
SHA1:	53524526E1898A90FA98AE02E662B9C0E6DC2848
SHA-256:	425629B6309000013E8CD1A9B827BEE365D21C9F743873AADD0C3BC96A999D2A
SHA-512:	BB674FEB73751172A1ACE65AAB89C5EBF952A07F7AF0F3EC1DADF357FF693230CF08910AE273E8335EEC35E5827DA6405272D05C161987DF679199935AF21A76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................X.......X.R.....X.......Rich....................PE..d....@R`.........."......6..........0..........@............................. ......cM....`A....................................................<........\|...@...........$..........8)..8...........................p)............... ...............................text...)........................... ..h.rdata....... ......................@..H.data........0......................@....pdata.......@.......(..............@..HPAGE....J'...P...(...,.............. ..`INIT.................T.............. ..b.rsrc....\|.......~...X..............@..B.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10590
Entropy (8bit):	7.254430659006022
Encrypted:	false
SSDEEP:	192:1OgjZ7OPJCbngEw9JPgXkhYCClQBcA5E8qnajEzHbC:18UuLh3Cl+x5E8l4zu
MD5:	ACDAAE5D1219E7703285C42F774BE54D
SHA1:	47DF82D8C843BF1ADC098A26E9E3E27217B3104D
SHA-256:	25C8DAE186155D20F74FEEDEFB4F84161E4215925B8FD0C898F68F3E50EBCD7D
SHA-512:	83B663222FB22B1760EA8551D19557F3F2905BFAC205B380B23DD7F2A65A37B851A3C3C345E4A768B76700BB891B97C96A0DBBB58D81358993293AD1EB3E300A
Malicious:	false
Preview:	0.)Z...H........)K0.)G...1.0...`.H.e......0.....+.....7......0...0...+.....7.....7.M&...A.f..B....210319161347Z0...+.....7.....0..?0....#..6yS{.I..^o.Q{.A.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0.... Kt=..].....&...m.ng..,.....Q...\|1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Kt=..].....&...m.ng..,.....Q...\|0... ..\...{...p$..B.F.C8..C.p....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..\...{...*p$..B.F.C8..C.p....0.....w7=-{x\|<....8....O.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s......C0..?0....+.....7......0.....S.u.

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216472
Entropy (8bit):	6.58720462389318
Encrypted:	false
SSDEEP:	6144:Q0BoIohQyb1eSbUPWU7jTufjAOena7kWcoyt:iIsQybqWU7yjJpyt
MD5:	5CA5F72D8A7A6C1A265AA0E349BAEB59
SHA1:	1BDA4CA3D6541FEE025CB93664BEFF8A22C7356A
SHA-256:	9F07E799804897D2A9C1297322B66D753A9134A1BCA1CF7F13DC5834377A5381
SHA-512:	FFBD33AFB1D84B5225151F9B22BE914E8F2BB43D92D0A4C46818F796A997149505F610F38C1803910A476757352B18EB9AB8E6A227A5A60276FE62AC51E62BC2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.C...-...-...-.......-...)...-.q.)...-.q.....-.q.(.B.-...(..-...,...-...,..-..$...-..-...-......-../...-.Rich..-.........................PE..L.....b............................q........0....@..........................`......X.....@.........................p.......H........0...............$...)...@......p...p...............................@............0...............................text...,........................... ..`.rdata.......0......................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628759224235533
Encrypted:	false
SSDEEP:	96:3q9BSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3qzSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	328087CAF99B50D988A304BEEEA3FCE8
SHA1:	23FFEF913679537BB049008F5E6F8E517BB24192
SHA-256:	BA175CFDDD91B87BDDA3F1DF2A70249E1742E846B843381EB0438B70F91A110A
SHA-512:	D006E8DE0F9258A3EE75723E458D635586040702C1357630F199CF5740C7E29D87FEFD4B869A897BDD26B67FAD134E6BF35A2C01C3A00ACC8BF20181D7DA1AA3
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/17/2021,14.1.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322560
Entropy (8bit):	2.8824956385159206
Encrypted:	false
SSDEEP:	768:mwrXoME2X1k56OBvZTwJikibqqqqqqqqqqqqqqqqqqqaFgNj///////////////y:VfE2X1Ng2ik6sccco3tq
MD5:	C05A2F8F443C7D756F594B583D7C820F
SHA1:	0DA76FA1BA7CF5E631C8AC25E9A3C3BA105C5381
SHA-256:	7BA582F2B468502E7DFF903069A7A5E177479C92B483EB9EDBF683A85B423CB9
SHA-512:	5069C8D568D463324CF426D9CD14994D3E4912EA7921D4F9EAE3F3BFA6C6022AA4D9BD6834690A97C74DDBDA1ADFFE6F587FD631251ED53E663BC3E54A2238BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5..q...q...q...e..p...e..t...q...o...e..u.......{....._.p.......p...Richq...................PE..L....@R`.................2..........0p....... ....@.................................Z.....@E................................`p..<........\|...............$...........&..8............................'............... ...............................text............................... ..h.rdata..X.... ......................@..H.data........0......................@...PAGE..... ...@..."... .............. ..`INIT....h....p.......B.............. ..b.rsrc....\|.......~...F..............@..B.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvadntx86.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	7.255569051169796
Encrypted:	false
SSDEEP:	192:OOggMgObJC+ngEw9JPgXkhYCVyLHIMvN/qnajyCRe:OdNuLh3k/lmCo
MD5:	CC51E0BF07678A35F8CE058E2A674B18
SHA1:	F44CF566246C83C37177403439E8C203A672B543
SHA-256:	15D3EB929843C1A3D5AEAFC6D93E673906ABBB95208DF95009BA8962AC6AD11C
SHA-512:	EFD4A37255F375278B9AC9E9B1FE86A0B198B90E9F8E9494AD2D49A060B6C99905C69B7773439ED80CF48A673F3B6349B5657602D4456D50A2DC49118133139C
Malicious:	false
Preview:	0.)Q...H........)B0.)>...1.0...`.H.e......0.....+.....7......0...0...+.....7.....9lN.A..H. ..>.....210319161347Z0...+.....7.....0..?0....#..6yS{.I..^o.Q{.A.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0.... HYu.dQ...a.....s:1'm. .}X..+xi1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... HYu.dQ...a.....s:1'm. .}X..+xi0... ..\...{...p$..B.F.C8..C.p....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..\...{...*p$..B.F.C8..C.p....0.......d\-.u......];...u1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s......!0...0....+.....7......0.....S.u.

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	269720
Entropy (8bit):	6.338509183501062
Encrypted:	false
SSDEEP:	6144:crRV8AjsaX6xJMmp/LyFEJ3tI8TD9BTzxlKohK4z+5Atw:+/OTMuTyeJGI9Bpso8Kw
MD5:	225F1417E8EA755755A3C0E58F9FD09A
SHA1:	55B5165B0EB06441EF26FD16F66E1BE9D4EF8BFF
SHA-256:	F86FB7F2585BAF2D22FC35A70A34BCB724EB0B1B9C9D8D1BE7013E919AFE28AD
SHA-512:	B37E510FC8DE5D2E644A0D46E5AB81A8461E4A391F5F5F520B13D650832A977DA3A18F2DA9BF317D0FB34968E5CE58BB948B73210538F535707DB1DA227F1C27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n............}......}.....w.....w......w.....}.b...}.......A..Hv....Hv....Hv=....Hv.....Rich...........................PE..d.....b.........."......\|..........D..........@.............................P.......&....`.........................................................0..........4#.......)...@.......o..p...........................Pn..@............................................text....z.......\|.................. ..`.rdata...........0..................@..@.data....*..........................@....pdata..4#.......$..................@..@_RDATA..\.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628596767870037
Encrypted:	false
SSDEEP:	96:3quSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3quSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	82D8CBA970FF0CF924F8C750E4470873
SHA1:	F2EDC8BD8FCAF38976DC8E718D5D3ACE3BE82792
SHA-256:	042C6B79DFF1FDA007776F7EA14CAF4E7665F0A2A3F00644966EFDA6478B4939
SHA-512:	02B2E5FD829DE9C0C7841319376ABF2F2B89064CE59AEE8EC6B8F886DB25D7ADE4F05E1B5B3BBC76F0DE660F91C9799314B85A418DEBBB5A66ABE928A31C9B54
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/22/2021,14.2.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326120
Entropy (8bit):	2.895336145016568
Encrypted:	false
SSDEEP:	768:pAm4aLqpAogNTiqwu2CvcijikibqqqqqqqqqqqqqqqqqqqaFgNj////////////9:P45A/N8C/jik6scccR
MD5:	36F645D44476652DD078287D05499BC5
SHA1:	287A7AD815F60691942B0BF533B39C20AD43300D
SHA-256:	DAB6F4A9A68821FE8CC4B11AF19CC5FDE71E67FB9275E39E2ABDA680E477446B
SHA-512:	4CC4F625661EE755B44D94B8F4C91F7FFDB6DAF6DA39CD6147C5465C7448EB9620A0E71BAC6414AE2BBB99CE8CD379B03A98D70863CC384BE83F70BA00254FF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..!...!...!...5.. ...5..$...!...9...5..#...5..".....+....u. ..... ...Rich!...................PE..d...L.X`.........."......6..........0..........@............................. .......6....`A....................................................<........\|...@...........!..........8)..8...........................p)............... ...............................text...)........................... ..h.rdata....... ......................@..H.data........0......................@....pdata.......@.......(..............@..HPAGE....J'...P...(...,.............. ..`INIT.................T.............. ..b.rsrc....\|.......~...X..............@..B.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvadntamd64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9568
Entropy (8bit):	7.231189475826073
Encrypted:	false
SSDEEP:	192:VrIMfdZubhlYZputZscF8Bd1LoZo6wTBZHklE8:nFZQYZCZsHLoilht8
MD5:	381CF31B9363FB10C0E4DD4FA3847A74
SHA1:	8B360D53A6D63E1A32A650BD7326EFED17BEBEA5
SHA-256:	82EC9E6E7EC723052CB1D608A39DC41D501818027837730D0D9F3B42DBE750C8
SHA-512:	8DCBB28C2A35BE40B984F614B094B29E27F41AC0F679CD74BC39BDB3DEDAE129A53EBB95069D62B12FC355A2088FF74D643AE5E3CB7E1B216FB89CFFAB8EEE77
Malicious:	false
Preview:	0.%\...H........%M0.%I...1.0...`.H.e......0.....+.....7......0...0...+.....7.......L.7F.E..i...cY..210322123238Z0...+.....7.....0...0..w.RB.5.2.0.9.5.B.A.D.2.A.4.7.9.4.8.0.A.E.1.9.8.C.3.C.7.4.A.6.F.C.9.E.9.1.E.E.6.1.6...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+......... ...yH....Jo.....0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..o.RF.2.E.D.C.8.B.D.8.F.C.A.F.3.8.9.7.6.D.C.8.E.7.1.8.D.5.D.3.A.C.E.3.B.E.8.2.7.9.2...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..............v.q.]:.;.'.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0(..+.....7.....0....O.S........7.X.6.4...00..+.....7...."0 ...H.W.I.D.2........f.x.v.a.d...0:..+.....7....,0.

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216472
Entropy (8bit):	6.587544616995315
Encrypted:	false
SSDEEP:	6144:Z0BoIohQyb1eSbUPWU7jTufjAOena7kWcoyV:FIsQybqWU7yjJpyV
MD5:	939B76A79E780C43D9C93B4ED10F74E7
SHA1:	89A177E350055B45C9C5E20E2FA4BB61F1B02078
SHA-256:	0F03F95818362877E5D6293590AA5B5368AFDD895939B9918D786153BDB6DCC5
SHA-512:	253DAF7C95A02237AEADE781B7F5E6B0086A170574DAFE5793798AA936F70BDA36221B08597B3F08B9644D4F70922A6882563D2F2BE67E14ADC6B268D9C176CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.C...-...-...-.......-...)...-.q.)...-.q.....-.q.(.B.-...(..-...,...-...,..-..$...-..-...-......-../...-.Rich..-.........................PE..L.....b............................q........0....@..........................`............@.........................p.......H........0...............$...)...@......p...p...............................@............0...............................text...,........................... ..`.rdata.......0......................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628596767870037
Encrypted:	false
SSDEEP:	96:3quSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3quSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	82D8CBA970FF0CF924F8C750E4470873
SHA1:	F2EDC8BD8FCAF38976DC8E718D5D3ACE3BE82792
SHA-256:	042C6B79DFF1FDA007776F7EA14CAF4E7665F0A2A3F00644966EFDA6478B4939
SHA-512:	02B2E5FD829DE9C0C7841319376ABF2F2B89064CE59AEE8EC6B8F886DB25D7ADE4F05E1B5B3BBC76F0DE660F91C9799314B85A418DEBBB5A66ABE928A31C9B54
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/22/2021,14.2.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322024
Entropy (8bit):	2.869696033678278
Encrypted:	false
SSDEEP:	768:foXmL+F+U1Da96r9rWikibqqqqqqqqqqqqqqqqqqqaFgNj/////////////////b:w/YU1D34ik6scccR
MD5:	31B1A479F995A4A3EFF6E11BACC34400
SHA1:	11587B7105E94891470273D35C77EBC3ECAF1EBC
SHA-256:	A507119631F73432B9E98D8D33815FFED90156C3BFB7E5E81666591D46CE460F
SHA-512:	8AAF5E0919370163691B38F5B754C9391DEE12AFB8157CACE51ECE19503B20D96D220948D8ACE262778FD4EB98C48D5FF5B247C53E831CB793FACECAFEBE73C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5..ql..ql..ql..e...pl..e...tl..ql..ll..e...ul......{l...._.pl......pl..Richql..........PE..L...b.X`.................2..........0p....... ....@.................................2.....@E................................xp..<........\|...............!...........&..8............................'..@............ ..\|............................text...g........................... ..h.rdata..X.... ......................@..H.data........0......................@...PAGE..... ...@..."... .............. ..`INIT....r....p.......B.............. ..b.rsrc....\|.......~...F..............@..B.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvadntx86.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	7.230532185757443
Encrypted:	false
SSDEEP:	192:9fIMbdZubhlYZputZscF8Bd1LciivWBZHkWDVjO:ThZQYZCZsHLcDshFjO
MD5:	94015CF4A09898205476CEE29F2B75FA
SHA1:	9F847A10277C4CAF45A83FA0F53F5D525302AE39
SHA-256:	1A453865D234167FBE486F62D632373107994C634D9619E6D310C1DD3B5037E5
SHA-512:	A4B34E39DEB20BE3C1F27B3913EEC1B15454D5437EA41DB1C745CA9DAE35765588849FC05957CA27F2D1DDC309C023EC5013F7F7E8D08750003BE6AE299F59D4
Malicious:	false
Preview:	0.%]...H........%N0.%J...1.0...`.H.e......0.....+.....7......0...0...+.....7...... iX..xG..P.>D9...210322123242Z0...+.....7.....0...0..w.R3.3.3.B.F.5.C.F.4.B.0.B.4.A.8.3.4.9.0.1.F.9.3.F.A.2.0.9.4.9.F.F.7.6.3.5.C.A.7.0...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........3;..K.J.I..?..I.v5.p0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..o.RF.2.E.D.C.8.B.D.8.F.C.A.F.3.8.9.7.6.D.C.8.E.7.1.8.D.5.D.3.A.C.E.3.B.E.8.2.7.9.2...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..............v.q.]:.;.'.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0(..+.....7.....0....O.S........7.X.8.6...00..+.....7...."0 ...H.W.I.D.2........f.x.v.a.d...0:..+.....7....,0.

C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	944
Entropy (8bit):	4.77740089112828
Encrypted:	false
SSDEEP:	24:qElw1IoJ3RVyGt5djvBp0HOAppzttw5kuUBwDR:CKiyG5djzUtCt
MD5:	F27EA21512686DA8E8C90E0A4D0F5616
SHA1:	3231A236C4D517197E28413EED3F5AC74D557CD7
SHA-256:	B9FF4BAD7F89D0FDB9032B6AEA475A04FAC8C1EEC39020FA00DB3CD72B91E1FB
SHA-512:	45911C28BC677C223BAAF46B6CF1E12EDCE56BF9584FC3317535D8B3BE1AE0F402847C7DDD2D1E7E6DFC01C4C24D04965DC475B9419A85D7A703685335559DB9
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..General..0: Double Params Flag..1: Total number of elements..50: Main 0..20: Main 1..0: Main 2..0: Main 3..60: Main 4..60: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..0: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115: CF.. 0: Boost/Cut..Band 3.. 250: CF.. 1: Boost/Cut..Band 4.. 450: CF.. 2: Boost/Cut..Band 5.. 630: CF.. 0: Boost/Cut..Band 6.. 1250: CF.. -1: Boost/Cut..Band 7.. 2700: CF.. 0: Boost/Cut..Band 8.. 5300: CF.. -1: Boost/Cut..Band 9.. 7500: CF.. -2: Boost/Cut..Band 10.. 13000: CF.. 0: Boost/Cut

C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.8567723479487075
Encrypted:	false
SSDEEP:	24:q/vw1IcJOhRVyWWt5djvBp0TOAwUCJaSSOpNBlpA:coKryb5djzcL
MD5:	10A1B6C5A17F64D377394251C816FD73
SHA1:	3A54DBCB969269F9B4B63A0A72FEC51F9C1F2FD7
SHA-256:	5DA7F6318249417A1EDF02D133ED5543334389CE42E75CB904A311C680EF0D33
SHA-512:	DC32487CC4488F114C03605702F496AFF597797D1469FC246561F6C9055A4691B5E3AF6D1BCFFCAD6344310B1C1FEA27F70473D2C7A1F6BE6711D37047227C41
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Movies..0: Double Params Flag..1: Total number of elements..60: Main 0..50: Main 1..0: Main 2..0: Main 3..85: Main 4..35: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115.734: CF.. 0: Boost/Cut..Band 3.. 250: CF.. 2: Boost/Cut..Band 4.. 396.85: CF.. 0: Boost/Cut..Band 5.. 734.867: CF.. 2: Boost/Cut..Band 6.. 1360.79: CF.. 2: Boost/Cut..Band 7.. 2519.84: CF.. 1: Boost/Cut..Band 8.. 5350: CF.. -1: Boost/Cut..Band 9.. 8640.48: CF.. 0: Boost/Cut..Band 10.. 13800: CF.. 2: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.855292559830285
Encrypted:	false
SSDEEP:	24:q+w1IZBSRVyWWt5djvBp0TOAppUCJnpQSOpNBNpA:oKIyb5djzMl
MD5:	038E70D0B0223598B6F11890C7A39DA1
SHA1:	E790CA1456F895C6EF3A112BCEA575FC1F3A1006
SHA-256:	D05ED165422959C5F6B4C2B25FBE84B3BB0AA9BBDB72A6B0123BCB7CC2FB3CEA
SHA-512:	02BF6CD53AE7D2F1B9DE9868454A8937D72A787227496FE2D07F75AA296AA3FE71464E0ED610EF974E73C0F3E8B51939CE43C6563F2CDA958B7A7964DF42FBF9
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..TV..0: Double Params Flag..1: Total number of elements..50: Main 0..50: Main 1..0: Main 2..20: Main 3..60: Main 4..45: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115.734: CF.. 0: Boost/Cut..Band 3.. 250: CF.. 1: Boost/Cut..Band 4.. 396.85: CF.. 0: Boost/Cut..Band 5.. 734.867: CF.. 1: Boost/Cut..Band 6.. 1360.79: CF.. 0: Boost/Cut..Band 7.. 2519.84: CF.. 1: Boost/Cut..Band 8.. 5350: CF.. -1: Boost/Cut..Band 9.. 8640.48: CF.. -1: Boost/Cut..Band 10.. 13800: CF.. 2: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	4.810538314108478
Encrypted:	false
SSDEEP:	24:qCw1ImJqRVyXt5djvBp0qOA14/7Woh5fMBjfA:2KZyd5djzSSwx3
MD5:	EEC389C321A0F4E18D568D9EB52D4A4A
SHA1:	46555A411D1DBE75B4994B0D9C44C21B72243EDD
SHA-256:	33E8695F8DEDD7E7F4ED640C8F6412C1898D2A06489AAD41C09F0326BDC08DB7
SHA-512:	B61D04D025CF4CC2B1FE8CB5881F57BB0C2DD0B3FAB2F47548D433D6EE2B2419838379DAF115FDD9F0C797C9DE8366C21A6DBA1BAB7C6F1E5CC9F2AFA656BBB4
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Transcription..0: Double Params Flag..1: Total number of elements..100: Main 0..0: Main 1..0: Main 2..0: Main 3..115: Main 4..75: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..0: Integer[1]..0: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 86: CF.. -12: Boost/Cut..Band 3.. 250: CF.. 7: Boost/Cut..Band 4.. 293: CF.. 2: Boost/Cut..Band 5.. 615: CF.. -1: Boost/Cut..Band 6.. 1320: CF.. 7: Boost/Cut..Band 7.. 3430: CF.. 0: Boost/Cut..Band 8.. 4630: CF.. 10: Boost/Cut..Band 9.. 6360: CF.. 3: Boost/Cut..Band 10.. 11770: CF.. -12: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\2.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.801168282589878
Encrypted:	false
SSDEEP:	24:q3vw1IyvjRVyWWt5djvBp0COASiepELDYB0iA:JKUyb5djzV
MD5:	EE618C4C177068C08DACDFC8411D5610
SHA1:	726B0F02F137361D658EE0A45FE4C8AD64F83C87
SHA-256:	690ED5C16C33B8EFD0ED7C7AEF90F71E6DF3F20C2A44114E98CF8CF7355DBED8
SHA-512:	D1C6652D14ED28DC5D71D0017CE975F57F247E5134033384B50B0FF094C407CDB11E0AF4518A900025E4B56131F25AAC300E8702F4D6E7E267FDA44B93B8985F
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Music..0: Double Params Flag..1: Total number of elements..50: Main 0..35: Main 1..0: Main 2..35: Main 3..20: Main 4..60: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 110.0: CF.. 2: Boost/Cut..Band 3.. 250.0: CF.. 2: Boost/Cut..Band 4.. 370.0: CF.. 1: Boost/Cut..Band 5.. 650.0: CF.. 0: Boost/Cut..Band 6.. 1200.0: CF.. 0: Boost/Cut..Band 7.. 2130.0: CF.. 0: Boost/Cut..Band 8.. 4550.0: CF.. -1: Boost/Cut..Band 9.. 6850.0: CF.. 0: Boost/Cut..Band 10.. 16000: CF.. 2: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\3.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	965
Entropy (8bit):	4.861329835911262
Encrypted:	false
SSDEEP:	24:qYnw1IcEmJNPRVyXedjvBp0qOAOUAJtGJ7KxBr7cA:rwKcLLyudjzg
MD5:	8A3BB2B9767A3FD8397C2783F3EE1A65
SHA1:	8802B8F2FB027A8AF228548BA70D577138057EED
SHA-256:	77720ED67150B2C854A36F2F8002913E98788A9634BE0FC1540A19CA1423BFB6
SHA-512:	50184F85557C1CFAAAB4DC37693FB6AA854EE22E7D1061CA1780F16BDD57912F9726891A060AD74934E08DE4199BBD6B7E94914E42DD05BED9194012BF85DDBD
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Voice..0: Double Params Flag..1: Total number of elements..72: Main 0..0: Main 1..0: Main 2..0: Main 3..95: Main 4..0: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..0: Integer[1]..0: Integer[2]..1: Integer[3]..0: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115.734: CF.. -4: Boost/Cut..Band 3.. 214.311: CF.. -2: Boost/Cut..Band 4.. 396.85: CF.. 2: Boost/Cut..Band 5.. 734.867: CF.. 4: Boost/Cut..Band 6.. 1360.79: CF.. 5: Boost/Cut..Band 7.. 3430.8: CF.. 3: Boost/Cut..Band 8.. 5250.0: CF.. 3: Boost/Cut..Band 9.. 6300: CF.. 5: Boost/Cut..Band 10.. 11770: CF.. -11: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\4.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.827256471188213
Encrypted:	false
SSDEEP:	24:qBJw1IsJzlLRVyWWt5djvBp0rOAbUAJ4QSOpApBEiA:COKayb5djzhu
MD5:	54307B58B9FD001E1910F98FDB25D966
SHA1:	1DBDBE2906679A4C97FE294D90BBBAEB4EB4019E
SHA-256:	FC6CD10E51D33A70E74091A662054989D97CDE5AE705475C8D80F681708FF07F
SHA-512:	15D185CD1B740DC726AE9A77F0F650DE05E0C74F76DBF10E5BACA4124CDADDD30636D814CE051B4B0D3979CB4ED493C00925AE52B505FEBA9CEFAA528FAFD8CD
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Volume Boost..0: Double Params Flag..1: Total number of elements..32: Main 0..20: Main 1..0: Main 2..0: Main 3..103: Main 4..35: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 101: CF.. 3: Boost/Cut..Band 3.. 240: CF.. 2: Boost/Cut..Band 4.. 396.85: CF.. 2: Boost/Cut..Band 5.. 734.867: CF.. 0: Boost/Cut..Band 6.. 1360.79: CF.. 0: Boost/Cut..Band 7.. 2519.84: CF.. 1: Boost/Cut..Band 8.. 4670: CF.. 1: Boost/Cut..Band 9.. 11760: CF.. 2: Boost/Cut..Band 10.. 16000: CF.. 2: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\5.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	966
Entropy (8bit):	4.857342274064095
Encrypted:	false
SSDEEP:	24:qpRw1IRJOhRVyXt5djvBp0d5OAhHWiQSHvEGBaqA:kmKSyd5djzYL87
MD5:	471670C3295D3BBFED92E693981C30E1
SHA1:	23274FA49B6CCA00CA92CFF619B04EE657E4D97B
SHA-256:	F961856C2FEF99BCC9ABDA07BF3B1F19C9B16685208EA0E28CD4ED3F39778418
SHA-512:	54A54D9B8FFBE2B22F6151445D9F50941C738F112678DEDD5114D14503E4088CE77DF2D6428DB6E95DB6031A78E4F6444D8F8BA8ECEC360408EBEF9771D002E3
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Gaming..0: Double Params Flag..1: Total number of elements..35: Main 0..0: Main 1..0: Main 2..0: Main 3..85: Main 4..35: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..0: Integer[1]..0: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 128.75: CF.. 0: Boost/Cut..Band 3.. 238.311: CF.. 2: Boost/Cut..Band 4.. 444.0: CF.. 2: Boost/Cut..Band 5.. 805.0: CF.. 2: Boost/Cut..Band 6.. 1360.79: CF.. 0: Boost/Cut..Band 7.. 2519.84: CF.. -1: Boost/Cut..Band 8.. 4400.12: CF.. -1: Boost/Cut..Band 9.. 7930.48: CF.. 2: Boost/Cut..Band 10.. 12570: CF.. 2: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\6.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.857216071020656
Encrypted:	false
SSDEEP:	24:qAZIRw1IDluRVyWWt5djvBp0TOAVUCJ4QS7TBlOA:DimKSyb5djzRT
MD5:	3817D6E5582793099881320401DFDDD7
SHA1:	AC6CDB82AE160EB3E6A55B338A7332B8CAC3DD1D
SHA-256:	59024B05F345CBB6332A581C916676D685913F0EBD1A8D0D8ECAD395D9D11E3B
SHA-512:	DF55BEEA1F116F5B6996DFE0212A115582CDAE1B110726D94462F4D3D1E20FE0D1400591A9CCB966B2865A0EFCEF913FE03048C7BD60A974B6074FBF492B9403
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Classic Processing..0: Double Params Flag..1: Total number of elements..60: Main 0..35: Main 1..0: Main 2..60: Main 3..60: Main 4..70: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115.734: CF.. 0: Boost/Cut..Band 3.. 214.311: CF.. 0: Boost/Cut..Band 4.. 396.85: CF.. 0: Boost/Cut..Band 5.. 734.867: CF.. 0: Boost/Cut..Band 6.. 1360.79: CF.. 0: Boost/Cut..Band 7.. 2519.84: CF.. 0: Boost/Cut..Band 8.. 4666.12: CF.. 0: Boost/Cut..Band 9.. 8640.48: CF.. 0: Boost/Cut..Band 10.. 13500: CF.. 0: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\7.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	984
Entropy (8bit):	4.890210143884036
Encrypted:	false
SSDEEP:	24:qIZIRw1IIvxtCRVyZWt5djvBp0fOAQpU5pJeWSEfBNMvpA:/imKDyo5djz91i
MD5:	16F49CF8417B0E368FAEB40CB70F3239
SHA1:	CE95736E467389C60F5C23BEA0DFFCCE547D529D
SHA-256:	0CC4E260945485F45D2BEEAEC9D7FF8F8EAE92FBD7C094AED4B39ABCDFBA07B3
SHA-512:	08BFC9B87D9C28DB55EBFCEF8D00748B7F351538AB224A03F97E263928079CAB6C0755B4740F1F6481AB547103557148C4AA607969A25FD97E0E86CE039D4AA8
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Light Processing..0: Double Params Flag..1: Total number of elements..25: Main 0..0: Main 1..0: Main 2..35: Main 3..5: Main 4..20: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..0: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115.734: CF.. -1: Boost/Cut..Band 3.. 214.311: CF.. 1: Boost/Cut..Band 4.. 396.85: CF.. 1: Boost/Cut..Band 5.. 734.867: CF.. -1: Boost/Cut..Band 6.. 1360.79: CF.. -1: Boost/Cut..Band 7.. 2519.84: CF.. -2: Boost/Cut..Band 8.. 4666.12: CF.. -1: Boost/Cut..Band 9.. 8640.48: CF.. -1: Boost/Cut..Band 10.. 13600: CF.. 1: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\8.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	4.857752267847404
Encrypted:	false
SSDEEP:	24:qXwJw1I4v5RVyWWt5djvBp0d8O8wtZpFSHfBNpVA:TOK8yb5djztRO
MD5:	C4EF8C129665163D28601E229493892A
SHA1:	3737A43F1A503166E063A44DEF48152C5DEF1EFF
SHA-256:	4A22A50C3AA77F6E887CD9E30DE1D381BEF900D5391EC84AD3154546FD1399A8
SHA-512:	3257A8A3EACA06AA89FB4A26139F5908DAACFEC34C6613D94F78B458184BF41E52561F99A9B0CA6580DC8D7EB845F47EC30033C72C3CCF9F4410E2331C514466
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Bass Boost..0: Double Params Flag..1: Total number of elements..30: Main 0..35: Main 1..0: Main 2..35: Main 3..20: Main 4..75: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..1: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 98.0: CF.. 3: Boost/Cut..Band 3.. 158.3: CF.. 3: Boost/Cut..Band 4.. 345.0: CF.. 2: Boost/Cut..Band 5.. 541.867: CF.. 1: Boost/Cut..Band 6.. 1170.0: CF.. -1: Boost/Cut..Band 7.. 2519.84: CF.. -1: Boost/Cut..Band 8.. 4666.12: CF.. -1: Boost/Cut..Band 9.. 8640.48: CF.. -1: Boost/Cut..Band 10.. 14650: CF.. 0: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\Factsoft\9.fac

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.8615388361461545
Encrypted:	false
SSDEEP:	24:qjw1I9JaRVyGt5djvBp0TOAVUCJnpfpSOpHBlpA:pKcyG5djzr1
MD5:	D6712E9A03F84CA656BCB54815D11287
SHA1:	73D3CCD471460C24465597985329BC864B52C29A
SHA-256:	FBF25A50A996204B8F732E43ADF5ED8DB4FF6EAE6AA19C5832461B96AC71A016
SHA-512:	85DA0E65B9B0C18469165391343396DA5A3E9E153793FD6CCCF979F427C097A38DA5A439A7B10CBD5481A10E5435C1117BACEDFFB7B44F6C6872E40BCDE92483
Malicious:	false
Preview:	CLASS1 : Effect Type..9: Version..Streaming Video..0: Double Params Flag..1: Total number of elements..35: Main 0..35: Main 1..0: Main 2..0: Main 3..54: Main 4..35: Main 5..0: Element Number.. 0: Param 0.. 0: Param 1.. 0: Param 2.. 0: Param 3.. 0: Param 4.. 0: Param 5.. 0: Param 6..7: Number of Application Dependent Integers..0: Number of Application Dependent Reals..0: Number of Application Dependent Strings..1: Integer[0]..1: Integer[1]..0: Integer[2]..1: Integer[3]..1: Integer[4]..0: Integer[5]..2: Integer[6]..10: Number of EQ Bands..1: On/Off Flag..Band 1.. 62.5: CF.. 0: Boost/Cut..Band 2.. 115.734: CF.. 0: Boost/Cut..Band 3.. 214.311: CF.. 0: Boost/Cut..Band 4.. 396.85: CF.. 0: Boost/Cut..Band 5.. 734.867: CF.. 1: Boost/Cut..Band 6.. 1360.79: CF.. 1: Boost/Cut..Band 7.. 2519.84: CF.. 1: Boost/Cut..Band 8.. 5350.0: CF.. -1: Boost/Cut..Band 9.. 8640.48: CF.. 0: Boost/Cut..Band 10.. 13800: CF.. 2: Boost/Cut..

C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4595096
Entropy (8bit):	6.568137368170458
Encrypted:	false
SSDEEP:	98304:qJTC0pDGBBBBBBBBBBBBBBBBBBBBBBBBBU2U1oO:iTLDGBBBBBBBBBBBBBBBBBBBBBBBBBU7
MD5:	0A1E1E6B90FE62B9011393501BEF58D7
SHA1:	AA1A03B628301E17A17B178E7307780AA54B93CE
SHA-256:	F934DE57CFA0633F125B6707D21727F25B02D7C96E13FDCF3CB84042EE43876B
SHA-512:	1E9236D3F22114BD9A3DC91F64618F9E1803F26107A3E4FA7763DC14B3CA9487C7D31ED0D09AA10A54A8868B5982A23D1675694A7D262167424B1B5407180B7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........B.....................R...............................................t..................................P.......8............Rich............PE..d...K..e.........."....$..+.........@..........@..............................G.....^XF...`...................................................A.T....`F......@D.4.....E..)....G.(\|....:.T.....................:.(.....:.@.............+..............................text...8.+.......+................. ..`.rdata..>.....+.......+.............@..@.data...ti....A.......A.............@....pdata..4....@D.......B.............@..@_RDATA..\....PF.......D.............@..@.rsrc........`F.......D.............@..@.reloc..(\|....G..~...vE.............@..B........................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Bold.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 17 tables, 1st "GDEF", 13 names, Microsoft, language 0x409
Category:	dropped
Size (bytes):	201148
Entropy (8bit):	6.077443346933577
Encrypted:	false
SSDEEP:	3072:bbUD3Sp234i3viK7ldlrTft7yEeVfvVF1wSlCfzMV4lzCO0aMbVKgdIxfBEP:b4Di81v3ftneVfb1wXMizCtjzdIg
MD5:	DEC15F4454DA4C3DCDBA85A36C9F9A37
SHA1:	EE2C78FD0AF8AA895F15A93F9A61E13A960C17F3
SHA-256:	4A204F20F82129D09196FA3F16F2340B9CBBE2FC5E27038E0E57F76E03D96E38
SHA-512:	2FAAF11B8C6B5F487E8D563C8BA05F8CD34FA595AC2AD3CB9B1BFF29283DB7BE33D9345DFD9C19BD3EB058BBB8F45C32649F4B18E35F33CA300B35A516AEAB33
Malicious:	false
Preview:	............GDEF............GPOS.}.7...<...\|GSUB.$+...C... "OS/2V.B.......`cmap.<..........cvt 3...........fpgmM$.\|.......mgasp............glyf...........head.M.:...h...6hhea...i...D...$hmtx\|. ...-P....loca.#.9.......Pmaxp...J...$... named..G........post......d...9,prep.K.........................N...R.....(.:.......m...................1.s........................33.7"._.<............F......x......s.4.........................X...K...X...^.2.B............ ...............ULA .............U.. .............. ...K...RX....Y.......cp...B@..k[K;.'.....B@.p.`.P.@.4.,........B@.r.h.X.H.:.0.%......BA..@.@.@.@.@.@.........BA..@.@.@.@.@.@.@.......D.$..QX.@.X..dD.&..QX......@.cTX...DYYYY@.r.b.R.B.6... .............D..d..DD............................................................................>....."...6.........?...J...........?.?.....J.J.......................>......."...6.........;.........>.C....."...>...........G.......>......."...6.............4............."...$.5...7.:...<.=...B.\

C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Medium.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 17 tables, 1st "GDEF", 15 names, Microsoft, language 0x409
Category:	dropped
Size (bytes):	199912
Entropy (8bit):	6.096339699160351
Encrypted:	false
SSDEEP:	3072:1DmsP234i3vSKmaHeqI9vOogmrctL7CzXjvfEZgczCLy5Bw9upmnJ0:1Dmse1v3He7Hh3zcBOupmnJ0
MD5:	4C61E408402414F36F5C3A06ECC5915B
SHA1:	F3C1C9E778680061C35EC512C918F1A630868872
SHA-256:	02CF88921629EEBFB25FBBCF5D46D0EF5BB307BB0D8AF482F47A65BB6620B088
SHA-512:	8F98065BD0B2FDA1A658FCCF9166BB4387A279D3471FFA8BE43B78FF874EE62735350390157270BC73A9AD84B7AC2DF81FC0538E3B5B569965C3D1BA55C47B92
Malicious:	false
Preview:	............GDEF............GPOS...6...t...GSUB.$+...D$.. "OS/2V..J.......`cmap.<..........cvt 0...........fpgmM$.\|.. ....mgasp............glyf.@........\|.head.8.!...h...6hhea...A...D...$hmtx+Bn...-.....locaKc.........Pmaxp...T...$... nameg5.........post......dH..9,prep.K.........................L...P.....6.H.......m...............R...B.5........................33)..w_.<............F......x......5...........................X...K...X...^.2.>............ ...............ULA .............U.. .............. ...K...RX....Y.......cp...B@..k[K;.'.....B@.p.`.P.@.4.,........B@.r.h.X.H.:.0.%......BA..@.@.@.@.@.@.........BA..@.@.@.@.@.@.@.......D.$..QX.@.X..dD.&..QX......@.cTX...DYYYY@.r.b.R.B.6... ...*..........D..d..DD............................................................a.a.T.T.........>.........8.b.b.T.T.8...@...b.b.T.T.8.8.....@.@.....a.a.T.T...........>...........8.a.a.T.T.;.........>.@.........>.a.a.T.T...G.......>...........8.............4............."...$.5...7.:...<.=...B.\

C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Regular.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 17 tables, 1st "GDEF", 13 names, Microsoft, language 0x409
Category:	dropped
Size (bytes):	201976
Entropy (8bit):	6.085964601621602
Encrypted:	false
SSDEEP:	3072:N5ZPg234i3vgm8LjbRWJrqi+Z5qefAMTvP/fXJGeqNE5Hv:Nrb1v18LjbwN/KAMTvPHXgZN4v
MD5:	AED416691BA9AFB1590D9DDF220F5996
SHA1:	8A441A013BB65EDB42D747EFC85CABA6D4149464
SHA-256:	720187E6F1FEC0D3510A9407BFDF8B952DC61BD990EDEBAA477FBD72F66775C5
SHA-512:	06B7933D35247259EA58271C6EDADB1DC7CAE80A158A47A4F41192773876C08F3DC0B31D5E11948936CFA6F696DAB1F6B10B9B5A697DBC7ACD06BCB49EFC44EC
Malicious:	false
Preview:	............GDEF............GPOS..f>...T....GSUB.$+...D... "OS/2U..?.......`cmap.<..........cvt /2..........fpgmM$.\|.......mgasp............glyfQ.....8....head./.....h...6hhea...0...D...$hmtx......-h....locaqO.9.......Pmaxp...V...$... namef.1........post......d(..9,prep.K.........................L...R.....6.H.......m...............;...H..........................33.k.._.<............F......x........................\|.........X...K...X...^.2.;............ ...............ULA .............U.. .............. ...K...RX....Y.......cp...B@..k[K;.'.....B@.p.`.P.@.4.,........B@.r.h.X.H.:.0.%......BA..@.@.@.@.@.@.........BA..@.@.@.@.@.@.@.......D.$..QX.@.X..dD.&..QX......@.cTX...DYYYY@.r.b.R.B.6... .............D..d..DD............................................................H.H.>.>.........>.........9.H.H.>.>.5...<...H.H.>.>.5.5.....<.<.....H.H.>.>...........>...........9.H.H.>.>.;.........>.?.........>.H.H.>.>...G.......>...........9.............4............."...$.5...7.:...<.=...B.\

C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Bold.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	4909668
Entropy (8bit):	7.368899402965331
Encrypted:	false
SSDEEP:	98304:enEug8DH6ILVsFG88XJb2kRAOpEa3m5L4IlSyHApLmSi72TJiqvYg5Ka6xQQ3L:eu6dAl8ZTRAOpl30c6ELWmiqvY6yrL
MD5:	E2406FF1791C401BC93E73D9E44E6D2B
SHA1:	49E50DE244558C4C21F43D85B7404CABB970B30B
SHA-256:	E7BE1CDB169344A75BDF09F8563DCF5E662194BE3064873B6B4CA57E0BA0774F
SHA-512:	2A386A33F204FA5D07DA0DA4BB45590DDECA669235B77471FCA2E5405F749C9AD35289D439F48F2340377E27EE85725644C6F051D6DEEA10ED9C49B837B845FA
Malicious:	false
Preview:	OTTO.......pCFF .......\|.E..GDEF............GPOS\.._..x<....GSUB..0.......j4OS/2...........`VORG....... ....cmap......%h....head.!4g.......6hhea..iv...@...$hmtx............maxpa%P.........name..H........:post...2... ... vhea.jv....d...$vmtx..Rc..........P.a%.........................................2.....................................n................a%...............>.n................_............j_.<...........x.......x......n...........................X...K...X...^.2.E............0...+.<.........GOOG. . ...p....... `.............. .......p.....f...k...k...z...........g...`.......{...g...g...g...g...g...g...g...g...g...g...g...g...g...................................................W...^...^...W...W...^...W...^...^...^...W...^...^...W...W...^...W...^...^...^...d...d...k.$...%...&.a.'.h...b...a...............b.......g.......g...v...g...g...g.......g...................g...v...g...g...g...................}...................v...................................-...O...a...a...g........

C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Medium.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	4768768
Entropy (8bit):	7.457467785730833
Encrypted:	false
SSDEEP:	98304:ZyEuezzWZAAjDyfnbWfANGPj89xGXE5D6fUdeujQlae22ljN1PSTl/EsqoCXpmU9:ZlzyZAAnyvbWY/9MODkKQl92YjeTls1L
MD5:	32666AE307200B0BCAB5553590672BB1
SHA1:	A4CDC5C494D118E231A32DDA98373E7835AC9DD8
SHA-256:	256BB06B91D974DDBC0E3C063C85522CDA6187CC638F0C6AE5D752EFA63FE093
SHA-512:	EB1459B024346ECB2A2014A481202C76988F2757C1287908295ECBF71E51CE1FDB886CC07C28B49D86FAEDD59FBFC7C017D5C5B797D03447314F882184E76847
Malicious:	false
Preview:	OTTO.......pCFF ...o.....B..GDEF............GPOS.....xx....GSUB..0....D..j4OS/2.G.........`VORG....... ....cmap......$.....head.'3........6hhea..i....@...$hmtx.i.....P....maxpa%P.........name..R........ppost...2... ... vhea..v....d...$vmtx..o....H......P.a%.........................................2.....................................o................a%............. .O.o................_............y_.<...........w.......w......o...........................X...K...X...^.2.E............0...+.<.........GOOG... ...p....... `.............. .......p.....d...g...g...v...........d...k...].......x...e...d...d...d...d...d...d...d...d...d...d...d...d...................................................T...[...[...T...T...[...T...[...[...[...T...[...[...T...T...[...T...[...[...[...d...d.$...%...&._.'.e..._..._..............._.......e.......e...u...e...e...e.......e...................e...u...e...e...e...................\|...................u...................................*...O..._..._...e........

C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Regular.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	4744692
Entropy (8bit):	7.421579840888723
Encrypted:	false
SSDEEP:	98304:WREu/Kcw9VIXKPq8fCupfDdcCMjfe3NmletiwzaSs3ItjgB7v2bGPzraG69s9U59:WzbW+XKPPKqrd18f9MScGPXaVIU5YBQ
MD5:	210989664066C01D8FFDBDF56BB773CD
SHA1:	5F533D0D5CAF3847AFA2D78301E7B87B3485ECBC
SHA-256:	29445948E432137E0DE104DEC389E956D72633AA0E4CB04CA572BB8E378E3D35
SHA-512:	86AB46CE5F441AB7ADE525B0ACE1347D0B26A77303CDE9F11C68C772431E9CE181F50847C9D4D31026752F6230E66549692108DF9F1197F99C42FB5525C42ADC
Malicious:	false
Preview:	OTTO.......pCFF ...=....B.YGDEF............GPOS......x.....GSUB..0.......j4OS/2...........`VORG....... ....cmap......$.....head.-3}.......6hhea..i....@...$hmtx............maxpa%P.........name..Hy.......*post...2... ... vhea..v....d...$vmtx...j..........P.a%.........................................2.....................................p................a%.............6.[.p................_...........7h_.<...........w.......w......p...........................X...K...X...^.2.E............0...+.<.........GOOG.@. ...p....... `.............. .......p.....c...d...k...d...........b...i...[.......u...c...b...b...b...b...b...b...b...b...b...b...b...b...w...w...w...w.......w...w...w...w.......w...w...R...Y...Y...R...R...Y...R...Y...Y...Y...R...Y...Y...R...R...Y...R...Y...Y...Y...d...d.$...%...&.].'.c...]...]...............].......c.......c...c...c...c.......c...................c...c...c...c... ...............{...................................................'...N...]...]...c....................

C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Bold.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	8716392
Entropy (8bit):	7.495261473238618
Encrypted:	false
SSDEEP:	196608:tYotfY/gXxDZWgpU9Gt1Bzo5UO86DT2O/Hq8ADWmAp5G9r+4wNQ/+W:xtg/+DEx9RU0T2O/UW1p5G9lk+
MD5:	9C8CB849CB0041912EC77C9C59725A2A
SHA1:	60A514FD2A07CA63EBD7F5484951E50CB03F4FC2
SHA-256:	D1961BE1161EA1BE08496C920862D06EA5C23A757628F4FD69368DE1D9F51BED
SHA-512:	2C89324DCC21D9AAA44258BF96A295115F19B8264AB125250E20AB5BE0A7C1A55754BD754B569D938C7145FB431FCAFDA75900CD461F6A3FADD2D38728D13931
Malicious:	false
Preview:	OTTO.......pCFF G8j........fGDEF............GPOS.7"e..\|....^GSUB..2.......)`OS/2...........`VORG#)..... ....cmap].....7h..E#head.!4{.......6hhea.......@...$hmtx.^K^...0....maxpx.P.........name..H........:post...2... ... vhea.j.o...d...$vmtx..yr.......B..P.x..........................................2.....................................n................x................>.n................wm........D..E_.<...........x.......x......n...........................X...K...X...^.2.E............ ...*.<.........GOOG. . ...p....... `.............. .......p.....f...k...k...z...........g...`.......{...g...g...g...g...g...g...g...g...g...g...g...g...g...................................................W...^...^...W...W...^...W...^...^...^...W...^...^...W...W...^...W...^...^...^...d...d...k...........a...h...b...a...............b.......g.......g...v...g...g...g.......g...................g...v...g...g...g...................}...................v...................................-...O...a...a...g........

C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Medium.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	8508580
Entropy (8bit):	7.531997873570796
Encrypted:	false
SSDEEP:	196608:jhk120oT4Q8zL13Y0kv11hkQzvL9+fWdJMEtr9HYMiOA5dZARxZsa2Hl9:9OQTD8zL1DkdzZL9+eJT4MjMKRbp2z
MD5:	34D4F8EE5AD2748A4CF36D3D414B49AF
SHA1:	57F0F560DF654BC8E322A44C947672AE92CD2FAD
SHA-256:	9C62CEB174D7529AE4A7F2071F6531991CFADBC2F1897910B48BA951A580AC57
SHA-512:	63D2E90007C7D26203E5010291478A431701018F6A75107C2365DCF3B968CE38086CED05E31C57505B5C2564E22A32E63410E5B143D57F7ED914276967096788
Malicious:	false
Preview:	OTTO.......pCFF ...q...x.\|.,GDEF............GPOSN.....\|.....GSUB..2....D..)`OS/2.G.........`VORG....... ....cmap].....7...E#head.'4........6hhea.......@...$hmtx..\.........maxpx.P.........name.eR........ppost...2... ... vhea.......d...$vmtx.......d...B..P.x..........................................2.....................................o................x.............. .O.o................wm..........._.<...........w.......w......o...........................X...K...X...^.2.E............ ....<.........GOOG... ...p....... `.............. .......p.....d...g...g...v...........d...k...].......x...e...d...d...d...d...d...d...d...d...d...d...d...d...................................................T...[...[...T...T...[...T...[...[...[...T...[...[...T...T...[...T...[...[...[...d...d..........._...e..._..._..............._.......e.......e...u...e...e...e.......e...................e...u...e...e...e...................\|...................u......................................O..._..._...e........

C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Regular.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	8482020
Entropy (8bit):	7.490491055703114
Encrypted:	false
SSDEEP:	196608:V7zc85mwwTUbsFIpaGu97lX6vf6LzkROpDYBFSvjL/0jbGQH2YQylFW:i85mzTDGu97gEzkRNrS3/NC29ynW
MD5:	E3AE561F7B8052D9AA9F2B0B09C33EA1
SHA1:	7FB779EA2A8D83D7F80D4A2865D1EBB5E3CF1257
SHA-256:	A2B93E6C2DB05D6BBBF6F27D413EC73269735B7B679019C8A5AA9670FF0FFBF2
SHA-512:	32B1F305AEC14A5EA7C1166F76C5BA7DCD1D4FCF513902EA1E2811EC1F2B72CC73EFB6CAE4369FD877619EE66EAABD014C6ED0FF7C9D9B5E7F1C5FF3DCC8E8AD
Malicious:	false
Preview:	OTTO.......pCFF .^.......\|..GDEF............GPOSS`.8..\|h....GSUB..2.......)`OS/2...........`VORGb...... ....cmap].....7D..E#head.-3........6hhea...&...@...$hmtx...H...H....maxpx.P.........name..Hz.......post...2... ... vhea.......d...$vmtx...........B..P.x..........................................2.....................................p................x..............6.[.p................wm..........._.<...........w.......w......p...........................X...K...X...^.2.E............ ....<.........GOOG.@. ...p....... `.............. .......p.....c...d...k...d...........b...i...[.......u...c...b...b...b...b...b...b...b...b...b...b...b...b...w...w...w...w.......w...w...w...w.......w...w...R...Y...Y...R...R...Y...R...Y...Y...Y...R...Y...Y...R...R...Y...R...Y...Y...Y...d...d...........]...c...]...]...............].......c.......c...c...c...c.......c...................c...c...c...c... ...............{...................................................'...N...]...]...c....................

C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Medium.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 14 names, Microsoft, language 0x409, Copyright 2022 The Noto Project Authors (https://github.com/notofonts/thai)Noto Sans Thai Medium
Category:	dropped
Size (bytes):	46448
Entropy (8bit):	6.342108991808269
Encrypted:	false
SSDEEP:	768:mK81vBz2gZztejCF0T0y/bGxWBraFRP+PTleQBJ/vmjpJIuzXrlay+Jv8iqK5:mKMZzrE0tFRKTl1/vmxBay+Jv8iqK5
MD5:	B26FBAE4345B2CD98CF41FCA34206B56
SHA1:	A4075B2CFEAE20A076B0303622F3EC7A4A558480
SHA-256:	6ACDBF858F40BCC0FA57B3971B1C5FE904C46B38DF8E4073556BD51F22FED358
SHA-512:	E560A762DB0E95D5C85A7392C7E7622DA101DDADCCC3AC90C2ED09668FFD5AC4662EAB4EAC1A9486F599ABF0F321C3783D62838D48DD0046489B3BC26F486E0A
Malicious:	false
Preview:	............GDEF...\........GPOS.`.....p....GSUB>.C....@....OS/2...........`STAT.[.W...0...@cmap..TL........gasp.......\|....glyfm.......w.head..<...\|....6hhea.5.....h...$hmtx......}....`loca%.....y.....maxp......x.... name>.cL.......xpost..v;...p....preph..............^............3.!.%!.!^.....5.....63.d.............3....7..#"&&54632...&&#"....326553.3.3..#"&'7..326553..H..Y?6U0SJ.$..... +3363k...'<#.0.....39k..Z.C='P;KV..K..(,099....f,:...C..<:x.....K...........#.'..7.32............#'32654&##532654&##..3.K.{y@;(A&7eF..K;>NzvH7DGjQ@$..JU8K..."?1:R+V=-,7V0,-).w.2.....N.....$....."&5.3...3265.3....2zjk;>><kk.ph.W..?>>?.Z..hp...&...../....35#53.326654&&#"..56632......#.G..)8.!H:1V&.c;]p30n[.L.'UDFW'..`..B~[X{A...3.....+.=..."&554676654&#"..'6632.............326554&##5326653............dk...........9.'0........00 $..& .k.,...e.^\7/9..".....H.../ #0..,%50./..#&?%6.7L... )..T[...O...../.#..."&&553...326554&&#"..56632....#'#....8Q,i54@H%E01\(.j?Vk2U...Y.&P@.{58REV<B...`..6hM..Q'4...?...B

C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Regular.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 12 names, Microsoft, language 0x409, Copyright 2022 The Noto Project Authors (https://github.com/notofonts/thai)Noto Sans ThaiRegular
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	6.332636311465189
Encrypted:	false
SSDEEP:	768:tKC1+LWAHjb4oBQ4TETj4oaNGrHmcsa3cGr2yxzQqaf2KVvbd+9MzXrlaKn8iqK8:tKo4400XHDsa39/x8qevBBaKn8iqK8
MD5:	DB4FA9CBA5C3BED6D99A608207F5240B
SHA1:	65AF553B1091B015CAFEA3A1498C9F8E36997864
SHA-256:	2166DDD8DD7650AC7A7D81FD229CACBE99C06CF559D93DB3B37D356312DEB405
SHA-512:	BD81A38A4ADB1849D19393D6476719C13E93EA418DCF369E38872D0FF59325FD8058AC683B514EE3B6663FD8F88BABDA0CFD065CC5E0F7ED9E1858B5893F031F
Malicious:	false
Preview:	............GDEF...\...`....GPOS...#...L....GSUB>.C.........OS/2._.........`STAT...V.......Dcmap..TL........gasp.......X....glyf.#.......w.head..<...\|....6hhea.5.....`...$hmtxw.....}....`loca#..b..y.....maxp......x.... name9][........Zpost..v;...L....preph..............^............3.!.%!.!^.....5.....63.d.............3....7..#"&&54632...&&#"....326553.3.3..#"&'7..326553..L..Z?7U/RH.#.....#/87;7Y...)>#.......7<Y..a.F=(O:JU..C..,/14>>....l-;...:..?=w.....O...........#.'..7.32............#'32654&##532654&##..3.O.{\|@<)B'8eF..RADVzvP;JNiY=$..IV9J..."?2:Q+LA1/;M301+.n.2.....Q.....$....."&5.3...3265.3....-vfY@CDAYg.ld.^..CBBC._..dl...&..........35#53.326654&&#"..56632......#.L..-<.!I>/W(.b9[m0/iX.F.(ZJJ\..S..C~ZW{A...6.....*.=..."&554676654&#"..'6632.............326554&##5326653............_g...........5.%-......2.24"&..)".Y.....`.[[=2:..".....@...-.%0...%;.2./1.%'9&7.5J...!)..MW...Q.......#..."&&553...326554&&#"..56632....#'#....8S-X::GN'H30[+.g=Uj1I...[.'Q@..7=YIZBH...S..6hM..Q(3...B...9

C:\Program Files\FxSound LLC\FxSound\updater.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1057176
Entropy (8bit):	6.336031755439875
Encrypted:	false
SSDEEP:	12288:vgDKXk+MUYWnd/xgHKfZKKuDeNnEQh9Ip+o55cZPBREGz5ItHXBhb:vq+26/bse+g9UgZPBREGz5oHXBhb
MD5:	BC7B29CD513AEC979CEFBF30E6D68A01
SHA1:	26CAF25713A32D16658F062E14CD7C6068F536E4
SHA-256:	5FD669E66046950328A555C8F3223D9F3E8599C7128E9DE15D29BD76CDE5DE30
SHA-512:	AEA0CC8B1B195149DFD662948E04250CB6539B7C836C64AE8DE8C11A916A9CBEA13486691F33FE8FB1060CA3E267DCA385A5913DEC66A9CFE641B8FB98A57B69
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.k..{8..{8..{8.ex9..{8.e~9~.{8.m.9..{8.mx9..{8.o~9..{8.m~9..{8.e.9..{8.e}9..{8.ez9..{8..z8~.{8.mr9..{8.m.8..{8.my9..{8Rich..{8........................PE..L...[..b..........".... ............o........@....@..........................0.......F....@.....................................,....P...:...............)......<...@...p............................\..@............@..t...d........................text....-.......................... ..`.rdata..Z....@.......2..............@..@.data...<)... ......................@....rsrc....:...P...<..................@..@.reloc..<............X..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\FxSound LLC\FxSound\updater.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	484
Entropy (8bit):	5.430713079925545
Encrypted:	false
SSDEEP:	12:1CGbPmi+BtvtSx7u1XK3VyXWCECFbSt7MecHB8zQ:1nn+be7u18V6g7MeRzQ
MD5:	66DF04C3C3E209E28CD4226DDA3FA646
SHA1:	A07956CF11956D975F601CA25D3267485319764B
SHA-256:	7290DBD8641C8D682005AE0E93DA8F9AFD0C19A2A3C24F6ED781B4CFB0F53611
SHA-512:	E7036D1DF37233DAA9611EB24615FB6D09E6F10707E9ECD729729A1E4858BE18092B090A8FD6BC69EDF929016FFF2990B03BD4F8E518EB00F9499FFEEB035980
Malicious:	false
Preview:	[General]..AppDir=C:\Program Files\FxSound LLC\FxSound\..ApplicationName=FxSound..CompanyName=FxSound LLC..ApplicationVersion=1.1.20.0..DefaultCommandLine=/silent..URL1=https://s3.amazonaws.com/downloads3.fxsound.com/fxsound/2/updates.txt..CheckFrequency=2..DownloadsFolder=C:\ProgramData\FxSound LLC\FxSound\updates\..Flags=NoDisableAutoCheck\|PerMachine\|VerifyDigitalSignature\|NoUpdaterInstallGUI..ID={1CA2081B-0D5A-41DF-86E8-2788204CE340}..URL=https://download.fxsound.com/updates..

C:\ProgramData\FxSound LLC\FxSound\updates\updates.aiu.part

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\updater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	497
Entropy (8bit):	5.546037615393976
Encrypted:	false
SSDEEP:	12:8odu5B8u1bWYSu1aFYl6zLOZrK3GfvXFQn0WYX0VB5:fu1bou1aul68u3MXH3cB5
MD5:	59451DEEB43402AD76F849F6E15AE125
SHA1:	E64FA3C155C7C0DDCD8DFC3606D9F533D5CF4B17
SHA-256:	A236454D0707640CE09E73D38877A97CF6280B289B1A8A47D36DFBC74EC6EDD6
SHA-512:	D2EF11FD1917A548DD4D271F66CE29505E2B2482CEC90816D4F0B7587325E73B703C6F69BE212C483E5178740559AC5E3AEA26AEA454B1C2AC8375486459CDC1
Malicious:	false
Preview:	;aiu;....[Update]..Name = FxSound..ProductVersion = 1.1.20.0..URL = https://download.fxsound.com/fxsoundlatest..URL1 = https://downloads3.fxsound.com/fxsound/2/fxsound_setup.exe..Size = 46914960..SHA256 = 3541DF625AFFA384FEACF3CD3D64C47D2372EAB9A2055D57DDE08AFE7F85862C..MD5 = 9ea725e3e3bc82249957cc00b74c4882..ServerFileName = fxsound_setup.exe..Flags = SilentInstall\|Sys64..RegistryKey = HKUD\Software\FxSound LLC\FxSound\Version..Version = 1.1.20.0..AutoCloseApplication = [APPDIR]FxSound.exe..

C:\ProgramData\FxSound\FxSound.settings

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	365
Entropy (8bit):	5.210278155455057
Encrypted:	false
SSDEEP:	6:TMVBd/1qFPM+/QOQlvqitMvVQqAvcW+cDvcWFLPcg:TMHdkFjQnjtMv3kzJZ0g
MD5:	BE359259B30D461DBF8D299C3347C4AC
SHA1:	7E8087FEC573363C1B568D993892ED1881F28B06
SHA-256:	D2357AE5AEE6D8691DB67B9F9E7684A96B6FAC4DF62336F5F13679AE1D18727E
SHA-512:	176E02BB757D35AE7732DA8CD17AEC6AA2771E3E346BB1F2F0CECD439DD6123926626368711554527729D4B83717331DE775B0796D087D12E348981137E24DC1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<PROPERTIES>.. <VALUE name="power" val="1"/>.. <VALUE name="hotkeys" val="1"/>.. <VALUE name="preset" val="General"/>.. <VALUE name="cmd_on_off" val="196689"/>.. <VALUE name="cmd_open_close" val="196677"/>.. <VALUE name="cmd_change_preset" val="196673"/>.. <VALUE name="cmd_change_output" val="196695"/>..</PROPERTIES>

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FxSound\Check for FxSound updates.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Sat Sep 16 21:13:02 2023, mtime=Wed Nov 22 15:30:33 2023, atime=Sat Sep 16 21:13:02 2023, length=1057176, window=hide
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	3.668553029214428
Encrypted:	false
SSDEEP:	24:8bAdIfzDZyRAqc6d0VVd0VPb+M3kb6/S7crd4W3kb6kJliyfm:8MdIbwiMd0VVd0Vz50bCS7crCW0bn
MD5:	6619D5612745A81070CF370E2C96EE45
SHA1:	FCA5763E73001B9FA1D2A25487EDB9C7F7466368
SHA-256:	A5070870AB1B3B30DDB59BC7D4855043E35E0973437727C95160B5F494DA6B6D
SHA-512:	70D31978F12EFE2AE9C851DFE7634BB3D2E1933A65519C551F73DB08CC440DCCF4CA449F69C3A13859FB9258BB014AB1C416BB249B765C2F3919F6ED00F0B9E7
Malicious:	false
Preview:	L..................F.@.. ....+S.....&..6a....+S......!...........................P.O. .:i.....+00.../C:\.....................1.....vW...PROGRA~1..t......O.IvW.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....`.1.....vW...FXSOUN~1..H......vW.vW...............................F.x.S.o.u.n.d. .L.L.C.....V.1.....vW...FxSound.@......vW.vW...............................F.x.S.o.u.n.d.....b.2..!..0W.. .updater.exe.H......0W..vW.....d+........................u.p.d.a.t.e.r...e.x.e......._...............-.......^...........o........C:\Program Files\FxSound LLC\FxSound\updater.exe..?.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.u.p.d.a.t.e.r...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.../.c.h.e.c.k.n.o.w.G.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.4.6.0.0.6.6.5.-.0.1.6.5.-.4.9.E.8.-.8.0.1.7.-.D.1.B.D.6.A.2.9.0.3.3.5.}.\.f.x.s.o.u.n.d.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FxSound\FxSound.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sat Sep 16 16:44:52 2023, mtime=Wed Nov 22 15:30:34 2023, atime=Sat Sep 16 16:44:52 2023, length=4595096, window=hide
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	3.644367570927665
Encrypted:	false
SSDEEP:	24:8ZdIfzDZyZlAqXk6d0VsKd0Vd+M3kb6/S7crd4W3kb6kJloyAyfm:8ZdIbwZO4d0VsKd0Vd50bCS7crCW0b7
MD5:	31839BBE602359472F590E68D56CC150
SHA1:	5536528BFFD2194030AC41567AC1EEB0DD7B2D7C
SHA-256:	033284943644254A570425C19EEC28FB27CAC9A2463072B39F32327A2AB36B88
SHA-512:	4D0A8B5B75C9691AEBB7F3C607250E7E258DDACA4596A09575EE68D722C3C93DEE5CEE8EB121DF78320751D169C5D728E6D9B4E2E731B27BBD7589AC30EFF0E8
Malicious:	false
Preview:	L..................F.@.. ......~....&..7a......~......F..........................P.O. .:i.....+00.../C:\.....................1.....vW...PROGRA~1..t......O.IvW.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....`.1.....vW...FXSOUN~1..H......vW.vW...............................F.x.S.o.u.n.d. .L.L.C.....V.1.....vW...FxSound.@......vW.vW...............................F.x.S.o.u.n.d.....b.2...F.0W.. .FxSound.exe.H......0W..vW...............................F.x.S.o.u.n.d...e.x.e......._...............-.......^...........o........C:\Program Files\FxSound LLC\FxSound\FxSound.exe..?.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.F.x.S.o.u.n.d...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.G.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.4.6.0.0.6.6.5.-.0.1.6.5.-.4.9.E.8.-.8.0.1.7.-.D.1.B.D.6.A.2.9.0.3.3.5.}.\.f.x.s.o.u.n.d...e.x.e.........%Sys

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FxSound.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sat Sep 16 16:44:52 2023, mtime=Wed Nov 22 15:30:32 2023, atime=Sat Sep 16 16:44:52 2023, length=4595096, window=hide
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	3.6463658766037312
Encrypted:	false
SSDEEP:	24:8hdIfzDZTZlAqXk6d0VsKd0Vd+M3kb6/S7crd4W3kb6kJloyAyfm:8hdIbRZO4d0VsKd0Vd50bCS7crCW0b7
MD5:	4600C611796A8FE69B4B30F2B92532A2
SHA1:	F6B21054C1499A33F0DD56E06B8AA28298738E2B
SHA-256:	ECED7E4799A291EEF8F8501B2DC9D1AA47AC5F61AF9C514916BE7C2466A664C4
SHA-512:	1D4ED92CB636B544D902D04522BC1B6D0FFFCE997D247A8FE56C83A93FD49A13AC55375B0214D75D0050D3B0BCC949A390D880A62BF3FEE49A3D8090733F3094
Malicious:	false
Preview:	L..................F.@.. ......~....i..6a......~......F..........................P.O. .:i.....+00.../C:\.....................1.....vW...PROGRA~1..t......O.IvW.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....`.1.....vW...FXSOUN~1..H......vW.vW...............................F.x.S.o.u.n.d. .L.L.C.....V.1.....vW...FxSound.@......vW.vW...............................F.x.S.o.u.n.d.....b.2...F.0W.. .FxSound.exe.H......0W..vW...............................F.x.S.o.u.n.d...e.x.e......._...............-.......^...........o........C:\Program Files\FxSound LLC\FxSound\FxSound.exe..?.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.F.x.S.o.u.n.d...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.G.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.4.6.0.0.6.6.5.-.0.1.6.5.-.4.9.E.8.-.8.0.1.7.-.D.1.B.D.6.A.2.9.0.3.3.5.}.\.f.x.s.o.u.n.d...e.x.e.........%Sys

C:\Users\Public\Desktop\FxSound.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Sat Sep 16 16:44:52 2023, mtime=Wed Nov 22 15:30:34 2023, atime=Sat Sep 16 16:44:52 2023, length=4595096, window=hide
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	3.641584485354774
Encrypted:	false
SSDEEP:	24:8EdIfzDZyZlAqX+d0VsKd0Vd+M3kb6/S7crd4W3kb6kJloyAyfm:8EdIbwZOtd0VsKd0Vd50bCS7crCW0b7
MD5:	746B248A225DDC7AA22E08F8834A6B8A
SHA1:	60A302927D06EAD5B3EE6001CAA950D5A3E9D6BA
SHA-256:	A90A00C02D2FFBCEF94BA888087A9ED7A38750AC0962160340893B9587E355F5
SHA-512:	5D510BBC480E73C185B2CB4513F5CD8E7F7321137A82B5F57F2198F1954740689C166FFBC2C4966132C8E1BFD7AE3B44023F415FC7263DBE0A54B3960F719BF6
Malicious:	false
Preview:	L..................F.@.. ......~.......7a......~......F..........................P.O. .:i.....+00.../C:\.....................1.....vW...PROGRA~1..t......O.IvW.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....`.1.....vW...FXSOUN~1..H......vW.vW...............................F.x.S.o.u.n.d. .L.L.C.....V.1.....vW...FxSound.@......vW.vW...............................F.x.S.o.u.n.d.....b.2...F.0W.. .FxSound.exe.H......0W..vW...............................F.x.S.o.u.n.d...e.x.e......._...............-.......^...........o........C:\Program Files\FxSound LLC\FxSound\FxSound.exe..6.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.F.x.S.o.u.n.d...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d.\.G.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.4.6.0.0.6.6.5.-.0.1.6.5.-.4.9.E.8.-.8.0.1.7.-.D.1.B.D.6.A.2.9.0.3.3.5.}.\.f.x.s.o.u.n.d...e.x.e.........%SystemRoot%\Installer

C:\Users\user\AppData\Local\Temp\MSICA43.LOG

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	53274
Entropy (8bit):	3.7476742110289996
Encrypted:	false
SSDEEP:	1536:QcdY0TTJmLAYIsDvV0i4mojQagWgCgWgeI0i4mojQagWgCgWg+o0i4mojQagWgC4:QDEZ+
MD5:	C311955AABEBBD7EA935D5C992F4D8BC
SHA1:	E86D1313469CB193D31E50FDDCD68419B75811D3
SHA-256:	BE0004CF77358C475DE530CDBEBCB9827D09F833185B776659E14CE67DA1F4F4
SHA-512:	D88DBE0D03B8C548E0710FBAB0116DB90D4EC54102C9E63F73E6FF28E732FF56EA1228309F18486BE74ED22704426CCEAEF5F74D38D7AFF35BFA3658B5679C2B
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.2./.1.1./.2.0.2.3. . .1.7.:.3.0.:.2.9. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.D.e.s.k.t.o.p.\.f.x.s.o.u.n.d._.s.e.t.u.p...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.C.4.:.5.C.). .[.1.7.:.3.0.:.2.9.:.2.7.7.].:. .S.O.F.T.W.A.R.E. .R.E.S.T.R.I.C.T.I.O.N. .P.O.L.I.C.Y.:. .V.e.r.i.f.y.i.n.g. .p.a.c.k.a.g.e. .-.-.>. .'.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d. .1...1...2.0...0.\.i.n.s.t.a.l.l.\.f.x.s.o.u.n.d...x.6.4...m.s.i.'. .a.g.a.i.n.s.t. .s.o.f.t.w.a.r.e. .r.e.s.t.r.i.c.t.i.o.n. .p.o.l.i.c.y.....M.S.I. .(.c.). .(.C.4.:.5.C.). .[.1.7.:.3.0.:.2.9.:.2.7.7.].:. .S.O.F.T.W.A.R.E. .R.E.S.T.R.I.C.T.I.O.N. .P.O.L.I.C.Y.:. .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.F.x.S.o.u.n.d. .L.L.C.\.F.x.S.o.u.n.d. .1...1...2.0...0.\.i.n.s.t.a.l.l.\.f.x.s.o.u.n.d...x.6.

C:\Users\user\AppData\Local\Temp\MSICC49.tmp

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIccd31.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (361), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	299756
Entropy (8bit):	3.833281861018859
Encrypted:	false
SSDEEP:	3072:QeZNGbaAUdZrjjMDQu3tosamdNxIdn7wNxj8ILfZFnsKw578YLLGRE3i9kkJDrUA:QAA2juQntr+
MD5:	E68DD675E09CA798FF2F669542F6B76C
SHA1:	39631AA83BA0CB73BC75250D8C998ACB116E8333
SHA-256:	6A7BF00760D3D332094415CDCF121BEFD96289BD702D7EABF4DC974AA263E8F3
SHA-512:	5FF824FBDA4D09889E1F7EC9135CBF448F786878116AE08F92F2B072DE33A70FF3F4FE2BA6207A6B054F89B81D235EBC7363762F63131259ED144209C1F5C09F
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.2./.1.1./.2.0.2.3. . .1.7.:.3.0.:.3.0. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.6.C.:.7.0.). .[.1.7.:.3.0.:.3.0.:.0.5.6.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.6.C.:.7.0.). .[.1.7.:.3.0.:.3.0.:.0.5.6.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.6.C.:.7.C.). .[.1.7.:.3.0.:.3.0.:.1.0.3.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.6.C.:.7.C.). .[.1.7.:.3.0.:.3.0.:.1.0.3.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .

C:\Users\user\AppData\Local\Temp\shiCBDA.tmp

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDD9.tmp

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
File Type:	data
Category:	dropped
Size (bytes):	10590
Entropy (8bit):	7.254430659006022
Encrypted:	false
SSDEEP:	192:1OgjZ7OPJCbngEw9JPgXkhYCClQBcA5E8qnajEzHbC:18UuLh3Cl+x5E8l4zu
MD5:	ACDAAE5D1219E7703285C42F774BE54D
SHA1:	47DF82D8C843BF1ADC098A26E9E3E27217B3104D
SHA-256:	25C8DAE186155D20F74FEEDEFB4F84161E4215925B8FD0C898F68F3E50EBCD7D
SHA-512:	83B663222FB22B1760EA8551D19557F3F2905BFAC205B380B23DD7F2A65A37B851A3C3C345E4A768B76700BB891B97C96A0DBBB58D81358993293AD1EB3E300A
Malicious:	false
Preview:	0.)Z...H........)K0.)G...1.0...`.H.e......0.....+.....7......0...0...+.....7.....7.M&...A.f..B....210319161347Z0...+.....7.....0..?0....#..6yS{.I..^o.Q{.A.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0.... Kt=..].....&...m.ng..,.....Q...\|1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Kt=..].....&...m.ng..,.....Q...\|0... ..\...{...p$..B.F.C8..C.p....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..\...{...*p$..B.F.C8..C.p....0.....w7=-{x\|<....8....O.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s......C0..?0....+.....7......0.....S.u.

C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDE9.tmp

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628759224235533
Encrypted:	false
SSDEEP:	96:3q9BSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3qzSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	328087CAF99B50D988A304BEEEA3FCE8
SHA1:	23FFEF913679537BB049008F5E6F8E517BB24192
SHA-256:	BA175CFDDD91B87BDDA3F1DF2A70249E1742E846B843381EB0438B70F91A110A
SHA-512:	D006E8DE0F9258A3EE75723E458D635586040702C1357630F199CF5740C7E29D87FEFD4B869A897BDD26B67FAD134E6BF35A2C01C3A00ACC8BF20181D7DA1AA3
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/17/2021,14.1.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\SETEDFA.tmp

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	2.91036654915667
Encrypted:	false
SSDEEP:	768:3Ft4aLqpAogNTiqwu2CvcCjikibqqqqqqqqqqqqqqqqqqqaFgNj////////////l:T45A/N8Cfjik6scccoFtr
MD5:	EAF913C1DE47C2421669B662EDAA5A6A
SHA1:	53524526E1898A90FA98AE02E662B9C0E6DC2848
SHA-256:	425629B6309000013E8CD1A9B827BEE365D21C9F743873AADD0C3BC96A999D2A
SHA-512:	BB674FEB73751172A1ACE65AAB89C5EBF952A07F7AF0F3EC1DADF357FF693230CF08910AE273E8335EEC35E5827DA6405272D05C161987DF679199935AF21A76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................X.......X.R.....X.......Rich....................PE..d....@R`.........."......6..........0..........@............................. ......cM....`A....................................................<........\|...@...........$..........8)..8...........................p)............... ...............................text...)........................... ..h.rdata....... ......................@..H.data........0......................@....pdata.......@.......(..............@..HPAGE....J'...P...(...,.............. ..`INIT.................T.............. ..b.rsrc....\|.......~...X..............@..B.reloc..............................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.msi

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {1FE29950-43C3-42AA-A25F-578F09237F5B}, Number of Words: 2, Subject: FxSound, Author: FxSound LLC, Name of Creating Application: FxSound, Template: ;1033, Comments: This installer database contains the logic and data required to install FxSound., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2117632
Entropy (8bit):	6.598867176501236
Encrypted:	false
SSDEEP:	49152:sxNYvPMg85nF9BrdLq2+cZfsZrAWlGFAvHZXm1+Ck:sY3orxq1AWkFA
MD5:	164DBF6A8998960D7EF4E2ACECC5F415
SHA1:	27303F0D0BAD5ED8AA551368B3718FF6180BEDD7
SHA-256:	965CDEE211FF716C29D9767898D270F2457112A9379A272E6F2C2B09C27B4CA0
SHA-512:	BD613F1EF6D1A48455B853381A26027BFFB627A7DDC18260D3B6E82D433D5D62A56C19DC74DE475486E5368EBFF6727C0F8626697378BB93A172214E95636683
Malicious:	false
Preview:	......................>...................!...................................V.......~...............................X...................................................................................................................................................................................................................................................................................................................................................................................................................p...................,...<....................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...8...:......./...0...1...2...3...4...5...6...7.......9...=...;...C...O...>...?...@...A...B...E...D...L...F...G...H...I...J...K.......M...N...X...P...Q...R...S...T...U...........X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {D5DE046A-A59D-4852-B552-7C613C8DBEAF}, Number of Words: 2, Subject: FxSound, Author: FxSound LLC, Name of Creating Application: FxSound, Template: x64;1033, Comments: This installer database contains the logic and data required to install FxSound., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2117632
Entropy (8bit):	6.598567603205823
Encrypted:	false
SSDEEP:	49152:VcfYwPMg85nF9Brdgq2+cZfsZXAWlGFAvHZXm1+rN:sY6oruqxAWkFA
MD5:	42FA3A7E2E5BC46FBBB6DBC801A7EFEA
SHA1:	8B33A5D24120F9B88170CFCF8FDD802DA8882C56
SHA-256:	8BE0260EAD9EF1F0D6097CA26A30BBE18A7E59E3BD8160F5465E1107DD1C6648
SHA-512:	77574873F7695419F8FBF125B11764DC1F1583F9A3ED8860803AE72AB5C9AA47BD27AF3EE94B29A02D4AF28AE74D26BD90C9A8AC9C9D348F071CF15E011C586A
Malicious:	false
Preview:	......................>...................!...................................V.......~...............................X...................................................................................................................................................................................................................................................................................................................................................................................................................p...................,...<....................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...8...9......./...0...1...2...3...4...5...6...7.......:...;...=...C...N...>...?...@...A...B...E...D...K...F...G...H...I...J...O...L...M...X...P.......Q...R...S...T...U...........X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound1.cab

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	Microsoft Cabinet archive data, many, 39420851 bytes, 58 files, at 0x44 +A "FxSound.exe" +A "FxSound.settings", flags 0x4, ID 1234, number 1, extra bytes 20 in head, 1631 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	39431555
Entropy (8bit):	7.998338875644748
Encrypted:	true
SSDEEP:	786432:rHAuWfgcKbjylyM5fZFKlG4GjIKNnSTAk5jDSUfzTm8/t4zdahXZBHHAIG:suG1KEyM5fZdxjIKNnEZDFLf/SJ+XZpG
MD5:	69DB76D4D58760C3CD42C04CFCCB9124
SHA1:	40A129702E82DE5F2E6C9498DFBC918717FBA947
SHA-256:	029BB5DEC04A6E33970E2EF57997D5372817756DC2C17DFA7D1AE37B3D49318A
SHA-512:	8181B712DDAB654CC24703BFFFA0079A74A44524A3700B3ABFB2199186096ADC13C1079745B28C3384ED3C184D7EBADAA80F14AF7760629FA4D11627B38438AD
Malicious:	false
Preview:	MSCF......Y.....D...........:.................Y..).............._.....F.......0W.. .FxSound.exe.m.....F...,WEX .FxSound.settings...;...F...0W=. .FxSound.exe_2..3.........T\. .ptdevcon32.exe..........T\. .ptdevcon64.exe.....m......T+. .DfxSetupDrv.exe...........T\. .dfx.ico..!........0W.. .updater.exe.....y<....0W.. .DfxInstall.dll.&}...4.....V. .fxsound.ico.....7......T.} .fxdevcon64.exe...........T+. .fxvad.inf...........T+. .fxvad.sys.^)........T+. .fxvadntamd64.cat..M.........T.} .fxdevcon32.exe......V.....T+. .fxvad.inf_1.....qk.....T+. .fxvad.sys_1.U)..qW.....T+. .fxvadntx86.cat...........T.} .fxdevcon64.exe_1.....^......T+. .fxvad.inf_2.....4......T+. .fxvad.sys_2.`%.........T+. .fxvadntamd64.cat_1..M..\|.....T.} .fxdevcon32.exe_1...... .....T+. .fxvad.inf_3......4.....T+. .fxvad.sys_3.a%.........T+. .fxvadntx86.cat_1.....3D.....T+. .fac......G.....T+. .fac_1......K.....T+. .fac_2.....gO.....T+. .fac_3....."S.....T+. .fac_4......V.....T+. .fac_5......Z.....T+. .fac_6.....

C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\fxsound_setup.exe
File Type:	data
Category:	dropped
Size (bytes):	39431555
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D93DFEE3CB6CE63DA8DE821BF93BFDBA
SHA1:	A35882AAFA2D9558B6B083B6E6EA44A9FCED2C71
SHA-256:	47A71DE1F1A875CC47513A3607E52F638D76405ADC3337A63B909ADC10AD27BD
SHA-512:	D0D3FC1F6A030B19C5553DD35F9C21C87DCA8E5F07D7242E708A2BB1EF28464ABBACDC35810C3542FCF207F0CB65E8F1FC854878DE3113D26BCD1441A68E08D3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FxSound\FxSound_temp911c07dc.settings

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\FxSound.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.134952086722843
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCf3q1iXvFjz9sQCQriF0qCH9Rz9sl6c286AlRqbyFjz9sl6c286r:TMVBd/+qFPLemVs+b4VNb7dn
MD5:	87D0982F5500919568CD4D775DB57BCF
SHA1:	9FB7B681B302A81BCDA7064099BF1CC8F332137D
SHA-256:	367993596516DD874F7D3DD89488142033DB7B76E4670C0D7E2F143C92899A0D
SHA-512:	5D57866402BD36C1FC54702E5A661601F99A18CA6497D5EC3BACCE2A3F9973115EC400211BB9859B7867355DFF578AE6E205E14C4CD41C0676B2E83F5ABB4C06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>....<PROPERTIES>.. <VALUE name="language" val="en-GB"/>.. <VALUE name="output_device_id" val=""/>.. <VALUE name="output_device_name" val=""/>..</PROPERTIES>..

C:\Users\user\AppData\Roaming\FxSound\fxsound.log

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\FxSound.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	3.7464875870837915
Encrypted:	false
SSDEEP:	3:+/3PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPovhCW6KGD8:+ovJ5tMKxpmgLn7
MD5:	D83F006ECB85D0669F3DA59BA17D4C1F
SHA1:	37E5A78BA433FECAFF61A0D8603D8F3D51CCFA43
SHA-256:	12ECE37BCDD30C2194A0A5FD0F4F85F43A8E3A7D04CACAA9AE5E7EEEF18A9517
SHA-512:	D951147168C4A56963603A39E7B213B98C00923BE11F7E36194457D9EA693BA51450B9BB8758F3B62173EF2D5221870C810FBF39A3CF8F31232CEBB18A5904AD
Malicious:	false
Preview:	..**********************************************************..FxSound logs..Log started: 22 Nov 2023 6:51:51pm....v1.1.20.0..Windows 10..x64..

C:\Windows\INF\c_media.PNF

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2108 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	13156
Entropy (8bit):	3.6250477571032174
Encrypted:	false
SSDEEP:	96:cJOzh59k3f3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:7Qf3woapXQXQ1HNogE3lJSZmXx7p
MD5:	60B2EF95F0A811CC6FD2E163338A7294
SHA1:	0006F7466FDAA96BA0F306EBA5B8D65312806D1B
SHA-256:	F059676DE05CEB7116BCB5DC6C3F390B056BB2798DF3B70A3F76EF34F7DB2EA9
SHA-512:	C924E5CC4E55EF5238FFBA082C747D941062FD8D6615805924DC6528D8B7A39BCAD49EFB4176BB3F220C12C80FE65F0B97A8669C5C738D199C923A5CCEBD0B0C
Malicious:	false
Preview:	.....................!..h.......L..........x ......."......."..,... '......@-..h...............`3......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...................................................................................................................................L...h...............X.......................................................................L...........................................D...........................................8.......0.......................................................................................................................D....................... ...............................................................L...................................................d.......................................................................T.......\|.......................t...................t...............................................................................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628759224235533
Encrypted:	false
SSDEEP:	96:3q9BSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3qzSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	328087CAF99B50D988A304BEEEA3FCE8
SHA1:	23FFEF913679537BB049008F5E6F8E517BB24192
SHA-256:	BA175CFDDD91B87BDDA3F1DF2A70249E1742E846B843381EB0438B70F91A110A
SHA-512:	D006E8DE0F9258A3EE75723E458D635586040702C1357630F199CF5740C7E29D87FEFD4B869A897BDD26B67FAD134E6BF35A2C01C3A00ACC8BF20181D7DA1AA3
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/17/2021,14.1.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	46143
Entropy (8bit):	5.062356644348276
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwr05haujLrVDBf6V6D2iVWjyT/5i:Own95cdyYloiwQ+w9f6uWuT/I
MD5:	00EE4C1BF45B0D26BD804720E6A4C65B
SHA1:	EC3B103927AA59708E5969328332883AD22E3F9A
SHA-256:	DC3B696C92E316050DBE80506A6B33779F575177BE260EE6091C23EECFEFBEA6
SHA-512:	456E90F42D58E262DA66788D909DFBDEB853D94235BDDF05BA16F92EEC1D629E085BAC57E2B7C5ECC65C1367496058B0048FC378C574EE2C03C859702098CFFD
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Installer\4cce4a.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {D5DE046A-A59D-4852-B552-7C613C8DBEAF}, Number of Words: 2, Subject: FxSound, Author: FxSound LLC, Name of Creating Application: FxSound, Template: x64;1033, Comments: This installer database contains the logic and data required to install FxSound., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2117632
Entropy (8bit):	6.598567603205823
Encrypted:	false
SSDEEP:	49152:VcfYwPMg85nF9Brdgq2+cZfsZXAWlGFAvHZXm1+rN:sY6oruqxAWkFA
MD5:	42FA3A7E2E5BC46FBBB6DBC801A7EFEA
SHA1:	8B33A5D24120F9B88170CFCF8FDD802DA8882C56
SHA-256:	8BE0260EAD9EF1F0D6097CA26A30BBE18A7E59E3BD8160F5465E1107DD1C6648
SHA-512:	77574873F7695419F8FBF125B11764DC1F1583F9A3ED8860803AE72AB5C9AA47BD27AF3EE94B29A02D4AF28AE74D26BD90C9A8AC9C9D348F071CF15E011C586A
Malicious:	false
Preview:	......................>...................!...................................V.......~...............................X...................................................................................................................................................................................................................................................................................................................................................................................................................p...................,...<....................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...8...9......./...0...1...2...3...4...5...6...7.......:...;...=...C...N...>...?...@...A...B...E...D...K...F...G...H...I...J...O...L...M...X...P.......Q...R...S...T...U...........X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\4cce4d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {D5DE046A-A59D-4852-B552-7C613C8DBEAF}, Number of Words: 2, Subject: FxSound, Author: FxSound LLC, Name of Creating Application: FxSound, Template: x64;1033, Comments: This installer database contains the logic and data required to install FxSound., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2117632
Entropy (8bit):	6.598567603205823
Encrypted:	false
SSDEEP:	49152:VcfYwPMg85nF9Brdgq2+cZfsZXAWlGFAvHZXm1+rN:sY6oruqxAWkFA
MD5:	42FA3A7E2E5BC46FBBB6DBC801A7EFEA
SHA1:	8B33A5D24120F9B88170CFCF8FDD802DA8882C56
SHA-256:	8BE0260EAD9EF1F0D6097CA26A30BBE18A7E59E3BD8160F5465E1107DD1C6648
SHA-512:	77574873F7695419F8FBF125B11764DC1F1583F9A3ED8860803AE72AB5C9AA47BD27AF3EE94B29A02D4AF28AE74D26BD90C9A8AC9C9D348F071CF15E011C586A
Malicious:	false
Preview:	......................>...................!...................................V.......~...............................X...................................................................................................................................................................................................................................................................................................................................................................................................................p...................,...<....................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...8...9......./...0...1...2...3...4...5...6...7.......:...;...=...C...N...>...?...@...A...B...E...D...K...F...G...H...I...J...O...L...M...X...P.......Q...R...S...T...U...........X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSICFD1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID030.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID06F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID090.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	648136
Entropy (8bit):	6.449062813580053
Encrypted:	false
SSDEEP:	12288:kEvIkrf4bxnJAN9Wk9BR3NUBNoACiSsmqJBoQZXm1+g:keIgMyR3iyACyHZXm1+g
MD5:	9B4B4EA6509E4DB1E2A8F09A7C6F8F04
SHA1:	512880ABE3C9696EDB042599BD199F1D05210AA2
SHA-256:	3774C31039CB87ED0327F49A00ABD7B4211AC938A46378B8661CD5D8B3B34F94
SHA-512:	63B4788A3AD000C08582F55532DC06BF88BC4111837A63E8157E0F5F668225F46758F9481B6E526A5A813F4F0CC9BE65FB4107D2135C61083274592AF03BA608
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................-......-...W......................-...........-.......-.................................r............Rich....................PE..L......b.........."!... . ...................0............................................@.........................p=.......>..........h................#.......`...`..p....................a.......C..@............0......4;..@....................text............ .................. ..`.rdata..4!...0..."...$..............@..@.data...@"...`.......F..............@....rsrc...h............X..............@..@.reloc...`.......b...^..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID0BF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID0E0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID11F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	648136
Entropy (8bit):	6.449062813580053
Encrypted:	false
SSDEEP:	12288:kEvIkrf4bxnJAN9Wk9BR3NUBNoACiSsmqJBoQZXm1+g:keIgMyR3iyACyHZXm1+g
MD5:	9B4B4EA6509E4DB1E2A8F09A7C6F8F04
SHA1:	512880ABE3C9696EDB042599BD199F1D05210AA2
SHA-256:	3774C31039CB87ED0327F49A00ABD7B4211AC938A46378B8661CD5D8B3B34F94
SHA-512:	63B4788A3AD000C08582F55532DC06BF88BC4111837A63E8157E0F5F668225F46758F9481B6E526A5A813F4F0CC9BE65FB4107D2135C61083274592AF03BA608
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................-......-...W......................-...........-.......-.................................r............Rich....................PE..L......b.........."!... . ...................0............................................@.........................p=.......>..........h................#.......`...`..p....................a.......C..@............0......4;..@....................text............ .................. ..`.rdata..4!...0..."...$..............@..@.data...@"...`.......F..............@....rsrc...h............X..............@..@.reloc...`.......b...^..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID5C4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID6FD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	51328
Entropy (8bit):	4.258395351969839
Encrypted:	false
SSDEEP:	192:Fg91T7hVHUjxoTwba/cp9fbs1kjPR5vFXAoREdWzgXPE35DvgAXXfABH3sNmKCwt:FAJ00Eh41kj5jXAoREwz1u8a3GEhe9/B
MD5:	416461752DB24E01318DE5C08AECB11A
SHA1:	C4F917DAFEC16123976600DAFB1DA1CAA79F89BE
SHA-256:	EF555099E7FC8251D76B0E0205E808EC2623337E8F867DC86F1F592CF363A5FF
SHA-512:	ACCFCC6C822902BF19B14D2D89FC79E9E523BB2DB4D38E670DAB0AD2B40A94B9712AE64D578AB6C262D407001D141BCC2A25E0DD458A7D949D13D444C691C062
Malicious:	false
Preview:	...@IXOS.@.....@.vW.@.....@.....@.....@.....@.....@......&.{14600665-0165-49E8-8017-D1BD6A290335}..FxSound..fxsound.x64.msi.@.....@.....@.....@......fxsound.exe..&.{D5DE046A-A59D-4852-B552-7C613C8DBEAF}.....@.....@.....@.....@.......@.....@.....@.......@......FxSound......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{215927B7-6543-4106-B941-F33B96B65E3B}%.C:\Program Files\FxSound LLC\FxSound\.@.......@.....@.....@......&.{82E872A6-8D59-4785-92C3-8BBFF79EB0E4}0.C:\Program Files\FxSound LLC\FxSound\FxSound.exe.@.......@.....@.....@......&.{E6F40D13-6200-4931-A7A2-6142F7821778}9.C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe.@.......@.....@.....@......&.{EE536E27-12E6-4F20-A3E7-6A073AED85CB};.C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe.@.......@.....@.....@......&.{FF4D6223-08FD-4830-A07F-C3307A8FA1B5};.C:\Program Files\FxSound LLC

C:\Windows\Installer\SourceHash{14600665-0165-49E8-8017-D1BD6A290335}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2027779745763456
Encrypted:	false
SSDEEP:	12:JSbX72FjlmXsXAlfLIlHuRpzhG7777777777777777777777777ZDHFc3lmNpECi:J/JUIwqKVmNplUVF
MD5:	9135C9630213FE8FC63702A3CCE8742D
SHA1:	11A1F440210F2A5E44BAC7D3F5D088EE050F0235
SHA-256:	879FA388869676405B1DB04559FE6353CB37343B04C31F65475220CDC9ABA3AC
SHA-512:	FDB31190D979599616453E73EA8DD466CF3EE8A9547CB41A46D3FDFB0B5C916ED544B64CACF021F28513C193E5617DD080C8B14A713F868593699EF227C9C37A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7452870893259427
Encrypted:	false
SSDEEP:	48:msV8PhauRc06WX4YnT57MVsGd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoD4:Z4ha1onT1tRCrVq6DRg4a5chRCU
MD5:	2BCD066423C952D3EFF4E40572BB767A
SHA1:	565B2B22271E0AC1FC288C34253DC9E967370EDE
SHA-256:	F7BAEEB8B6D2243A2428E286AC3B1515E7C51B94D1BE97767E73BFD661992583
SHA-512:	10BC935D95350AA50892815C1EB158B7312A621B7300FC20D0EB8580AF7C6301CDC251674C3671F385DE83F06F3D0191F89735C9E6DA5CF409461E0505365FF4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{14600665-0165-49E8-8017-D1BD6A290335}\fxsound.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	2.096487496878294
Encrypted:	false
SSDEEP:	96:MuoSQH7SQKSQ37izg88PE3gGDvfYduXX3XfAw0EYpR9THXXXbLom+vvvvChboTCy:NoREdWzgXPE35DvgAXXfABH3sNmKCwiW
MD5:	F6822EF3F0A697D83A3F51D133E180DC
SHA1:	AD9451A6195338DF5260150EFE2178CB0072EE2F
SHA-256:	E350B7DA8FBD6798191FD591EFDA4D2B947BD2B48F8CFB54AC084D79FBBA14E4
SHA-512:	493172B804679D518DC38267CBB45B0A3359BF254532089A28DBCD00EC9E5DB5D94BCE8EC504343E58419F351CABBCBC1C943B28923A5F31AA09DE4D362EE47F
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... ............................'...........................................................'............................................................................................................................................................................................................TTT.===.....###.zzz.zzz.###.....===.TTT.................'''.........ppp.....KKK.........KKK.....ppp.........'''.........'''.........ppp.....LLL.........LLL.....ppp.........'''.................MMM.ppp.....LLL.........LLL.....ppp.KKK.............................rrr.....LLL.........LLL.....rrr.................................mmm.....HHH.........HHH.....mmm.................................###.```.................aaa.###.............................................................................................................\|\|\|.\|\|\|.......................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375165987693077
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauo:zTtbmkExhMJCIpEr9
MD5:	02BE08AE3D80D973B12C30BA972C8755
SHA1:	F99B65D4378967BA130A2766CD60EA87117B04A6
SHA-256:	A7D9A0DBF86F02534729611E231C830DF94F82C29F74DAFA20B878F594F041B9
SHA-512:	3FB8E696C6A16CB5E94FE1F10A2DD86D31A9001F4D208186CAF244632F70D5A60B43FBA497F7E0177B4EE44E074E34BBCFE3539469603258474B540E91ACF97C
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\dfx11.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32988
Entropy (8bit):	2.0838482936133116
Encrypted:	false
SSDEEP:	96:ziLVjzfTmM5JJJjY4vCYYYRImnyRRjiacLqzD8:YrTp5JJJjYMCYYYRImnyRRWacLq
MD5:	648D3F5E7778CA1F7983B246C264B0C9
SHA1:	86E382BE934A39AACC78F4CA3AB82CCF1E5E6E4F
SHA-256:	28F31663D6EA3161943737E0235EAC93D8DBDA241C925AD0FD72727F491274A0
SHA-512:	3772C9DF9494AFBBC8CACE58E98446B913739395FD1DA005DCE09D3E806C772D6DEDD9C654083C64E3AA0D5450836708C65969B763D129DBB8BE33F213A31FBB
Malicious:	false
Preview:	......@@.... .(@..F... .... .(...n@........ .(....P........ .(....Y..(...@......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\fxsound.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	2.096487496878294
Encrypted:	false
SSDEEP:	96:MuoSQH7SQKSQ37izg88PE3gGDvfYduXX3XfAw0EYpR9THXXXbLom+vvvvChboTCy:NoREdWzgXPE35DvgAXXfABH3sNmKCwiW
MD5:	F6822EF3F0A697D83A3F51D133E180DC
SHA1:	AD9451A6195338DF5260150EFE2178CB0072EE2F
SHA-256:	E350B7DA8FBD6798191FD591EFDA4D2B947BD2B48F8CFB54AC084D79FBBA14E4
SHA-512:	493172B804679D518DC38267CBB45B0A3359BF254532089A28DBCD00EC9E5DB5D94BCE8EC504343E58419F351CABBCBC1C943B28923A5F31AA09DE4D362EE47F
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... ............................'...........................................................'............................................................................................................................................................................................................TTT.===.....###.zzz.zzz.###.....===.TTT.................'''.........ppp.....KKK.........KKK.....ppp.........'''.........'''.........ppp.....LLL.........LLL.....ppp.........'''.................MMM.ppp.....LLL.........LLL.....ppp.KKK.............................rrr.....LLL.........LLL.....rrr.................................mmm.....HHH.........HHH.....mmm.................................###.```.................aaa.###.............................................................................................................\|\|\|.\|\|\|.......................................................................................

C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF03A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10590
Entropy (8bit):	7.254430659006022
Encrypted:	false
SSDEEP:	192:1OgjZ7OPJCbngEw9JPgXkhYCClQBcA5E8qnajEzHbC:18UuLh3Cl+x5E8l4zu
MD5:	ACDAAE5D1219E7703285C42F774BE54D
SHA1:	47DF82D8C843BF1ADC098A26E9E3E27217B3104D
SHA-256:	25C8DAE186155D20F74FEEDEFB4F84161E4215925B8FD0C898F68F3E50EBCD7D
SHA-512:	83B663222FB22B1760EA8551D19557F3F2905BFAC205B380B23DD7F2A65A37B851A3C3C345E4A768B76700BB891B97C96A0DBBB58D81358993293AD1EB3E300A
Malicious:	false
Preview:	0.)Z...H........)K0.)G...1.0...`.H.e......0.....+.....7......0...0...+.....7.....7.M&...A.f..B....210319161347Z0...+.....7.....0..?0....#..6yS{.I..^o.Q{.A.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0.... Kt=..].....&...m.ng..,.....Q...\|1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Kt=..].....&...m.ng..,.....Q...\|0... ..\...{...p$..B.F.C8..C.p....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..\...{...*p$..B.F.C8..C.p....0.....w7=-{x\|<....8....O.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........f.x.v.a.d...s.y.s......C0..?0....+.....7......0.....S.u.

C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF04B.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.628759224235533
Encrypted:	false
SSDEEP:	96:3q9BSSyjoh9OnLhtuGUdDrG9E/6uYqZpd7SY5MFgWC2i8/ENYZS:3qzSSyjoG17UprGEiuYqZpd7Se8eYENp
MD5:	328087CAF99B50D988A304BEEEA3FCE8
SHA1:	23FFEF913679537BB049008F5E6F8E517BB24192
SHA-256:	BA175CFDDD91B87BDDA3F1DF2A70249E1742E846B843381EB0438B70F91A110A
SHA-512:	D006E8DE0F9258A3EE75723E458D635586040702C1357630F199CF5740C7E29D87FEFD4B869A897BDD26B67FAD134E6BF35A2C01C3A00ACC8BF20181D7DA1AA3
Malicious:	false
Preview:	;..;fxvad.inf..;....[Version]..Signature="$CHICAGO$"..Class=MEDIA..Provider=%FXMN%..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}..DriverVer = 03/17/2021,14.1.0.0..CatalogFile.NTx86=fxvadNTx86.cat..CatalogFile.NTAMD64=fxvadNTAMD64.cat..PnpLockDown=1....[Manufacturer]..%MfgName%=DFX,NTamd64,NTx86....[DFX.NTx86]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....[DFX.NTamd64]..%DFX_Device.DeviceDesc%=DFX_Device,Root\%DEV_NAME%,%DEV_NAME%....;-----------------------------------------------------------------------------..;..; 2k+ Installation..;..;-----------------------------------------------------------------------------..[DFX_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=DFX_Device.CopyList..AddReg=DFX_Device.AddReg..AddProperty=DFX_1AddPropertySection....[DFX_Device.NT.Interfaces]..AddInterface=%KSCATEGORY_AUDIO%,%KSNAME_Wave%,DFX_Device.I.Wave..AddInterface=%KSCATEGORY_RENDER%,%KSNAME_Wave%,DFX_Device.I.Wave..;Add

C:\Windows\System32\DriverStore\Temp\{254d53e9-31e2-8942-bfe2-4e3f26d71e4a}\SETF05B.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	2.91036654915667
Encrypted:	false
SSDEEP:	768:3Ft4aLqpAogNTiqwu2CvcCjikibqqqqqqqqqqqqqqqqqqqaFgNj////////////l:T45A/N8Cfjik6scccoFtr
MD5:	EAF913C1DE47C2421669B662EDAA5A6A
SHA1:	53524526E1898A90FA98AE02E662B9C0E6DC2848
SHA-256:	425629B6309000013E8CD1A9B827BEE365D21C9F743873AADD0C3BC96A999D2A
SHA-512:	BB674FEB73751172A1ACE65AAB89C5EBF952A07F7AF0F3EC1DADF357FF693230CF08910AE273E8335EEC35E5827DA6405272D05C161987DF679199935AF21A76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................X.......X.R.....X.......Rich....................PE..d....@R`.........."......6..........0..........@............................. ......cM....`A....................................................<........\|...@...........$..........8)..8...........................p)............... ...............................text...)........................... ..h.rdata....... ......................@..H.data........0......................@....pdata.......@.......(..............@..HPAGE....J'...P...(...,.............. ..`INIT.................T.............. ..b.rsrc....\|.......~...X..............@..B.reloc..............................@..B........................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4403
Entropy (8bit):	5.389950055776771
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3hpTpbCpEpDk+psNVpsLL:QO00eO00erMwmkB1kAIrN4n
MD5:	A86318D239DAE53C391DFDB571790B5A
SHA1:	C251670D87CB3C331F541050F7EA982B3CB94175
SHA-256:	2D20D9525C683C27065547E3165923A7B6C1405E37BBCD5FBE7FAD15FE8FB176
SHA-512:	309CC8A280CB666BC49B87E3F5CB3C00E5809915ED27627588A8D8EC0AB6BF4CDE1DB472E6EAA5BBAE6240CA024E8688DF8C3C72F26C1FB4D326F0B2EF1B013C
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\Temp\~DF006815BFF968E633.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0FFC1179443D23C7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7452870893259427
Encrypted:	false
SSDEEP:	48:msV8PhauRc06WX4YnT57MVsGd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoD4:Z4ha1onT1tRCrVq6DRg4a5chRCU
MD5:	2BCD066423C952D3EFF4E40572BB767A
SHA1:	565B2B22271E0AC1FC288C34253DC9E967370EDE
SHA-256:	F7BAEEB8B6D2243A2428E286AC3B1515E7C51B94D1BE97767E73BFD661992583
SHA-512:	10BC935D95350AA50892815C1EB158B7312A621B7300FC20D0EB8580AF7C6301CDC251674C3671F385DE83F06F3D0191F89735C9E6DA5CF409461E0505365FF4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF286D9F0067A9F4A4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09949761863524546
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOccUtKm05wqpmrggX/qUXtl6Vky6lhJlw:50i8n0itFzDHFc3lmNpECU9rdw
MD5:	C78A3DADB9078FA503230CC7CF4026C0
SHA1:	C0746492841A530A7BE84111130D09704DC70BEA
SHA-256:	1BE8F6C9CF44FA8638979DB141739C24244E96BC069EB09FF755E0690D78BF28
SHA-512:	16B62DA427418959D12D9F55DB1E9E5ED5913985FD6A8F198E4574E250184503491D57819E9A1675C2B9C9F433E853F110AFD0B3D23C91DAAF9CD1005C65AB79
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF47037A2E7B8C9E4C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF59BE0FB7AA74C068.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5D7D0D5102B0E0F1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF61A136CA6F41C657.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.38410848677053
Encrypted:	false
SSDEEP:	48:6PyuWpvhPIFX4/T53mMVsGd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoDa55:syjTIcT5otRCrVq6DRg4a5chRCU
MD5:	F9FA20D30FA24299B9377C6875506554
SHA1:	11305FEB5691F54D99224E94B4A6F40BD6094F0A
SHA-256:	714B7B19E5CB6F94C7B9A87E615CC65DE0A438E0CB8B6D7D27BBFB10316753CE
SHA-512:	EEC000AAE0299839E3C79E43F8D7D87F9B15872E44CBB32DA2EE92885E9F9299563BA66E00E512EFD0191EBA9DAA158607A95E619CC9E79CA121A3725D72D70F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9C17DE074F8B19A0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBAA91B63B34D500E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.38410848677053
Encrypted:	false
SSDEEP:	48:6PyuWpvhPIFX4/T53mMVsGd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoDa55:syjTIcT5otRCrVq6DRg4a5chRCU
MD5:	F9FA20D30FA24299B9377C6875506554
SHA1:	11305FEB5691F54D99224E94B4A6F40BD6094F0A
SHA-256:	714B7B19E5CB6F94C7B9A87E615CC65DE0A438E0CB8B6D7D27BBFB10316753CE
SHA-512:	EEC000AAE0299839E3C79E43F8D7D87F9B15872E44CBB32DA2EE92885E9F9299563BA66E00E512EFD0191EBA9DAA158607A95E619CC9E79CA121A3725D72D70F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC3CDDCA110AC9A29.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.20474494122788708
Encrypted:	false
SSDEEP:	48:1b4g9d0V2AEkrCyAsSkd0Vxd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoDaN:ARCULRCrVq6DRg4a5cy
MD5:	903D3B7A6DD796317677761412FDCD61
SHA1:	FBA221056A7A768387ECA9CAA83CD5F604F4729A
SHA-256:	70F6E3580689BF9D7C630C1303198ABD992835F7A5351EE5E8870C52BCB54186
SHA-512:	CD458C8D43925E60846FD0B435AF0BB36969341E91CF1D776EC3B66136A9B6570C73A5C9F5F7E5540398DC4B21E89198AFBFE45DD4605633E2645CAC50AC5945
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC9DA50CA829CC9D8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.38410848677053
Encrypted:	false
SSDEEP:	48:6PyuWpvhPIFX4/T53mMVsGd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoDa55:syjTIcT5otRCrVq6DRg4a5chRCU
MD5:	F9FA20D30FA24299B9377C6875506554
SHA1:	11305FEB5691F54D99224E94B4A6F40BD6094F0A
SHA-256:	714B7B19E5CB6F94C7B9A87E615CC65DE0A438E0CB8B6D7D27BBFB10316753CE
SHA-512:	EEC000AAE0299839E3C79E43F8D7D87F9B15872E44CBB32DA2EE92885E9F9299563BA66E00E512EFD0191EBA9DAA158607A95E619CC9E79CA121A3725D72D70F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD1F7F6D97F461C7D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7452870893259427
Encrypted:	false
SSDEEP:	48:msV8PhauRc06WX4YnT57MVsGd0V2AEkrCyAVBMpWSkd0VjBMpXxdvy8DFD2lBoD4:Z4ha1onT1tRCrVq6DRg4a5chRCU
MD5:	2BCD066423C952D3EFF4E40572BB767A
SHA1:	565B2B22271E0AC1FC288C34253DC9E967370EDE
SHA-256:	F7BAEEB8B6D2243A2428E286AC3B1515E7C51B94D1BE97767E73BFD661992583
SHA-512:	10BC935D95350AA50892815C1EB158B7312A621B7300FC20D0EB8580AF7C6301CDC251674C3671F385DE83F06F3D0191F89735C9E6DA5CF409461E0505365FF4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.917799875281958
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fxsound_setup.exe
File size:	46'914'960 bytes
MD5:	9ea725e3e3bc82249957cc00b74c4882
SHA1:	3291c62ff7f044dabe2809317df09ae451384cd1
SHA256:	3541df625affa384feacf3cd3d64c47d2372eab9a2055d57dde08afe7f85862c
SHA512:	a9530ec03f952e38f51cb2af65ebc72d577322b63031ce6279085116ac413574ccfd839774195d50cd0909525e1ec403b40d4d5738b1ef2b5ec3af916d339234
SSDEEP:	786432:+LehHAuWfgcKbjylyM5fZFKlG4GjIKNnSTAk5jDSUfzTm8/t4zdahXZBHHAIK:+KOuG1KEyM5fZdxjIKNnEZDFLf/SJ+XO
TLSH:	B6A71231368AC537C57A01B01A2CDABB556CBE760B7154CB73C82D2F6AB49C21736E27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w._.3.1.3.1.3.1...2.>.1...4...1...7.2.1.S.5. .1.S.2.+.1.Q.4.0.1.S.4.V.1...5.).1...0.0.1...6.2.1.3.0...1.W.8.~.1.W...2.1.3...2.1

File Icon


Icon Hash:	45927168a2920045

Static PE Info

General

Entrypoint:	0x5b51a4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62E7A72C [Mon Aug 1 10:13:00 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d23703a6f12b30c40e0b3bc256b113cd

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	09/05/2023 01:00:00 09/05/2024 00:59:59
Subject Chain	CN="FxSound, LLC", O="FxSound, LLC", L=Mill Valley, S=California, C=US, SERIALNUMBER=201721910237, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	904606D5FE879BF037251B7E13C1CAE7
Thumbprint SHA-1:	913A9CB96D6560245DEC2055995CEF6441EA4B9F
Thumbprint SHA-256:	5EEDD80D7AA6E117DE4C5FAE1EA018DEA0C96F735635D2FE457A8CE7FDECED5F
Serial:	05CB73BD02C1F64ED47434A5D279074D

Entrypoint Preview

Instruction
call 00007FE31909B10Fh
jmp 00007FE31909A94Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FE319099FA3h
jmp 00007FE31909AAB2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006C1024h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006C1024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006C1024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2bf5ec	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2ca000	0x29368	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2cbb3f8	0x2998
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f4000	0x26810	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x267c58	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x267d00	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23afa8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x239000	0x2cc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2bc998	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x237b1f	0x237c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x239000	0x8762c	0x87800	False	0.31338827548431736	data	4.6063411973791215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c1000	0x8d24	0x6c00	False	0.14344618055555555	PGP symmetric key encrypted data - Plaintext or unencrypted data salted & iterated -	2.9234755461718365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2ca000	0x29368	0x29400	False	0.13069957386363637	data	4.907014416952871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f4000	0x26810	0x26a00	False	0.4470507180420712	data	6.513793248957895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x2cac70	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
IMAGE_FILE	0x2cac78	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
RTF_FILE	0x2cac80	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	English	United States	0.906832298136646
RTF_FILE	0x2cad24	0x2e9	Rich Text Format data, version 1, ANSI, code page 1252	English	United States	0.5503355704697986
RT_BITMAP	0x2cb010	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x2cb150	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x2cb978	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x2d0220	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x2d0c8c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x2d0de0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x2d1608	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.2579787234042553
RT_ICON	0x2d1a70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.11890243902439024
RT_ICON	0x2d2b18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.07811203319502075
RT_ICON	0x2d50c0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/m	English	United States	0.059931506849315065
RT_ICON	0x2d92e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3262411347517731
RT_MENU	0x2d9750	0x5c	data	English	United States	0.8478260869565217
RT_MENU	0x2d97ac	0x2a	data	English	United States	1.0714285714285714
RT_DIALOG	0x2d97d8	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x2d9884	0x2a6	data	English	United States	0.5132743362831859
RT_DIALOG	0x2d9b2c	0x3b4	data	English	United States	0.43248945147679324
RT_DIALOG	0x2d9ee0	0xbc	data	English	United States	0.7180851063829787
RT_DIALOG	0x2d9f9c	0x204	data	English	United States	0.560077519379845
RT_DIALOG	0x2da1a0	0x282	data	English	United States	0.48598130841121495
RT_DIALOG	0x2da424	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x2da4f0	0x146	data	English	United States	0.5736196319018405
RT_DIALOG	0x2da638	0x226	data	English	United States	0.4690909090909091
RT_DIALOG	0x2da860	0x388	data	English	United States	0.45464601769911506
RT_DIALOG	0x2dabe8	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x2dad9c	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x2daed4	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x2daf20	0x45c	data	English	United States	0.3844086021505376
RT_STRING	0x2db37c	0x344	data	English	United States	0.37320574162679426
RT_STRING	0x2db6c0	0x2f8	data	English	United States	0.4039473684210526
RT_STRING	0x2db9b8	0x598	data	English	United States	0.2807262569832402
RT_STRING	0x2dbf50	0x3aa	StarOffice Gallery theme i, 1627418368 objects, 1st n	English	United States	0.4211087420042644
RT_STRING	0x2dc2fc	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x2dc8bc	0x568	data	English	United States	0.32875722543352603
RT_STRING	0x2dce24	0x164	data	English	United States	0.5421348314606742
RT_STRING	0x2dcf88	0x520	data	English	United States	0.39176829268292684
RT_STRING	0x2dd4a8	0x1a0	data	English	United States	0.45913461538461536
RT_STRING	0x2dd648	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x2dd7d4	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x2dd9ec	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x2de010	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x2de670	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x2de954	0x3e	data	English	United States	0.7903225806451613
RT_VERSION	0x2de994	0x2e8	data	English	United States	0.4543010752688172
RT_HTML	0x2dec7c	0x3835	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08298005420807561
RT_HTML	0x2e24b4	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x2e37cc	0x52b	HTML document, ASCII text, with CRLF line terminators	English	United States	0.36281179138321995
RT_HTML	0x2e3cf8	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x2ea7c8	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x2eae6c	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x2ebeb8	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x2ed46c	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x2ef4c8	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x2f2b58	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, CreateEventExW, WaitForSingleObject, SetEvent, RemoveDirectoryW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, MoveFileW, GetLastError, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, InitializeCriticalSection, lstrcpynW, CreateThread, GetProcAddress, LoadLibraryExW, GetCurrentProcess, Sleep, WideCharToMultiByte, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetModuleHandleW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SystemTimeToFileTime, MultiByteToWideChar, GetSystemInfo, WaitForMultipleObjects, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, SetUnhandledExceptionFilter, FileTimeToSystemTime, GetEnvironmentVariableW, GetSystemTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateProcessW, GetExitCodeProcess, GetWindowsDirectoryW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetEnvironmentStringsW, LocalFree, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetSystemDefaultLangID, GetUserDefaultLangID, GetLocalTime, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, CreateNamedPipeW, ConnectNamedPipe, TerminateThread, LocalAlloc, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, GetSystemTimeAsFileTime, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetFileType, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2023 17:30:47.371854067 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:47.371887922 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:47.371965885 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:47.383769035 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:47.383785009 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:47.821238995 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:47.821346045 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.124084949 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.124119043 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.124497890 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.124562025 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.128710032 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.173254013 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.624572039 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.624639988 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.624764919 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.624897957 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.624917984 CET	443	49731	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.624927998 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.624978065 CET	49731	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.822432995 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.822491884 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:48.822575092 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.823056936 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:48.823092937 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:49.575010061 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:49.575114012 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:49.578989983 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:49.579006910 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:49.579237938 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:49.579292059 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:49.579618931 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:49.625258923 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:50.020435095 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:50.020519018 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:50.020541906 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:50.020585060 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:50.021008968 CET	49733	443	192.168.2.4	45.79.74.123
Nov 22, 2023 17:30:50.021043062 CET	443	49733	45.79.74.123	192.168.2.4
Nov 22, 2023 17:30:50.021106958 CET	49733	443	192.168.2.4	45.79.74.123

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2023 17:30:47.191593885 CET	59077	53	192.168.2.4	1.1.1.1
Nov 22, 2023 17:30:47.363414049 CET	53	59077	1.1.1.1	192.168.2.4
Nov 22, 2023 17:30:48.639980078 CET	49339	53	192.168.2.4	1.1.1.1
Nov 22, 2023 17:30:48.820985079 CET	53	49339	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2023 17:30:47.191593885 CET	192.168.2.4	1.1.1.1	0x26ec	Standard query (0)	download.fxsound.com	A (IP address)	IN (0x0001)	false
Nov 22, 2023 17:30:48.639980078 CET	192.168.2.4	1.1.1.1	0xab11	Standard query (0)	drive.fxsound.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2023 17:30:47.363414049 CET	1.1.1.1	192.168.2.4	0x26ec	No error (0)	download.fxsound.com		45.79.74.123	A (IP address)	IN (0x0001)	false
Nov 22, 2023 17:30:48.820985079 CET	1.1.1.1	192.168.2.4	0xab11	No error (0)	drive.fxsound.com		45.79.74.123	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

download.fxsound.com

drive.fxsound.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	45.79.74.123	443	8124	C:\Program Files\FxSound LLC\FxSound\updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 16:30:48 UTC	146	OUT	GET /updates HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: download.fxsound.com Connection: Keep-Alive Cache-Control: no-cache
2023-11-22 16:30:48 UTC	467	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4e 6f 76 20 32 30 32 33 20 31 36 3a 33 30 3a 34 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 69 6e 64 65 78 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 64 72 69 76 65 2e 66 78 73 6f 75 6e 64 2e 63 6f 6d 2f 63 73 2f 73 67 4d 50 61 42 59 74 51 76 6c 69 75 38 38 2f 64 6f 77 6e 6c 6f 61 64 73 33 2e 66 Data Ascii: HTTP/1.1 301 Moved PermanentlyDate: Wed, 22 Nov 2023 16:30:48 GMTServer: Apache/2.4.41 (Ubuntu)Strict-Transport-Security: max-age=15552000; includeSubDomainsX-Robots-Tag: noindexLocation: https://drive.fxsound.com/cs/sgMPaBYtQvliu88/downloads3.f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	45.79.74.123	443	8124	C:\Program Files\FxSound LLC\FxSound\updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 16:30:49 UTC	215	OUT	GET /cs/sgMPaBYtQvliu88/downloads3.fxsound.com/fxsound/1.1.20.0/updates.txt/download HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Connection: Keep-Alive Cache-Control: no-cache Host: drive.fxsound.com
2023-11-22 16:30:50 UTC	1161	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4e 6f 76 20 32 30 32 33 20 31 36 3a 33 30 3a 34 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 30 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 58 2d Data Ascii: HTTP/1.1 200 OKDate: Wed, 22 Nov 2023 16:30:49 GMTServer: Apache/2.4.41 (Ubuntu)Strict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Robots-Tag: noneX-Frame-Options: SAMEORIGINX-
2023-11-22 16:30:50 UTC	497	IN	Data Raw: 3b 61 69 75 3b 0d 0a 0d 0a 5b 55 70 64 61 74 65 5d 0d 0a 4e 61 6d 65 20 3d 20 46 78 53 6f 75 6e 64 0d 0a 50 72 6f 64 75 63 74 56 65 72 73 69 6f 6e 20 3d 20 31 2e 31 2e 32 30 2e 30 0d 0a 55 52 4c 20 3d 20 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 66 78 73 6f 75 6e 64 2e 63 6f 6d 2f 66 78 73 6f 75 6e 64 6c 61 74 65 73 74 0d 0a 55 52 4c 31 20 3d 20 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 73 33 2e 66 78 73 6f 75 6e 64 2e 63 6f 6d 2f 66 78 73 6f 75 6e 64 2f 32 2f 66 78 73 6f 75 6e 64 5f 73 65 74 75 70 2e 65 78 65 0d 0a 53 69 7a 65 20 3d 20 34 36 39 31 34 39 36 30 0d 0a 53 48 41 32 35 36 20 3d 20 33 35 34 31 44 46 36 32 35 41 46 46 41 33 38 34 46 45 41 43 46 33 43 44 33 44 36 34 43 34 37 44 32 33 37 32 45 41 42 39 41 32 30 35 35 44 35 37 44 44 Data Ascii: ;aiu;[Update]Name = FxSoundProductVersion = 1.1.20.0URL = https://download.fxsound.com/fxsoundlatestURL1 = https://downloads3.fxsound.com/fxsound/2/fxsound_setup.exeSize = 46914960SHA256 = 3541DF625AFFA384FEACF3CD3D64C47D2372EAB9A2055D57DD

Target ID:	0
Start time:	17:30:27
Start date:	22/11/2023
Path:	C:\Users\user\Desktop\fxsound_setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\fxsound_setup.exe
Imagebase:	0xf90000
File size:	46'914'960 bytes
MD5 hash:	9EA725E3E3BC82249957CC00B74C4882
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:30:29
Start date:	22/11/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff78d500000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:30:29
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 79E6DEEDE54CC17CA7037B4F320F9C61 C
Imagebase:	0xf30000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:30:29
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\fxsound_setup.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700670463 " AI_EUIMSI="
Imagebase:	0xf30000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:30:30
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 0C65C1CCF681D8CA1F2AEB8ADA388D35
Imagebase:	0xf30000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:30:35
Start date:	22/11/2023
Path:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12
Imagebase:	0x7ff7e06f0000
File size:	269'720 bytes
MD5 hash:	87EAD9C6CD7486421E3142B2A6480F8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:30:35
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:30:35
Start date:	22/11/2023
Path:	C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check
Imagebase:	0x350000
File size:	66'968 bytes
MD5 hash:	EFE3CF96899C9D9CC25815F88E9466E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:30:35
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:30:37
Start date:	22/11/2023
Path:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf
Imagebase:	0x7ff7e06f0000
File size:	269'720 bytes
MD5 hash:	87EAD9C6CD7486421E3142B2A6480F8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:30:37
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:30:38
Start date:	22/11/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	17:30:38
Start date:	22/11/2023
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fcd0319a-f7d0-4a4e-b0b4-a92d9d7e4c52}\fxvad.inf" "9" "4143399a7" "000000000000016C" "WinSta0\Default" "00000000000000C4" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"
Imagebase:	0x7ff619250000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:30:40
Start date:	22/11/2023
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "000000000000016C"
Imagebase:	0x7ff619250000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:30:42
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f
Imagebase:	0x950000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:30:42
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:30:43
Start date:	22/11/2023
Path:	C:\Program Files\FxSound LLC\FxSound\FxSound.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @
Imagebase:	0x7ff604770000
File size:	4'595'096 bytes
MD5 hash:	0A1E1E6B90FE62B9011393501BEF58D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	17:30:44
Start date:	22/11/2023
Path:	C:\Program Files\FxSound LLC\FxSound\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FxSound LLC\FxSound\updater.exe" /silent
Imagebase:	0x120000
File size:	1'057'176 bytes
MD5 hash:	BC7B29CD513AEC979CEFBF30E6D68A01
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	1071
Total number of Limit Nodes:	38

Executed Functions

Function 010E81C0 Relevance: 30.3, APIs: 14, Strings: 3, Instructions: 526
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 010E824E
GetLastError.KERNEL32 ref: 010E8254
GetUserNameW.ADVAPI32(00000000,?), ref: 010E829C
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 010E82D2
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 010E831C
RegDeleteValueW.KERNEL32(?,?,00000000,80000001,00000001,00000000,8C278AEA,00000000,?), ref: 010E8515
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,8C278AEA,00000000,?), ref: 010E854B
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 010E86A0
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,8C278AEA,00000000), ref: 010E86E2
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,8C278AEA,00000000), ref: 010E8727
RegDeleteKeyW.ADVAPI32(?,00000000), ref: 010E8749
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,8C278AEA,00000000), ref: 010E8785
RegDeleteValueW.KERNEL32(?,?,00000000,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000,8C278AEA,00000000), ref: 010E888A
RegCloseKey.ADVAPI32(?,?,?,00000000,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000,8C278AEA,00000000), ref: 010E88CC

Strings

Software, xrefs: 010E857E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010E87AA
UserDomain, xrefs: 010E82CD, 010E8317

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Close$Delete$EnvironmentNameUserValueVariable$ErrorInfoLastQuery
String ID: Software$Software\Microsoft\Windows\CurrentVersion\RunOnce$UserDomain
API String ID: 1615433478-4079418357
Opcode ID: 4e9ce11b953f4bcc8066d39b3b544523ffe76f9160b9a58c0c9dafa8f0dcbac5
Instruction ID: b79845d766c0443893efce071c5be55733c4dbb88c1e6d0549b292aa85955a08
Opcode Fuzzy Hash: 4e9ce11b953f4bcc8066d39b3b544523ffe76f9160b9a58c0c9dafa8f0dcbac5
Instruction Fuzzy Hash: DE225A70910209DFEF28DFA4CC99BEEBBB4BF14314F24815DE545A7290DB745A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010C4CA0 Relevance: 27.5, APIs: 11, Strings: 4, Instructions: 1259COMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

GetTickCount.KERNEL32 ref: 010C4D24
__Xtime_get_ticks.LIBCPMT ref: 010C4D2C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010C4D76
__Init_thread_footer.LIBCMT ref: 010C4F64
GetCurrentProcess.KERNEL32(?,?,?), ref: 010C517A
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,?), ref: 010C5187
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?), ref: 010C51A7
CloseHandle.KERNEL32(00000000,?,?,?), ref: 010C51D2

Strings

/uninstall, xrefs: 010C5383
\/:*?"<>|, xrefs: 010C4F26
\\?\, xrefs: 010C5A9D
VersionString, xrefs: 010C5454, 010C54A5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footerProcess$Token$CloseCountCurrentHandleHeapInformationOpenTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: /uninstall$VersionString$\/:*?"<>|$\\?\
API String ID: 3363527671-654522458
Opcode ID: 5a557ea5a7d4d4c1fb5a4ec5e4a0232a254fdefd8f0620d7d9a894111fba5587
Instruction ID: 75ac48b7f381f1bd594c0ca52c123fbad5831641173e4fe70aa7105e955f7b83
Opcode Fuzzy Hash: 5a557ea5a7d4d4c1fb5a4ec5e4a0232a254fdefd8f0620d7d9a894111fba5587
Instruction Fuzzy Hash: 43B2BC30A00609DFEB14DFA8CC48BAEBBF5BF44714F14829DE855AB291DB74A905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010ACF90 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010ACFD8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 010ACFE5
GetLastError.KERNEL32 ref: 010ACFEF
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,000000FF), ref: 010AD019
GetLastError.KERNEL32 ref: 010AD01F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),000000FF,000000FF,000000FF,000000FF), ref: 010AD045
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 010AD078
EqualSid.ADVAPI32(00000000,?), ref: 010AD087
FreeSid.ADVAPI32(?), ref: 010AD096
FindCloseChangeNotification.KERNEL32(00000000), ref: 010AD0D0

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateChangeCloseCurrentEqualFindFreeInitializeNotificationOpen
String ID:
API String ID: 2037597787-0
Opcode ID: dc98927bc561d3d1a23e183ba8665bd2065f6bf19c4f6cca21ab0335e62e3077
Instruction ID: 9fe87f477357de12834d6d5218fbf46570d7197c38f8465e3f5af89e5a6b3da2
Opcode Fuzzy Hash: dc98927bc561d3d1a23e183ba8665bd2065f6bf19c4f6cca21ab0335e62e3077
Instruction Fuzzy Hash: 37418771940219EFEF24CFE4C848BEEBBB8EF08314F504059E810B2690D7799A04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 010D0640 Relevance: 15.8, APIs: 10, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 844618260cbf9b4d784b50c7bc30ca247cf03ee06164ef9324482d533bb01d04
Instruction ID: 98288996ab232982f3617f7a88f5f70673d655b19caad4b21b7b96879580557f
Opcode Fuzzy Hash: 844618260cbf9b4d784b50c7bc30ca247cf03ee06164ef9324482d533bb01d04
Instruction Fuzzy Hash: 2272BF30A0034ADFEB14DFA8C888BDDBBF4BF45314F148299E559AB295DB74A944CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010AE740 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,8C278AEA,?,?,00000000), ref: 010AE77E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 010AE7A1
FreeLibrary.KERNEL32(00000000), ref: 010AE81F

Strings

LoadIconMetric, xrefs: 010AE79B
ComCtl32.dll, xrefs: 010AE772

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: 613f50a9401736caffa3bbf090c28bfaa1cd15ca561b1c5c95f8089dcd352da1
Instruction ID: 21aab9a67e97262d719329337901b2b6521e05033388c88fa1fb8020ad96146a
Opcode Fuzzy Hash: 613f50a9401736caffa3bbf090c28bfaa1cd15ca561b1c5c95f8089dcd352da1
Instruction Fuzzy Hash: A9316F71A00259ABEF148FA9DC48BAEBFFCEB48750F404269F925E7280D77589008B90

Uniqueness

Uniqueness Score: -1.00%

Function 010DB860 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 010DB93A

Strings

\, xrefs: 010DB8DE
\, xrefs: 010DB8B4
\, xrefs: 010DB8BC

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 83386aabbca5e07e7487e6f96dcb3c6d2930da169822b26e5eb0553d2690aaad
Instruction ID: 837bb0202e3d9e71eb5754d27e7dfe60de75fca38e976271655dee4577f67d92
Opcode Fuzzy Hash: 83386aabbca5e07e7487e6f96dcb3c6d2930da169822b26e5eb0553d2690aaad
Instruction Fuzzy Hash: F941D462E14395CBCB70DF28C4416ABF7E4FF8A254F164A6EE9D897040E7708985C3C6

Uniqueness

Uniqueness Score: -1.00%

Function 01067A10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 01067A51

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

LoadLibraryExW.KERNEL32(?,00000000,00000000,011A0D6D,000000FF), ref: 01067B24

Strings

UxTheme.dll, xrefs: 01067A2C, 01067AFF, 01067B00, 01067B94

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem
String ID: UxTheme.dll
API String ID: 2586271605-352951104
Opcode ID: d7abb6c10d74a1842b4212add4f04715a783a66cb034d91746129304f6acf2fe
Instruction ID: 99a57e1fa2a051063d61d16976bb28b5dcd2bdad3873b1de6ce593a31b7acc03
Opcode Fuzzy Hash: d7abb6c10d74a1842b4212add4f04715a783a66cb034d91746129304f6acf2fe
Instruction Fuzzy Hash: 7EA18AB0501745EFE718CF68C858B9ABBF4FF04308F14825DD9699B681D7BAA618CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01144245 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,010D35FE,?,?,?,?,?,?), ref: 0114424A
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?), ref: 01144251
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 01144297
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 0114429E

Part of subcall function 011440E3: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144107
Part of subcall function 011440E3: HeapAlloc.KERNEL32(00000000,?,0114428D,?,?,?,?,?,?,?), ref: 0114410E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 26a0a612abf9dd0ff1e071638e2871f36c105f3d6f764f5c955b3d972cc10b48
Instruction ID: 096571c0babe6725dbc32664d79407fd0d5ec639d5ba94b19a9d69df78bd6373
Opcode Fuzzy Hash: 26a0a612abf9dd0ff1e071638e2871f36c105f3d6f764f5c955b3d972cc10b48
Instruction Fuzzy Hash: 8AF02472A04A128BD73D2BFC780CF6E3D68AF80FA57024138F566D6508CF30C4418761

Uniqueness

Uniqueness Score: -1.00%

Function 010AB1B0 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?), ref: 010AB24D
FindClose.KERNEL32(00000000), ref: 010AB2AC

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: 4337654a535712f64e3726bbc114ffd3cea58c838e631507ded35e78055508d3
Instruction ID: fc58e3a337b9660b8a93730621c48707c88dfad8d20a22bf2beba62687e0e526
Opcode Fuzzy Hash: 4337654a535712f64e3726bbc114ffd3cea58c838e631507ded35e78055508d3
Instruction Fuzzy Hash: 9C31AF71904618DFDB28DF99C848BAEBBF4EF45328F5082AFD959A7380D7319944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010E98C0 Relevance: 3.1, APIs: 2, Instructions: 86filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,8C278AEA,8C278AEA,?,?,?,?,00000000), ref: 010E9949
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,8C278AEA,8C278AEA,?,?,?,?,00000000,011B83A5), ref: 010E996A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: f82bf0ee2f1d00cc1cd3999114c9f947a7f7251bc55fb07fdd6d489016fb10e8
Instruction ID: e58f470d0025f3b4f94f578e6a62c210c498e82c756f7ba5aee6b14f6e0c949c
Opcode Fuzzy Hash: f82bf0ee2f1d00cc1cd3999114c9f947a7f7251bc55fb07fdd6d489016fb10e8
Instruction Fuzzy Hash: 0631F731A48746AFE731CF19DC05B99BFE8EB01720F10866EF9A5976D0D775A540CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FCAEA0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00FCAEB8
SetUnhandledExceptionFilter.KERNEL32(010AA060), ref: 00FCAECE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 9d0b2e0582b232ac3c9aad4dad787a129e07de87fc1a36c331c91f485d300180
Instruction ID: 76d47cd7c53ee0907d96e04881872ec1c9270e7a83043b5e13649ef7da0a0510
Opcode Fuzzy Hash: 9d0b2e0582b232ac3c9aad4dad787a129e07de87fc1a36c331c91f485d300180
Instruction Fuzzy Hash: FFE08636A40254AFCB206792A84DF5A3F94EBA6B2DF054459F14467140C7B09844D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 010EF0D0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: ec95854e7dc8d13e923f8cf8089ad217f4590993dbf7f23f0425874bcbb66f87
Instruction ID: fd7b69152a9a591c52284f2cd1c12da3909216d4138e58f10d79b80159888729
Opcode Fuzzy Hash: ec95854e7dc8d13e923f8cf8089ad217f4590993dbf7f23f0425874bcbb66f87
Instruction Fuzzy Hash: FD6138B0500745CFEB54CF69C54838ABFE0FF08318F14899DD58A9B782D7B9A509DB91

Uniqueness

Uniqueness Score: -1.00%

Function 010B0410 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 010B047E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 010B04C5
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 010B04E4
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 010B0513
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 010B0588
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 010B05F1
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 010B0654
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 010B06A6
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 010B0743
GetProcAddress.KERNEL32(00000000), ref: 010B074A
__Init_thread_footer.LIBCMT ref: 010B075E
GetCurrentProcess.KERNEL32(?), ref: 010B0781
IsWow64Process.KERNEL32(00000000), ref: 010B0788
RegCloseKey.ADVAPI32(00000000), ref: 010B07C2

Strings

CSDVersion, xrefs: 010B069B
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 010B0474
CurrentMinorVersionNumber, xrefs: 010B04D9
CurrentVersion, xrefs: 010B0508
CurrentMajorVersionNumber, xrefs: 010B04BA
ReleaseId, xrefs: 010B0649
kernel32, xrefs: 010B073E
IsWow64Process, xrefs: 010B0739
co_release, xrefs: 010B05F9
rs_prerelease, xrefs: 010B0611
CurrentBuildNumber, xrefs: 010B057D
BuildBranch, xrefs: 010B05E6

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 1906320730-525127412
Opcode ID: 2caba34d8b71e80df07bc029dde537fb613c06d113d8ffc8e3da1b10a1622a4f
Instruction ID: 1a249223c282ea6c55663a10c1191431b4ee6b49d4979b16511c2765881e3d28
Opcode Fuzzy Hash: 2caba34d8b71e80df07bc029dde537fb613c06d113d8ffc8e3da1b10a1622a4f
Instruction Fuzzy Hash: 45A18E71940718DEDF60DF24DC88BDAB7F8FB04705F0041EAE589A6284EB749A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010B07F0 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 010B0860
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 010B089B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 010B0916
RegCloseKey.KERNEL32(00000000), ref: 010B0AEE

Strings

Small Business, xrefs: 010B0950
Embedded(Restricted), xrefs: 010B0A47
Compute Server, xrefs: 010B0A8C
ProductType, xrefs: 010B0890
Terminal Server, xrefs: 010B09B4
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 010B0856
EmbeddedNT, xrefs: 010B09E6
WinNT, xrefs: 010B08A1
Storage Server, xrefs: 010B0A75
Personal, xrefs: 010B0A19
ServerNT, xrefs: 010B08C4
Enterprise, xrefs: 010B0969
DataCenter, xrefs: 010B09FF
CommunicationServer, xrefs: 010B099B
BackOffice, xrefs: 010B0982
Security Appliance, xrefs: 010B0A5E
ProductSuite, xrefs: 010B090B
Blade, xrefs: 010B0A30
Small Business(Restricted), xrefs: 010B09CD

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: dcdc006284f9c65972b3e40fdfa1080b78efb2be11c84bea5ca31bc5b57f790f
Instruction ID: b10400ea9e61833bda53d04d322322fbbe732e11c8ab67768c15d9c9259c52ea
Opcode Fuzzy Hash: dcdc006284f9c65972b3e40fdfa1080b78efb2be11c84bea5ca31bc5b57f790f
Instruction Fuzzy Hash: 507107307043098AEB6A9A24CDC4BEF76F9FB40304F4085F5A995AB78AEB34DD45CB45

Uniqueness

Uniqueness Score: -1.00%

Function 010BFE70 Relevance: 39.1, APIs: 12, Strings: 10, Instructions: 599libraryloaderCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,SystemFolder,0000000C,?,?,?), ref: 010C0075
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 010C0170
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D,?,?,?), ref: 010C0270
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D,?,?,?), ref: 010C0355
GetTempPathW.KERNEL32(00000104,?,WindowsVolume,0000000D,?,?,?), ref: 010C03CB
GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D,?,?,?), ref: 010C0454
SHGetSpecialFolderLocation.SHELL32(00000000,?,WindowsVolume,0000000D,?,?,?), ref: 010C0532
__Init_thread_footer.LIBCMT ref: 010C05A6
LoadLibraryW.KERNEL32(shfolder.dll,?,?,?), ref: 010C05BC
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 010C05EE
SHGetPathFromIDListW.SHELL32(?,?), ref: 010C065C
SHGetMalloc.SHELL32(00000000), ref: 010C0675

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Strings

SHGetFolderPathW, xrefs: 010C05E8
shfolder.dll, xrefs: 010C05B7
WindowsVolume, xrefs: 010C02E4, 010C02F9, 010C0303
SystemFolder, xrefs: 010BFFE9, 010BFFFE, 010C0008
SETUPEXEDIR, xrefs: 010C0401
WindowsFolder, xrefs: 010C01FD, 010C0212, 010C021C
TempFolder, xrefs: 010C0382
ProgramW6432, xrefs: 010BFF05
ProgramFiles64Folder, xrefs: 010BFEAA
System32Folder, xrefs: 010C00FD, 010C0112, 010C011C

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DirectoryPath$FolderWindows$AddressAllocateFileFromHeapInit_thread_footerLibraryListLoadLocationMallocModuleNameProcSpecialSystemTemp
String ID: ProgramFiles64Folder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 3671250-2142986682
Opcode ID: e7d55de68f55e9669d03b14056ecc1bdc4c600a9ed5885a4258ccb7939d844f3
Instruction ID: b36f7bcc1aebad0705c674c4e4aaa49a3b24017f6677f49e4a12337faac70228
Opcode Fuzzy Hash: e7d55de68f55e9669d03b14056ecc1bdc4c600a9ed5885a4258ccb7939d844f3
Instruction Fuzzy Hash: 85221274600206CBEB64DF68CC84BAEB7B5EF54B14F5442DCF5869B295EB319A80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01092DF0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 327
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

MoveFileW.KERNEL32(?,?), ref: 01092F6A
GetModuleHandleW.KERNEL32(kernel32,?), ref: 01092FAC
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 01092FF4
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 0109304C
__Init_thread_footer.LIBCMT ref: 0109305C
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 010930A4
__Init_thread_footer.LIBCMT ref: 01093004

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

__Init_thread_footer.LIBCMT ref: 010930B4

Part of subcall function 01067A10: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 01067A51

Strings

@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 01092E87
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 01092E80, 01092E8F
SetDefaultDllDirectories, xrefs: 0109309E
kernel32, xrefs: 01092FA7
SetDllDirectory, xrefs: 01093046
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 01092E62
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 01092E67, 01092E6F
kernel32.dll, xrefs: 010931AF
SetSearchPathMode, xrefs: 01092FEE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$CriticalSection$ConditionDirectoryEnterFileHandleHeapLeaveModuleMoveProcessSystemVariableWake
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$kernel32$kernel32.dll
API String ID: 3437638698-3455668873
Opcode ID: 1b186c904f03d4fa5222884c52869414ad7b82d12d63ecc53bbb859bdad9ae89
Instruction ID: a3d6c900a197653ac2c87d5332a8f3b3a5f88930524405388d819a0334aaad32
Opcode Fuzzy Hash: 1b186c904f03d4fa5222884c52869414ad7b82d12d63ecc53bbb859bdad9ae89
Instruction Fuzzy Hash: BAE14BB0900689DFDF28DFA8D948BDEBBE4FB14318F108159E858AB251D7349948CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010C6470 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 773
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 010C652E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 010C6558

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

Strings

A valid language was received from commnad line. This is:, xrefs: 010C6AAA
Code returned to Windows by setup:, xrefs: 010C68B1
Language of a related product is:, xrefs: 010C6CAC
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 010C6C44
Language selected programatically for UI:, xrefs: 010C6D62
AI_BOOTSTRAPPERLANGS, xrefs: 010C7660, 010C7672, 010C767C
Languages of setup:, xrefs: 010C78BB
%hu, xrefs: 010C6AD8
Software\Caphyon\Advanced Installer\, xrefs: 010C6C30
Language used for UI:, xrefs: 010C6DDE
Advinst_Extract_, xrefs: 010C64C5, 010C64D7, 010C64E1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ByteCharInit_thread_footerMultiWide$FindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\
API String ID: 1419962739-297406034
Opcode ID: ee3c245041482cb03042951a48020c97ebeb382e891819d41424cc5968279d79
Instruction ID: 92060b93279c910649413f56e37483c6c91f3fcd1ded46dfc9387ae5a3772185
Opcode Fuzzy Hash: ee3c245041482cb03042951a48020c97ebeb382e891819d41424cc5968279d79
Instruction Fuzzy Hash: DF52D17090064A9BEB24DBACCC54BAEBBF4EF44714F1481ACE955AB391EB359904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010C6130 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 648threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 010C6300
SetLastError.KERNEL32(0000000E), ref: 010C631D
GetCurrentThreadId.KERNEL32 ref: 010C6335
EnterCriticalSection.KERNEL32(0125957C), ref: 010C6352
LeaveCriticalSection.KERNEL32(0125957C), ref: 010C6375
DialogBoxParamW.USER32(000007D0,00000000,01006090,00000000), ref: 010C6392
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 010C652E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 010C6558

Part of subcall function 01094B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,01259384,010DDA40,?), ref: 01094B58
Part of subcall function 01094B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 01094B8A

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 010C66E8
SetEvent.KERNEL32(?), ref: 010C6749

Part of subcall function 010D1C20: DeleteFileW.KERNEL32(?,?,?,?,?,010C676B,?), ref: 010D1C4B

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Strings

v, xrefs: 010C6375
Code returned to Windows by setup:, xrefs: 010C68B1
Advinst_Extract_, xrefs: 010C64C5, 010C64D7, 010C64E1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ByteCharMultiWide$CriticalEventInit_thread_footerSection$ActiveCurrentDeleteDialogEnterErrorFileHeapLastLeaveParamProcessThreadWindow
String ID: v$Advinst_Extract_$Code returned to Windows by setup:
API String ID: 2923632737-2472245143
Opcode ID: edc52e2e4dd1ea44fb6e8fbeec45e5e7d3ec40d01c1b31f2638f344c44b275f6
Instruction ID: c8b55694e4c62e96f05611031e123663d4a2ace55f7449a39f44354feb1639a4
Opcode Fuzzy Hash: edc52e2e4dd1ea44fb6e8fbeec45e5e7d3ec40d01c1b31f2638f344c44b275f6
Instruction Fuzzy Hash: 6D42AD70900249DFEB14DFA8C848BDEBBF8AF15314F1482ADE855AB391DB759A04CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010D3590 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 179
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 010D35CA
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?), ref: 010D3607
GetCurrentThreadId.KERNEL32 ref: 010D3692
SetWindowTextW.USER32(?,?), ref: 010D371C
GetDlgItem.USER32(?,000003E9), ref: 010D3726
SetWindowTextW.USER32(00000000,?), ref: 010D3732
GetDlgItem.USER32(?,00000002), ref: 010D379F
SetWindowTextW.USER32(00000000,?), ref: 010D37A7

Part of subcall function 010CC1B0: GetDlgItem.USER32(?,00000002), ref: 010CC1D0
Part of subcall function 010CC1B0: GetWindowRect.USER32(00000000,?), ref: 010CC1E6
Part of subcall function 010CC1B0: ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,010D35EA,?,?,?,?,?,?), ref: 010CC1FF
Part of subcall function 010CC1B0: InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,010D35EA,?,?), ref: 010CC20A
Part of subcall function 010CC1B0: GetDlgItem.USER32(?,000003E9), ref: 010CC21C
Part of subcall function 010CC1B0: GetWindowRect.USER32(00000000,?), ref: 010CC232
Part of subcall function 010CC1B0: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,010D35EA), ref: 010CC275

Strings

v, xrefs: 010D366D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Item$RectText$ActiveCurrentErrorInvalidateLastShowThread
String ID: v
API String ID: 127311041-3261393531
Opcode ID: af6936ecadf287ec715e3dbb9d40ad104969ceb37571a920b9c2a8d9e81e0643
Instruction ID: defc6db12d5a05fa183ce637bac4765c48c24ff1a0039172c32afd9df5ff8504
Opcode Fuzzy Hash: af6936ecadf287ec715e3dbb9d40ad104969ceb37571a920b9c2a8d9e81e0643
Instruction Fuzzy Hash: 1261CDB1900705EFDB21DF68DC88B9ABBF4FF04324F148299E9699B295C770A940CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01143FD7 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,01144376,01257F88,?,00000000,?,010D361C,?,00000000,00000000,?,?), ref: 01143FE9
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,01144376,01257F88,?,00000000,?,010D361C,?,00000000,00000000), ref: 01143FFE
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0114407A

Strings

AtlThunk_AllocateData, xrefs: 0114400F
AtlThunk_InitData, xrefs: 01144026
atlthunk.dll, xrefs: 01143FF9
AtlThunk_FreeData, xrefs: 01144054
AtlThunk_DataToCode, xrefs: 0114403D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 3fe8ee0619611aba4714ad2c0944fcc0d89e6d4a33fe2b5d03b4b082002f1702
Instruction ID: b09b31c4fae456b846a6d72d6d8d56d4760217d89bb6889f61e394555d6f8601
Opcode Fuzzy Hash: 3fe8ee0619611aba4714ad2c0944fcc0d89e6d4a33fe2b5d03b4b082002f1702
Instruction Fuzzy Hash: 7E01C4305803146BEB2EE719AD07BDA3F585F21F4CF04009CFD0467545E7A18A28C6C6

Uniqueness

Uniqueness Score: -1.00%

Function 01093420 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01093420: GetModuleFileNameW.KERNEL32(00000000,?,00000104,8C278AEA,00000000,?,011A83F6,000000FF), ref: 01093368

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

FreeLibrary.KERNEL32(00000001,8C278AEA,?,00000001,?,?,?), ref: 010935B7
EnterCriticalSection.KERNEL32(01259338), ref: 010935D2
DestroyWindow.USER32(00000000), ref: 010935F0
LeaveCriticalSection.KERNEL32(01259338), ref: 01093639

Strings

v, xrefs: 01093639
.local, xrefs: 010933D4
%s%lu, xrefs: 0109349D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalInit_thread_footerSection$DestroyEnterFileFreeHeapLeaveLibraryModuleNameProcessWindow
String ID: v$%s%lu$.local
API String ID: 3496055493-1141559199
Opcode ID: 6aa45e3f23dd4da584ac6b2b296ebc5c47dfd49f984f1fcc0bd95c999e6abf68
Instruction ID: 8f038325b1d417de63df33decc3ddd2720ab491014c7d87bc8e1b65988d14f77
Opcode Fuzzy Hash: 6aa45e3f23dd4da584ac6b2b296ebc5c47dfd49f984f1fcc0bd95c999e6abf68
Instruction Fuzzy Hash: 7591AC71A01605DBEF24DF68D898B6ABBF4FF44314F1485ADE895AB380DB74A800CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010B4F80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010B0240: __Init_thread_footer.LIBCMT ref: 010B0312

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,8C278AEA,00000000,00000000,?), ref: 010B4FD5
GetTempPathW.KERNEL32(00000104,?), ref: 010B5069
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 010B509A
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 010B512D
CopyFileW.KERNEL32(?,?,00000000), ref: 010B514F
Wow64RevertWow64FsRedirection.KERNEL32(?), ref: 010B517E

Strings

shim_clone, xrefs: 010B508E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderInit_thread_footerNameRevert
String ID: shim_clone
API String ID: 4264308349-3944563459
Opcode ID: bdaa9055a97c91b14130e036187c728f8e84092782c6708a8a492d4d37853f27
Instruction ID: 459d7f16f890557c53a4d20fdefc9d5e8f3f17e88d5ba33825ef00464ae987e8
Opcode Fuzzy Hash: bdaa9055a97c91b14130e036187c728f8e84092782c6708a8a492d4d37853f27
Instruction Fuzzy Hash: 3D515974A002189FEB29DF24CC84BEEBBF9EF54700F4440E9E589D7180EB319A81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010C4E40 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

APIs

Part of subcall function 010C4CA0: GetTickCount.KERNEL32 ref: 010C4D24
Part of subcall function 010C4CA0: __Xtime_get_ticks.LIBCPMT ref: 010C4D2C
Part of subcall function 010C4CA0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010C4D76

Part of subcall function 010E81C0: GetUserNameW.ADVAPI32(00000000,?), ref: 010E824E
Part of subcall function 010E81C0: GetLastError.KERNEL32 ref: 010E8254
Part of subcall function 010E81C0: GetUserNameW.ADVAPI32(00000000,?), ref: 010E829C
Part of subcall function 010E81C0: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 010E82D2
Part of subcall function 010E81C0: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 010E831C

__Init_thread_footer.LIBCMT ref: 010C4F64

Strings

\/:*?"<>|, xrefs: 010C4F26

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: EnvironmentNameUserVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 2099558200-3830478854
Opcode ID: 28ae0602581e063b22572af1b96626d0878306d479091114a3fb8e454a64c52f
Instruction ID: 45b795c9b76d462343207231d186db5e8281a7b04fe820899f916df966b4fa95
Opcode Fuzzy Hash: 28ae0602581e063b22572af1b96626d0878306d479091114a3fb8e454a64c52f
Instruction Fuzzy Hash: 99C18970A01349CFEF14DFA8C898BAEBBB0BF54708F24416CE545AB291DB746A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010A88D0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 212
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,8C278AEA), ref: 010A8ACE
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 010A8ADE
RegOpenKeyExW.KERNEL32(?,?,00000000,000000FF,00000000,?,8C278AEA), ref: 010A8B13
RegCloseKey.ADVAPI32(00000000), ref: 010A8B27

Strings

Advapi32.dll, xrefs: 010A8AC9
RegOpenKeyTransactedW, xrefs: 010A8AD8

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 9e1f2fd6fb0566cea8dd107d4922248c3feb68968645c8e1de3e4c640cf30fc5
Instruction ID: 578fef7687381289b3b2e311d853cb9b9a239eaa4bc59b3f40554345ab9a0e42
Opcode Fuzzy Hash: 9e1f2fd6fb0566cea8dd107d4922248c3feb68968645c8e1de3e4c640cf30fc5
Instruction Fuzzy Hash: 45916CB0D14308DFEB14CFA8C959B9EBBF4FF54300F54855AE859AB281D774AA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010ED430 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(011B902D,-00000400,?,00000002,00000400,8C278AEA,?,?,?), ref: 010ED4D6
GetLastError.KERNEL32(?,?), ref: 010ED4E4
ReadFile.KERNEL32(011B902D,00000000,00000400,?,00000000,?,?), ref: 010ED4FF

Strings

ADVINSTSFX, xrefs: 010ED533, 010ED5EE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: cd77fc116b723a97f169e027403baff5c1bf0bf961830834cee0ae4f9dce0ab5
Instruction ID: a7312a4ebace683aea26aa2455de4551c9a69cc421a83e06f3925ca40cc84d37
Opcode Fuzzy Hash: cd77fc116b723a97f169e027403baff5c1bf0bf961830834cee0ae4f9dce0ab5
Instruction Fuzzy Hash: DC61C6B1E002099FDB15CFA9C888BBEBBF5FF49324F1442A5E555AB281D734E941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01096C10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,8C278AEA,00000000,?,75A8EB20,?,?,0116CB30,000000FF), ref: 01096C53
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 01096C7C
RegCreateKeyExW.KERNEL32(?,010E887A,00000000,00000000,00000000,0116CB30,00000000,00000000,0116CB30,8C278AEA,00000000,?,75A8EB20,?,?,0116CB30), ref: 01096CC9
RegCloseKey.ADVAPI32(00000000,?,75A8EB20,?,?,0116CB30,000000FF), ref: 01096CDC

Strings

RegCreateKeyTransactedW, xrefs: 01096C76
Advapi32.dll, xrefs: 01096C4E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-2994018265
Opcode ID: 7395f8aa448e9d1323be45b4772fc6ee0109047d71d1b6fa08d95f09db6b5c22
Instruction ID: 8b23d80ff7993629e82487d924fe6d75078eb745833cba34bf2499a579b4af20
Opcode Fuzzy Hash: 7395f8aa448e9d1323be45b4772fc6ee0109047d71d1b6fa08d95f09db6b5c22
Instruction Fuzzy Hash: 4A31A272A40249BFEF258F49DC55FAABBA8FB04750F10816AF915D7280D776A810DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010CC1B0 Relevance: 10.6, APIs: 7, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000002), ref: 010CC1D0
GetWindowRect.USER32(00000000,?), ref: 010CC1E6
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,010D35EA,?,?,?,?,?,?), ref: 010CC1FF
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,010D35EA,?,?), ref: 010CC20A
GetDlgItem.USER32(?,000003E9), ref: 010CC21C
GetWindowRect.USER32(00000000,?), ref: 010CC232
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,010D35EA), ref: 010CC275

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: 70e3fc84ec4441bc582a7d55a1f1fefa90962f6b43bb7f91fd360d9899be878f
Instruction ID: 06e8409ab0631aa36665c343e4fe7a2a45f05240b7cc84c32fe2d3a4eb71470a
Opcode Fuzzy Hash: 70e3fc84ec4441bc582a7d55a1f1fefa90962f6b43bb7f91fd360d9899be878f
Instruction Fuzzy Hash: 02213B71644340AFD310DF24E989B6B7BE9EF8C714F008659F859D6281E730E9818B52

Uniqueness

Uniqueness Score: -1.00%

Function 010D0160 Relevance: 9.4, APIs: 6, Instructions: 354
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,8C278AEA,?,?,00000002,?,?,?,?,?,?,00000000,011B32F2), ref: 010D01B7
GetLastError.KERNEL32(?,00000002), ref: 010D0449
GetLastError.KERNEL32(?,00000002), ref: 010D04F3
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,011B32F2,000000FF,?,010CF05A,00000010), ref: 010D01C6

Part of subcall function 010AE5B0: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,8C278AEA,?,00000000), ref: 010AE5FB
Part of subcall function 010AE5B0: GetLastError.KERNEL32(?,00000000), ref: 010AE605

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 010D0288
ReadFile.KERNEL32(?,8C278AEA,00000000,00000000,00000000,00000001,?,00000002), ref: 010D0305

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: cfb075050a394911b3968b007cb6b69311119c0ff324196f9e1e169a779ab63b
Instruction ID: 5397ddbf48d7e8184248d2866a41992ecf0cf553dbe520a1f19876e25259455c
Opcode Fuzzy Hash: cfb075050a394911b3968b007cb6b69311119c0ff324196f9e1e169a779ab63b
Instruction Fuzzy Hash: 8FD19371D00209DFDB04DFA8C884BAEFBB5FF44314F1482A9E959AB395EB749905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010AB720 Relevance: 9.2, APIs: 6, Instructions: 233COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,8C278AEA,00000000,?,?), ref: 010AB76B
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,011E4494,00000001,?,?,?,?,?,00000000,011AC395,000000FF,?,010EEC41), ref: 010AB82A
GetLastError.KERNEL32(?,?,?,?,00000000,011AC395,000000FF,?,010EEC41,00000000,?,00000000), ref: 010AB838

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: 157efd6ca05f0ff7b8583290a2dbe5ffd8aaa69e667fbf09d33c0ee815919a1d
Instruction ID: 55d02be875a2d317288b0da796e13033148cfcf7502223e529d52608ddf71dda
Opcode Fuzzy Hash: 157efd6ca05f0ff7b8583290a2dbe5ffd8aaa69e667fbf09d33c0ee815919a1d
Instruction Fuzzy Hash: EE81AF31A046099FDB15DFACC888BEDBBF4EF15324F644269E960A72D0DB759A04CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010D37D0 Relevance: 9.1, APIs: 6, Instructions: 69threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0015EF30,011F0B08,00000000,?), ref: 010D384D
GetLastError.KERNEL32 ref: 010D385A
WaitForSingleObject.KERNEL32(00000000,FFFFFFFF), ref: 010D3883
GetExitCodeThread.KERNEL32(00000000,?), ref: 010D389D
TerminateThread.KERNEL32(00000000,00000000), ref: 010D38B5
FindCloseChangeNotification.KERNEL32(00000000), ref: 010D38BE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Thread$ChangeCloseCodeCreateErrorExitFindLastNotificationObjectSingleTerminateWait
String ID:
API String ID: 766675602-0
Opcode ID: 6320fb92cefc4d453aa2ffd430cb443492b70f34666efbbfdf1c387c9d94783a
Instruction ID: fc160e25ef5163e5c2d9e5eba60560fc0f7f21dc87d042b4c74622c5dc1cd52e
Opcode Fuzzy Hash: 6320fb92cefc4d453aa2ffd430cb443492b70f34666efbbfdf1c387c9d94783a
Instruction Fuzzy Hash: CB31E6B090031DAFDF14CFA4C949BDEBBB8FB08314F104269E960B6290D7799A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 010B5480 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(80004005,011B3C95,8C278AEA,?,?,?,?,?,00000000,011B3C95,000000FF,?,80004005,8C278AEA,?), ref: 010B54E5
GetFileVersionInfoW.KERNELBASE(80004005,?,00000000,000000FF,00000000,?,?,?,?,00000000,011B3C95,000000FF,?,80004005,8C278AEA,?), ref: 010B5533

Strings

ProductName, xrefs: 010B5593
\VarFileInfo\Translation, xrefs: 010B5567
\StringFileInfo\%04x%04x\%s, xrefs: 010B559D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: 9b430b5cf15f9a602ff26cd48983ce5d0730b1187748d6d7e8f4ec74710e2f72
Instruction ID: 2caa97a2e176419061243f8cbafa0a014c04f127c58409e649f4f237d1fbddef
Opcode Fuzzy Hash: 9b430b5cf15f9a602ff26cd48983ce5d0730b1187748d6d7e8f4ec74710e2f72
Instruction Fuzzy Hash: E661BE719012099FDB14DFACDC99AEEBBF8EF15315F1481A9E451E7290EB349900CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010B5370 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 010B4F80: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,8C278AEA,00000000,00000000,?), ref: 010B4FD5
Part of subcall function 010B4F80: GetTempPathW.KERNEL32(00000104,?), ref: 010B5069
Part of subcall function 010B4F80: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 010B509A

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,8C278AEA,00000000,?,?,00000000,011AD9C5,000000FF,Shlwapi.dll,010B5326,?,?,?), ref: 010B53BD
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,?), ref: 010B53E9
GetLastError.KERNEL32(?,?), ref: 010B542E
DeleteFileW.KERNEL32(?), ref: 010B5441

Strings

Shlwapi.dll, xrefs: 010B5370, 010B53A8

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$InfoPathTempVersion$DeleteErrorFolderLastNameSize
String ID: Shlwapi.dll
API String ID: 2355151265-1687636465
Opcode ID: 7143fee03707996ecf95dda97a5cfe204a7776281e92f014591d1c37df8af374
Instruction ID: 6ba6cd34f44b03632218dd996e9e008e2be4a5dbf47d662613742dc631561d99
Opcode Fuzzy Hash: 7143fee03707996ecf95dda97a5cfe204a7776281e92f014591d1c37df8af374
Instruction Fuzzy Hash: 93318471A01209AFDB15CFA9DD84BEEBBF8EF08615F1441A9E945A3240DB359901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010EE990 Relevance: 7.7, APIs: 5, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,8C278AEA,?,?,00000000,?,?,?,?,011B941D,000000FF,?,010D0E0E), ref: 010EE9D0
CreateThread.KERNEL32(00000000,00000000,010EECE0,?,00000000,?), ref: 010EEA06
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 010EEB0F
GetExitCodeThread.KERNEL32(00000000,?), ref: 010EEB1A
CloseHandle.KERNEL32(00000000), ref: 010EEB3A

Part of subcall function 00FA8590: RaiseException.KERNEL32(8C278AEA,8C278AEA,00000000,00000000,01143F71,C000008C,00000001,?,01143FA2,00000000,?,?,?,00F990D7,00000000,8C278AEA), ref: 00FA859C

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CreateThread$CloseCodeEventExceptionExitHandleObjectRaiseSingleWait
String ID:
API String ID: 3595790897-0
Opcode ID: 77c45cba1f34db03c440ee52b370fe396202745edbb7d3dcd9d14a9203ea4b4f
Instruction ID: 1e071821a33dc0371591012f0238bf4b9b4a9e9638572d5ff379fa05a264b795
Opcode Fuzzy Hash: 77c45cba1f34db03c440ee52b370fe396202745edbb7d3dcd9d14a9203ea4b4f
Instruction Fuzzy Hash: 7F516A74A00709DFCB24CF69C888BAABBF5FF49314F244669EA56A7751D730A840CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FA845B Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00FA8470
GetWindowLongW.USER32(?,000000FC), ref: 00FA8485
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 00FA849B
GetWindowLongW.USER32(?,000000FC), ref: 00FA84B5
SetWindowLongW.USER32(?,000000FC,?), ref: 00FA84C5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: 969b203d5368e288196773f72c64b59bf2b2e0ff58ac5543b80ae30066f02772
Instruction ID: 7b843e8af4ff3dacd185ce30c05e2eab3971b9be464a1b52147d73e5b0354929
Opcode Fuzzy Hash: 969b203d5368e288196773f72c64b59bf2b2e0ff58ac5543b80ae30066f02772
Instruction Fuzzy Hash: 4F210EB1504700AFC720DF29DC84917FBF5FF89760B508A1EF99A82660D772E8559B50

Uniqueness

Uniqueness Score: -1.00%

Function 010ABFF0 Relevance: 7.6, APIs: 5, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 010AC011
PeekMessageW.USER32(?,00000000), ref: 010AC057
TranslateMessage.USER32(00000000), ref: 010AC062
DispatchMessageW.USER32(00000000), ref: 010AC069
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 010AC07B

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Message$MultipleObjectsWait$DispatchPeekTranslate
String ID:
API String ID: 4084795276-0
Opcode ID: 63a252d38db03c97e0dd104f561c8e9aca0e5384f583554e3affa29d5c3c9a4a
Instruction ID: ab5194937c22fb20642a6bed20b4a6759770ca0006c85028793e853c8a93823f
Opcode Fuzzy Hash: 63a252d38db03c97e0dd104f561c8e9aca0e5384f583554e3affa29d5c3c9a4a
Instruction Fuzzy Hash: 4B1159716803057EF320CA55AD81FA7B7DCEB89760F900226FA50960C0D770E5448771

Uniqueness

Uniqueness Score: -1.00%

Function 010CCC60 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 326COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,8C278AEA,?,00000010,?), ref: 010CCF2A

Part of subcall function 010ACF90: GetCurrentProcess.KERNEL32 ref: 010ACFD8
Part of subcall function 010ACF90: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 010ACFE5
Part of subcall function 010ACF90: GetLastError.KERNEL32 ref: 010ACFEF
Part of subcall function 010ACF90: FindCloseChangeNotification.KERNEL32(00000000), ref: 010AD0D0

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

Strings

\\?\, xrefs: 010CCF37
[WindowsVolume], xrefs: 010CCCF0, 010CCD02, 010CCD0C
Extraction path set to:, xrefs: 010CCF7D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Process$FindInit_thread_footer$ChangeCloseCurrentErrorHeapLastNotificationOpenPathResourceToken
String ID: Extraction path set to:$[WindowsVolume]$\\?\
API String ID: 2914359614-3538578949
Opcode ID: d40a073d5b76f318144d28bf98715df51fe6c542b57a271e89c95d4fd1fab05d
Instruction ID: 30330dbd18a8380cd3a50d0d5d367ef8d0fa175f2d5d1589fd0a41162579221b
Opcode Fuzzy Hash: d40a073d5b76f318144d28bf98715df51fe6c542b57a271e89c95d4fd1fab05d
Instruction Fuzzy Hash: 18C1E3309006469FEB14DFACC984BAEFBF4AF45714F1482ACE555AB292DB74D901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010E9FE0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 257filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,8C278AEA,?,000000FF,?,?,00000000,011B863E,000000FF,?,010EA25A,000000FF,?,00000001), ref: 010EA01C
GetLastError.KERNEL32(?,?,00000000,011B863E,000000FF,?,010EA25A,000000FF,?,00000001), ref: 010EA026

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

ReadFile.KERNEL32(?,?,00007F90,?,00000000,8C278AEA,?,000000FF,?,?,00000000,011B863E,000000FF,?,010EA25A,000000FF), ref: 010EA073

Strings

\\.\pipe\ToServer, xrefs: 010EA2E4, 010EA2F5, 010EA2FF

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: e2078e9a4029f228b4c6efd7585815e4d5b350d2686cab0bf70372ef8397c5f1
Instruction ID: 01ed1288293e611ce1d404dd749f9870e948bfffbebb89568b283c8bce9bfdb2
Opcode Fuzzy Hash: e2078e9a4029f228b4c6efd7585815e4d5b350d2686cab0bf70372ef8397c5f1
Instruction Fuzzy Hash: 7191A071A04205DFEB14DF69CC09BAEBBE4EF48324F0086ADF9559B381DB759900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010B30C0 Relevance: 6.3, APIs: 4, Instructions: 292COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,?,00000100), ref: 010B31BC
LoadStringW.USER32(?,?,?,00000001), ref: 010B3264

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: bd091b410c2dd26e7d5cf491b488e52357054a8f36246467dfb8fbb920709919
Instruction ID: 979c4ed84d150f4709480bf881b31f5b1b8c58cab36c7ba7e8732baf8a419725
Opcode Fuzzy Hash: bd091b410c2dd26e7d5cf491b488e52357054a8f36246467dfb8fbb920709919
Instruction Fuzzy Hash: 55B15E71D01209EFDB04DFA8D885BEEBBB5FF48714F248219E915A7380DB756A44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010C49A0 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,8C278AEA,?,00000010,?,010C7D90,?), ref: 010C4A06
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 010C4A4F
ReadFile.KERNEL32(00000000,8C278AEA,?,?,00000000,00000078,?), ref: 010C4A91
FindCloseChangeNotification.KERNEL32(00000000), ref: 010C4B0A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationPointerRead
String ID:
API String ID: 2405668454-0
Opcode ID: c87ef981262ab68d9e839c04b58eb346f594e099a85c11dc6413823e5f204125
Instruction ID: e3e3ee3551052aa3bfe601c3b7b12397a0bb362ed1cde257400f7c9388be9d71
Opcode Fuzzy Hash: c87ef981262ab68d9e839c04b58eb346f594e099a85c11dc6413823e5f204125
Instruction Fuzzy Hash: E4518C70900609AFEB15CBACC898BEEFBB8FF45724F148259E451AB2D0D7749904CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0570 Relevance: 4.8, APIs: 3, Instructions: 345fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,?,00000000,?,8C278AEA,?), ref: 00FA05E2
MoveFileW.KERNEL32(?,00000000), ref: 00FA0835
DeleteFileW.KERNEL32(?), ref: 00FA087F

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$DeleteMoveNameTemp
String ID:
API String ID: 788073729-0
Opcode ID: ef9244b3206819b84fe5e03026f3b5909981863ef0f3ef725d9513f0dfb132cf
Instruction ID: 9654ddd95a5657416f11b9284160712aff68b0cab3c5e8cd1a946e9c3a9c7594
Opcode Fuzzy Hash: ef9244b3206819b84fe5e03026f3b5909981863ef0f3ef725d9513f0dfb132cf
Instruction Fuzzy Hash: 07F198B0D11269CBDB28DF28CC9879DBBB0BF55304F1042D9D409A7291EB786B84DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA01A0 Relevance: 4.8, APIs: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,?,00000000,?,8C278AEA,?,00000004), ref: 00FA01FB
DeleteFileW.KERNEL32(?,?,00000004), ref: 00FA023E
CreateDirectoryW.KERNEL32(?,00000000,?,00000004), ref: 00FA024D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$CreateDeleteDirectoryNameTemp
String ID:
API String ID: 2411147693-0
Opcode ID: 21ffaa9dfb7b2a243df57d811eb75eb56e960c21cc3f7a99c092d117fc7ef1b5
Instruction ID: 49bacdb18de6ed86c83df7ce08cf394ad6b898e6dee2021b6e34001579e1558c
Opcode Fuzzy Hash: 21ffaa9dfb7b2a243df57d811eb75eb56e960c21cc3f7a99c092d117fc7ef1b5
Instruction Fuzzy Hash: 7CB18AB0D10248DFDB14DF68D9987EEBBB4FF59314F24429DD405A7281DB786A84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0115EA0C Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 0115EBBB

Part of subcall function 0115CA67: RtlAllocateHeap.NTDLL(00000000,011645BE,?,?,011645BE,00000220,?,?,?), ref: 0115CA99

__freea.LIBCMT ref: 0115EBD0
__freea.LIBCMT ref: 0115EBE0

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: dccff32a190e67b056e409595940f322d1ad908e3697306c00325af3b06c27d3
Instruction ID: 2fc73b0b5e761fc689886b449665d94c5043280f3202fb4c8dac0b9a3fe977a8
Opcode Fuzzy Hash: dccff32a190e67b056e409595940f322d1ad908e3697306c00325af3b06c27d3
Instruction Fuzzy Hash: C451D472A02216EFEF6D9F68CC80EBBBAA9EF44615F150128FD29D6140E731CE108761

Uniqueness

Uniqueness Score: -1.00%

Function 010CFC90 Relevance: 4.7, APIs: 3, Instructions: 191fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,8C278AEA,?,?), ref: 010CFCF7
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 010CFE04

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 863ba76dffa69a1640e8a1125c5017b7a7778f95030bb90ce260d384834a4207
Instruction ID: 00038f16364f2daf536d6113ba591157b87736f7cec2ad2a2c1f275deefb551c
Opcode Fuzzy Hash: 863ba76dffa69a1640e8a1125c5017b7a7778f95030bb90ce260d384834a4207
Instruction Fuzzy Hash: D6617171D00609AFDB04DFA8C844BDDFBF4FB09720F10826AE924A7390EB75A914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010CD040 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,8C278AEA,?,00000000,?,80004005,?,00000000), ref: 010CD0DE
GetLastError.KERNEL32 ref: 010CD116
GetLastError.KERNEL32(?), ref: 010CD1AF

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: fe08166db85aef9c80da2078403f82a606092f0476f52f92d3e17d88fca984f1
Instruction ID: ef101525b6cd59f47ff78f9b0ac03e0900db54d5c88054f54f08992d04e77762
Opcode Fuzzy Hash: fe08166db85aef9c80da2078403f82a606092f0476f52f92d3e17d88fca984f1
Instruction Fuzzy Hash: A351C371A006069FDB24DFA9C844B9EFBF5FF94720F10866DE95597390EB31A905CB80

Uniqueness

Uniqueness Score: -1.00%

Function 010FC670 Relevance: 4.7, APIs: 3, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(010FD5B6,40000000,00000001,00000000,00000002,00000080,00000000,8C278AEA,?,00000001), ref: 010FC6D2
WriteFile.KERNEL32(00000000,0000C800,0000C800,0000C800,00000000,?,0000C800), ref: 010FC768
CloseHandle.KERNEL32(00000000,?,0000C800), ref: 010FC7DC

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d6b8c1cf700c8bdca4c34f4f84dca50b87264acc9d70593b47eb2a8bfabf4055
Instruction ID: c9a380d016773fda730fe13086110e38316d934d9b01761b0b5698496c5b27c6
Opcode Fuzzy Hash: d6b8c1cf700c8bdca4c34f4f84dca50b87264acc9d70593b47eb2a8bfabf4055
Instruction Fuzzy Hash: A5518D71A00219AFEB14DFA8DD46FDEBBB9FF48714F104259E910B7680DB759900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 010CC140 Relevance: 4.5, APIs: 3, Instructions: 30threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 010CC149
DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,011B12D0,000000FF), ref: 010CC158
IsWindow.USER32(?), ref: 010CC185

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$CurrentDestroyThread
String ID:
API String ID: 2303547079-0
Opcode ID: b70a344c0b92d678d3f06ffd8772fe787920f29626f89f14a067781341bbf6b4
Instruction ID: 5adfd318d447b801d5008eb07743028d8bf39c6eed728d5b905b5ed0ea6cf3c8
Opcode Fuzzy Hash: b70a344c0b92d678d3f06ffd8772fe787920f29626f89f14a067781341bbf6b4
Instruction Fuzzy Hash: 64F05E71005B409EE3719B2DFB48B4ABFE5AB89F14F410A8DE58696A84C3B0F4418B24

Uniqueness

Uniqueness Score: -1.00%

Function 0114FD83 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0114FD7D,?,?,?,?,8C278AEA), ref: 0114FD94
TerminateProcess.KERNEL32(00000000,?,0114FD7D,?,?,?,?,8C278AEA), ref: 0114FD9B
ExitProcess.KERNEL32 ref: 0114FDAD

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 87c9671855160523013db4d782b0fca20005cc3a598094847767416a09e971a9
Instruction ID: c6b51de49adc27f3ddc397530bc6c8eadbc194bfbd056dc3251f61601397984e
Opcode Fuzzy Hash: 87c9671855160523013db4d782b0fca20005cc3a598094847767416a09e971a9
Instruction Fuzzy Hash: 9BD09E31000109AFDF692FA5EC0C8DD3F2AEF44749B144064B96A56125CB7199E7DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010ABB70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,8C278AEA), ref: 010ABD10

Part of subcall function 010ABDD0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 010ABDDD

Strings

USERPROFILE, xrefs: 010ABBBE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: 5b5b70a7ba7fc264bc66d73d145227a795405a37eadbf9f80ce1b9b770f903be
Instruction ID: 76f843ae943a488c53540486c33a0ed80a7fd67ee90248559bcf83a7cf452fe3
Opcode Fuzzy Hash: 5b5b70a7ba7fc264bc66d73d145227a795405a37eadbf9f80ce1b9b770f903be
Instruction Fuzzy Hash: 8561CE71A006099FDB14DFACCC59BAEBBF4EF44310F50866DE856DB291EB749900CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010EA1A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,8C278AEA,?,00000010,?,?,011B868E,000000FF), ref: 010EA228

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Part of subcall function 010E9FE0: ConnectNamedPipe.KERNEL32(?,00000000,8C278AEA,?,000000FF,?,?,00000000,011B863E,000000FF,?,010EA25A,000000FF,?,00000001), ref: 010EA01C
Part of subcall function 010E9FE0: GetLastError.KERNEL32(?,?,00000000,011B863E,000000FF,?,010EA25A,000000FF,?,00000001), ref: 010EA026

Strings

\\.\pipe\ToServer, xrefs: 010EA2E4, 010EA2F5, 010EA2FF

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessWrite
String ID: \\.\pipe\ToServer
API String ID: 3549655173-63420281
Opcode ID: 7e061e1158fbfb170efc35fb3c07de412699e9c07a86dd7426f45af7a402d9b1
Instruction ID: c7dfeeb70af211b2a2f4e01fef4657d97cdf2f8d98242e0311ddfc2a5632f839
Opcode Fuzzy Hash: 7e061e1158fbfb170efc35fb3c07de412699e9c07a86dd7426f45af7a402d9b1
Instruction Fuzzy Hash: 19417F71A04215EFDB14CF59D845BAEBBE8EF48714F00865EF915DB380DBB699008B90

Uniqueness

Uniqueness Score: -1.00%

Function 011647BA Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 011642EA: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 01164315

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,01164601,?,00000000,?,?,?), ref: 0116481B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,01164601,?,00000000,?,?,?), ref: 0116485D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 66cafddaef54c480f516509bf5c8a8ff9a944e6df3071f3fd7d0f4677ad69728
Instruction ID: ebc7437f7d5277d77693a2aa866d9179568d578c1a7397fe38cc8d06586d2a67
Opcode Fuzzy Hash: 66cafddaef54c480f516509bf5c8a8ff9a944e6df3071f3fd7d0f4677ad69728
Instruction Fuzzy Hash: AC516870A003858FEB2DCFB9C4946AABBFDEF45304F18406EC1968BA41E7769556CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010EF3D0 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 010EF421
EndDialog.USER32(00000000,00000001), ref: 010EF430

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: 935f5317f8401f0696bd9a35c5f501879f82c3e11adf41bd701c4fb273ec7839
Instruction ID: 38f66f3ebf0333065ef8ae426af66c5c562a8301822bddfe21cd3a679e96020a
Opcode Fuzzy Hash: 935f5317f8401f0696bd9a35c5f501879f82c3e11adf41bd701c4fb273ec7839
Instruction Fuzzy Hash: D3519970A01746DFE711CF6DCA48B4ABBF4EF49310F14829DD4599B2A1DB70AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010CBF40 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(010CB881), ref: 010CBF40
DestroyWindow.USER32(?,?,?), ref: 010CBFF7

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID:
API String ID: 1182162058-0
Opcode ID: f890be275f4a6f4fd9c6bb01b0892dd890bcda7264a8da0732ff26c59a62ea89
Instruction ID: 8b284f8998d74c18316edc2e1f1ca9a602cded2c35b0d46efaaf80f908e75354
Opcode Fuzzy Hash: f890be275f4a6f4fd9c6bb01b0892dd890bcda7264a8da0732ff26c59a62ea89
Instruction Fuzzy Hash: E221C3B160010A5BEB219F1CE845BAEB794EB55321F00426AFC48C7781D776E861DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 010AF130 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 010AE740: LoadLibraryW.KERNEL32(ComCtl32.dll,8C278AEA,?,?,00000000), ref: 010AE77E
Part of subcall function 010AE740: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 010AE7A1
Part of subcall function 010AE740: FreeLibrary.KERNEL32(00000000), ref: 010AE81F

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 010AF174
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 010AF17F

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: 4eeeb276a33a9a0a1fa0580718610f537f8af16c0af2340aae38421caf81256a
Instruction ID: 9578508aa310783043b72bdb212885df0a0a2969bccf1ba1a5d51e198da2a731
Opcode Fuzzy Hash: 4eeeb276a33a9a0a1fa0580718610f537f8af16c0af2340aae38421caf81256a
Instruction Fuzzy Hash: 94F0653178131837F660215A5C56F7BBA4DE781B64F544276FA98AF2C1ECD67C0003E9

Uniqueness

Uniqueness Score: -1.00%

Function 0115E778 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,0115EAFA,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0115E7AC
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,0115EAFA,?,?,00000000,?,00000000), ref: 0115E7CA

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: e2ad93367c7358c3b4332462be35f369ad2ae889425aa85fa250d83255a07995
Instruction ID: b4e59cc64f9e79d789d4d99ad7402a4a8175178c0f64cc52b045ec3d9ed925c7
Opcode Fuzzy Hash: e2ad93367c7358c3b4332462be35f369ad2ae889425aa85fa250d83255a07995
Instruction Fuzzy Hash: 92F07A3240151AFBCF165F90DC04DDE7F26EF48364F058420FE2865020C732D971AB94

Uniqueness

Uniqueness Score: -1.00%

Function 0115CA2D Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0116593D,?,00000000,?,?,01165BDE,?,00000007,?,?,01166030,?,?), ref: 0115CA43
GetLastError.KERNEL32(?,?,0116593D,?,00000000,?,?,01165BDE,?,00000007,?,?,01166030,?,?), ref: 0115CA4E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 214b12d69ba86a6b6b7ce7efca3e571febe9407a4c10a337d6a65b004eb4562d
Instruction ID: fa7c3f0469ae65c070b40bed052c58d959065c2b0c88e7e5b21a8984151126df
Opcode Fuzzy Hash: 214b12d69ba86a6b6b7ce7efca3e571febe9407a4c10a337d6a65b004eb4562d
Instruction Fuzzy Hash: DAE08631500318EBDB296FA5A80CB453F5C9B44B59F004060F61896050E73085908794

Uniqueness

Uniqueness Score: -1.00%

Function 011463CC Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 011463EA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 011463F5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: e1e420f516787d288171dad1f5ca08baf215e494b2b95a94770c47bb8b15d2a1
Instruction ID: 2a0e4df480126a6ce6a3df2d4b77e806212ecde1fa6449edb28b12219cae84b9
Opcode Fuzzy Hash: e1e420f516787d288171dad1f5ca08baf215e494b2b95a94770c47bb8b15d2a1
Instruction Fuzzy Hash: D2D0A77054C38617595C23B5689159E2244AB63DBC7A0069EE815850C1DF608000D122

Uniqueness

Uniqueness Score: -1.00%

Function 01094B40 Relevance: 2.6, APIs: 2, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,01259384,010DDA40,?), ref: 01094B58
MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 01094B8A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 37abf5118d60ccfb44fbe58276d51cad3b663891a7d6596694841b2af0ae0d6d
Instruction ID: 31f9679e81a97d9a200e391b4419dfd96bfe394d806349aeaf9b036094455a39
Opcode Fuzzy Hash: 37abf5118d60ccfb44fbe58276d51cad3b663891a7d6596694841b2af0ae0d6d
Instruction Fuzzy Hash: 48012631300111AFEA149B4DDC98F5EB799EFD4331F20426DF354EB2C0CA605801D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 010D1C20 Relevance: 1.7, APIs: 1, Instructions: 214fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,010C676B,?), ref: 010D1C4B

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d10f200b3bbef7710ca5b524cfa8d698ecc2be7042618eee1843732a20b0d874
Instruction ID: 1beb0b3edb1295be5ca2051fe9505c8cbc73485f2dd5077be56fc01d6d5d4041
Opcode Fuzzy Hash: d10f200b3bbef7710ca5b524cfa8d698ecc2be7042618eee1843732a20b0d874
Instruction Fuzzy Hash: F751E372A006559FDB14DF5CD884BAAFBE4FF05720F148669EA659B780DB71A800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011643BE Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,0116460D,01164601,00000000), ref: 011643F0

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 98ac94b3ac46f74e2ea4bfd22422a55aead53ed5b81beca910a4ce4ef400a7e3
Instruction ID: 93968b58f1e159c76c79a2acab81cd588b0933883e06c9280bf8bae0a8d95152
Opcode Fuzzy Hash: 98ac94b3ac46f74e2ea4bfd22422a55aead53ed5b81beca910a4ce4ef400a7e3
Instruction Fuzzy Hash: A5515B71A081589ADB298E28CD84BE67BBCEB56304F1405EDD59AC7942C3329D55CF21

Uniqueness

Uniqueness Score: -1.00%

Function 010AA540 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,8C278AEA,?,8C278AEA,011ABFAE,000000FF), ref: 010AA58F

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapPathProcessTemp
String ID:
API String ID: 764064751-0
Opcode ID: 4ba78c4160b5ed804eb0f6973c4a1a8f29833d9235a63e143ae18fc5fd155220
Instruction ID: a320fa3635a4af81ad6d7b0b23a4a27f27b147b58a641543009f74cd3eabbe59
Opcode Fuzzy Hash: 4ba78c4160b5ed804eb0f6973c4a1a8f29833d9235a63e143ae18fc5fd155220
Instruction Fuzzy Hash: E631A070600249DFDF18DFA8C809BAE7BE4EF48704F50456DE856C7281EB749504CB54

Uniqueness

Uniqueness Score: -1.00%

Function 010D2F70 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,010D30A0,?), ref: 010D2FBB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: 06ae9c0907f93a24dcf2588e8f712a261a46db2df0ddded6659d4d78fd0fb774
Instruction ID: 5276478f19b91db287c284596b05004e40e0d2e25fd3ec1585d8f016886e55a5
Opcode Fuzzy Hash: 06ae9c0907f93a24dcf2588e8f712a261a46db2df0ddded6659d4d78fd0fb774
Instruction Fuzzy Hash: 9241A3B190034A9BDB10DFA8C894BDEBBF4FF44714F104659E560AB281DBB69944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010B0100 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 010B0370: __Init_thread_footer.LIBCMT ref: 010B03E6

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

__Init_thread_footer.LIBCMT ref: 010B01E0

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: f5d0414c9c0941f53fbd108189103fa7d4e57158eb4b5210edbcc5cd46d48aea
Instruction ID: 6326e5d58aef910fbf4e6cec6707450b80b9b563416d2f7588fcc658f319c6dc
Opcode Fuzzy Hash: f5d0414c9c0941f53fbd108189103fa7d4e57158eb4b5210edbcc5cd46d48aea
Instruction Fuzzy Hash: AB31EE71640741DBEF25CF04F8C9B9AB3F0F704B28F108658E85147A88E3B56980CB95

Uniqueness

Uniqueness Score: -1.00%

Function 010EECE0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327e59d9aedb2f2faf0185868ed2820800d6d393f2d98c5f3ad2121c787889a3
Instruction ID: e40ee80ebf220f0592bb470b45fa2084899105eb0f8daada8d54db1dbb4b59ee
Opcode Fuzzy Hash: 327e59d9aedb2f2faf0185868ed2820800d6d393f2d98c5f3ad2121c787889a3
Instruction Fuzzy Hash: 7A110231304A2F9F8721AF8EC4C8D06FBE9FF147003024265EA909B221D722FC118BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01090A10 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

__Init_thread_footer.LIBCMT ref: 01090A82

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID:
API String ID: 2296764815-0
Opcode ID: fe11ded91953e60b4860cf3aa7f2fa900478d7d8f2e9a6c77437416daab24993
Instruction ID: 0ae31db2c1b70f1bac2e7eb0491b9284a67f9693a31396a883e3365b630a86a9
Opcode Fuzzy Hash: fe11ded91953e60b4860cf3aa7f2fa900478d7d8f2e9a6c77437416daab24993
Instruction Fuzzy Hash: 6C018FB1A44684DFCB68DF58E985B48BBA4E768B38F10436DE82683780D739AD409A51

Uniqueness

Uniqueness Score: -1.00%

Function 010B0370 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

Part of subcall function 010B0410: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 010B047E
Part of subcall function 010B0410: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 010B04C5
Part of subcall function 010B0410: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 010B04E4
Part of subcall function 010B0410: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 010B0513
Part of subcall function 010B0410: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 010B0588

__Init_thread_footer.LIBCMT ref: 010B03E6

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 641229a83ac478a22503578ff6ce744589f65db46298cbe93d2cd5ce6236a9e9
Instruction ID: d6dac917a8ba1844fba8c581a00f65aca8e354e82174be067f5e8375bda65711
Opcode Fuzzy Hash: 641229a83ac478a22503578ff6ce744589f65db46298cbe93d2cd5ce6236a9e9
Instruction Fuzzy Hash: F901F2B1A04784DFCB60DF5CD9C9B8AB3B8EB04B28F104768F921977C4C734A9408B51

Uniqueness

Uniqueness Score: -1.00%

Function 00F99980 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0114641A: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,00000007,?,01142091,?,0124B8A4,010A9CF1,?,010A9CF1,?), ref: 0114647A

RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: 2fcbfb700dfdc3cf2bc4223af8d602d26d1752de4e697945dc44e1471426c7e5
Instruction ID: 306afd7ea709725ca480be73a22d5c6a5d81e0508ab8d988cd92189731978e67
Opcode Fuzzy Hash: 2fcbfb700dfdc3cf2bc4223af8d602d26d1752de4e697945dc44e1471426c7e5
Instruction Fuzzy Hash: A5F0A771644648FFCB19DF54DD05F55BBA8F708B14F00466DF91586790DB36A820CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0115CA67 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,011645BE,?,?,011645BE,00000220,?,?,?), ref: 0115CA99

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 561989c2b5b8dd436521b8ab5ee7fd6b6d5668d531986101c1a8b0059df9696b
Instruction ID: 7e0a3dd964a99cea1757f5fa366202e79a9fe535bb08f2c5d79f9eadc59a58de
Opcode Fuzzy Hash: 561989c2b5b8dd436521b8ab5ee7fd6b6d5668d531986101c1a8b0059df9696b
Instruction Fuzzy Hash: 17E06535640726DAF7BDAE6DDC04B9A3E8CAB456E4F050161AD3596080FBA0C84082E6

Uniqueness

Uniqueness Score: -1.00%

Function 0115A77B Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0115A782

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: a551ca2cfbf7e2bbb226d3f16131b4ee07ce49cfa8f73efaeb731dfb546f4d2f
Instruction ID: 984dd98bc90a0658be0b70247dca1714a497b93d34488680071ccfc956de0ee2
Opcode Fuzzy Hash: a551ca2cfbf7e2bbb226d3f16131b4ee07ce49cfa8f73efaeb731dfb546f4d2f
Instruction Fuzzy Hash: 7FE0E572D4020E9BDB44DFD4C441AEFBBB8AB14A04F504116D204E6140EB7457458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0115DFCF Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f227ce526328f95c14246b39978c2eea986b6783604397c9c02da24bd0724d20
Instruction ID: 17591a8161aa2050b4154fdbdc88f8699f385498400b0fc8a0b15a1f9793bebf
Opcode Fuzzy Hash: f227ce526328f95c14246b39978c2eea986b6783604397c9c02da24bd0724d20
Instruction Fuzzy Hash: 8EE0CD31E41329E7DFBD3E569804B1B7E5CAF10F90B0540516D2467140CB60D901C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0114109A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01141091

Part of subcall function 01141B8B: DloadAcquireSectionWriteAccess.DELAYIMP ref: 01141B96
Part of subcall function 01141B8B: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01141BFE
Part of subcall function 01141B8B: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01141C0F

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: bf70860b59129ca100b0cc3f56aeddb396a02bed0bcdce9fde04e67cdf6d37ed
Instruction ID: ae82cdb76306a9e28a292f3a208d72aa8b58a9bec611a5b7b53cae197e441ad9
Opcode Fuzzy Hash: bf70860b59129ca100b0cc3f56aeddb396a02bed0bcdce9fde04e67cdf6d37ed
Instruction Fuzzy Hash: 13B012E53FD0017F324CA11D1F41E36252CC2E0D21320414FFC00D1080E5503C820036

Uniqueness

Uniqueness Score: -1.00%

Function 011410EA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01141091

Part of subcall function 01141B8B: DloadAcquireSectionWriteAccess.DELAYIMP ref: 01141B96
Part of subcall function 01141B8B: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01141BFE
Part of subcall function 01141B8B: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01141C0F

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 4138e5118bdb0910e148b9aaf498f5d4dac65ba61b4ceb3c51e90ab9006c1d2e
Instruction ID: 4166fe802e4806c7aeee6ab4916f46e3283def5ad9e96994c1b287658a3540fd
Opcode Fuzzy Hash: 4138e5118bdb0910e148b9aaf498f5d4dac65ba61b4ceb3c51e90ab9006c1d2e
Instruction Fuzzy Hash: 5BB012D53FD001BF324C621D1E41E36112CCAD0D21320414FFC00D1001E5503CC20036

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F93010 Relevance: 170.0, Strings: 134, Instructions: 2486COMMON

Download Yara Rule

Strings

AI_GxInstall, xrefs: 00F95D05
RemoveFile, xrefs: 00F94A45
15000, xrefs: 00F93FBA, 00F94040, 00F94BBB, 00F94D4D, 00F94F53, 00F95680, 00F9588F
DuplicateFile, xrefs: 00F94939, 00F94D60
AI_ScheduledTasks, xrefs: 00F96113
~, xrefs: 00F95B69
Complus, xrefs: 00F940D9, 00F95587
100000, xrefs: 00F95989
AI_ProcessTasks, xrefs: 00F960ED
PublishComponents, xrefs: 00F95779
PatchSize, xrefs: 00F94D14
RemoveExistingProducts, xrefs: 00F93034
120000, xrefs: 00F9481A
AI_XmlUninstall, xrefs: 00F9616A, 00F961F0
DuplicateFiles, xrefs: 00F94D3A
CreateFolders, xrefs: 00F94B22
RemoveFiles, xrefs: 00F94999, 00F94A1F
Options, xrefs: 00F95B5F, 00F95BE0
AI_GxUninstall, xrefs: 00F95EF9
WriteIniValues, xrefs: 00F95143
InstallODBC, xrefs: 00F952CC, 00F95352, 00F953D8
InstallInitialize, xrefs: 00F958F9
ProgId, xrefs: 00F94615, 00F94FE3
CreateShortcuts, xrefs: 00F94E3D
ODBCDataSource, xrefs: 00F941E5, 00F952F2
RegisterExtensionInfo, xrefs: 00F94F40
MsiConfigureServices, xrefs: 00F9566D, 00F95693
AI_ExtractPrereq, xrefs: 00F95A79
UnregisterProgIdInfo, xrefs: 00F945EF
InstallFiles, xrefs: 00F94C2E
CostInitialize, xrefs: 00F933FD
ServiceInstall, xrefs: 00F9560D
AI_XmlInstall, xrefs: 00F95C0B, 00F95C88
AI_InstallPrerequisite, xrefs: 00F95AFF
RemoveShortcuts, xrefs: 00F94807
FileSize, xrefs: 00F94C8E
UnregisterMIMEInfo, xrefs: 00F94675
StopServices, xrefs: 00F93FA7, 00F9402D
100, xrefs: 00F94CC7, 00F94FD0, 00F95F0C
Component_, xrefs: 00F93ED4, 00F93FE0, 00F94075, 00F940EC, 00F941F8, 00F9427E, 00F94318, 00F94410, 00F94496, 00F94734, 00F947BA, 00F94840, 00F948C6, 00F9494C, 00F949D2, 00F94AD5, 00F94B5B, 00F94BE1, 00F94C67, 00F94D73, 00F94E76, 00F950F6, 00F9517C, 00F95202, 00F95305, 00F9538B, 00F95416, 00F95497, 00F9559A, 00F95620, 00F956B5, 00F9572C, 00F957B2
AI_PreRequisite, xrefs: 00F95A19, 00F95A9F, 00F95B25, 00F95BAB
AI_ProcessAccounts, xrefs: 00F96070
8000, xrefs: 00F9414C, 00F94364, 00F95262, 00F954F7
IniFile, xrefs: 00F947A7, 00F95169
StartServices, xrefs: 00F956F3
RemoveIniFile, xrefs: 00F94721
Font, xrefs: 00F94377, 00F95275
20000, xrefs: 00F95706
MoveFiles, xrefs: 00F94BA8
RemoveRegistry, xrefs: 00F94483
SelfRegModules, xrefs: 00F954E4
ServiceControl, xrefs: 00F93FCD, 00F94053, 00F95719
MIME, xrefs: 00F9469B, 00F95060
6000, xrefs: 00F950D0
CreateFolder, xrefs: 00F94AC2, 00F94B48
AppSearch, xrefs: 00F9321B, 00F932A4
AI_UninstallGroups, xrefs: 00F95DFF
RegisterMIMEInfo, xrefs: 00F9503A
AI_ChainProductsPseudo, xrefs: 00F96276
ODBCTranslator, xrefs: 00F9426B, 00F95378
Registry, xrefs: 00F943FD, 00F950E3
RegisterTypeLibraries, xrefs: 00F9545E
AI_DefaultActionCost, xrefs: 00F96370
UnregisterExtensionInfo, xrefs: 00F94569
30000, xrefs: 00F93DA1, 00F95156, 00F95812
RemoveEnvironmentStrings, xrefs: 00F9488D
5000, xrefs: 00F94DD3
PublishFeatures, xrefs: 00F9587C
2000, xrefs: 00F93255, 00F95D18, 00F95D95, 00F95E12, 00F95E8F, 00F96006, 00F96083, 00F96100
RegisterComPlus, xrefs: 00F9555C
RemoveIniValues, xrefs: 00F946FB, 00F94781
WriteEnvironmentStrings, xrefs: 00F951C9
MsiUnpublishAssemblies, xrefs: 00F93D52
PublishComponent, xrefs: 00F93EC1, 00F9579F
InstallValidate, xrefs: 00F9398E
UnregisterFonts, xrefs: 00F94351
Environment, xrefs: 00F948B3, 00F951EF
500, xrefs: 00F95F89
10000, xrefs: 00F9578C, 00F96383
File, xrefs: 00F93668, 00F949BF, 00F94C4F
AI_CountRowAction, xrefs: 00F962F3
AI_Game, xrefs: 00F95D2B, 00F95F1F
AI_InstallPostPrerequisite, xrefs: 00F95B85
FileCost, xrefs: 00F935E4
UnpublishFeatures, xrefs: 00F93F1C
Extension, xrefs: 00F9458F, 00F94F66
RegisterProgIdInfo, xrefs: 00F94FBD
RegisterClassInfo, xrefs: 00F94EC3
PatchFiles, xrefs: 00F94CB4
1500000, xrefs: 00F955FA
WriteRegistryValues, xrefs: 00F950BD
RemoveDuplicateFiles, xrefs: 00F94913
ODBCDriver, xrefs: 00F942F1, 00F953FE
AI_UserAccounts, xrefs: 00F95DA8, 00F96096
UnregisterComPlus, xrefs: 00F940B3
BindImage, xrefs: 00F94DC0, 00F94DE6
12000, xrefs: 00F941D2, 00F94258, 00F942DE, 00F94926, 00F949AC, 00F94A32, 00F94AAF, 00F94B35, 00F94E50, 00F952DF, 00F95365, 00F953EB
1800, xrefs: 00F95C1E, 00F9617D
RemoveRegistryValues, xrefs: 00F943D7, 00F9445D
AI_DownloadPrereq, xrefs: 00F959F3
MsiPublishAssemblies, xrefs: 00F957FF
AI_UserGroups, xrefs: 00F95E25, 00F96019
AI_UninstallTasks, xrefs: 00F95E7C
RemoveFolders, xrefs: 00F94A9C
MsiAssembly, xrefs: 00F95825
AI_ProcessGroups, xrefs: 00F95FF3
Patch, xrefs: 00F94CDA
RegisterFonts, xrefs: 00F9524F
Feature_, xrefs: 00F93DF0, 00F945A2, 00F94F77, 00F95836, 00F95A2C, 00F95AB2, 00F95B38, 00F95BBE
AI_XmlElement, xrefs: 00F95C31, 00F96190
Component, xrefs: 00F93486, 00F9384A, 00F93A2C, 00F93C0E
MoveFile, xrefs: 00F94BCE
AI_UninstallAccounts, xrefs: 00F95D82
CostFinalize, xrefs: 00F937AC
3000, xrefs: 00F93BBF, 00F93EAE, 00F93F34, 00F940C6, 00F943EA, 00F94470, 00F944F6, 00F9457C, 00F94602, 00F94688, 00F948A0, 00F94ED6, 00F9504D, 00F95471, 00F95574
800, xrefs: 00F939DD
1500, xrefs: 00F94709, 00F94794, 00F95C9B, 00F96203
3000000, xrefs: 00F951DC
200000, xrefs: 00F9590C
ProcessComponents, xrefs: 00F93B70
Shortcut, xrefs: 00F9482D, 00F94E63
AI_XmlAttribute, xrefs: 00F95CAE, 00F96211
Feature, xrefs: 00F93F47, 00F958A2
TypeLib, xrefs: 00F95484
InstallServices, xrefs: 00F955E7
SelfReg, xrefs: 00F9415F, 00F9550A
AppId, xrefs: 00F94509, 00F94EE9
UnpublishComponents, xrefs: 00F93E9B
InstallFinalize, xrefs: 00F95976
AI_AppSearchEx, xrefs: 00F95F76, 00F95F9C
UnregisterClassInfo, xrefs: 00F944E3
SelfUnregModules, xrefs: 00F94139
RemoveODBC, xrefs: 00F941BF, 00F94245, 00F942CB
Location, xrefs: 00F95A53, 00F95AD9

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: 100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$800$8000$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$~
API String ID: 0-2910470256
Opcode ID: 4b3ab471047195ff2a38956add3f7202d9f1ea24042e406902e1d4cdd9fe3197
Instruction ID: aae06dedf0620df14eaf8813eabc570b84553a21965e132a3278280e77e0d7a5
Opcode Fuzzy Hash: 4b3ab471047195ff2a38956add3f7202d9f1ea24042e406902e1d4cdd9fe3197
Instruction Fuzzy Hash: 71330B20A693C4F9EB1AFBB4BD9976E7950AF51704F10524CF1412B7C2CBB81A44EBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F945FE Relevance: 141.5, Strings: 112, Instructions: 1547COMMON

Download Yara Rule

Strings

AI_GxInstall, xrefs: 00F95D05
RemoveFile, xrefs: 00F94A45
15000, xrefs: 00F94BBB, 00F94D4D, 00F94F53, 00F95680, 00F9588F
DuplicateFile, xrefs: 00F94939, 00F94D60
~, xrefs: 00F95B69
AI_ScheduledTasks, xrefs: 00F96113
Complus, xrefs: 00F95587
100000, xrefs: 00F95989
AI_ProcessTasks, xrefs: 00F960ED
PublishComponents, xrefs: 00F95779
PatchSize, xrefs: 00F94D14
120000, xrefs: 00F9481A
AI_XmlUninstall, xrefs: 00F9616A, 00F961F0
DuplicateFiles, xrefs: 00F94D3A
CreateFolders, xrefs: 00F94B22
RemoveFiles, xrefs: 00F94999, 00F94A1F
Options, xrefs: 00F95B5F, 00F95BE0
AI_GxUninstall, xrefs: 00F95EF9
WriteIniValues, xrefs: 00F95143
InstallODBC, xrefs: 00F952CC, 00F95352, 00F953D8
InstallInitialize, xrefs: 00F958F9
ProgId, xrefs: 00F94615, 00F94FE3
CreateShortcuts, xrefs: 00F94E3D
ODBCDataSource, xrefs: 00F952F2
RegisterExtensionInfo, xrefs: 00F94F40
MsiConfigureServices, xrefs: 00F9566D, 00F95693
AI_ExtractPrereq, xrefs: 00F95A79
InstallFiles, xrefs: 00F94C2E
ServiceInstall, xrefs: 00F9560D
AI_XmlInstall, xrefs: 00F95C0B, 00F95C88
AI_InstallPrerequisite, xrefs: 00F95AFF
RemoveShortcuts, xrefs: 00F94807
FileSize, xrefs: 00F94C8E
UnregisterMIMEInfo, xrefs: 00F94675
100, xrefs: 00F94CC7, 00F94FD0, 00F95F0C
Component_, xrefs: 00F94734, 00F947BA, 00F94840, 00F948C6, 00F9494C, 00F949D2, 00F94AD5, 00F94B5B, 00F94BE1, 00F94C67, 00F94D73, 00F94E76, 00F950F6, 00F9517C, 00F95202, 00F95305, 00F9538B, 00F95416, 00F95497, 00F9559A, 00F95620, 00F956B5, 00F9572C, 00F957B2
AI_PreRequisite, xrefs: 00F95A19, 00F95A9F, 00F95B25, 00F95BAB
AI_ProcessAccounts, xrefs: 00F96070
8000, xrefs: 00F95262, 00F954F7
IniFile, xrefs: 00F947A7, 00F95169
StartServices, xrefs: 00F956F3
RemoveIniFile, xrefs: 00F94721
Font, xrefs: 00F95275
20000, xrefs: 00F95706
MoveFiles, xrefs: 00F94BA8
SelfRegModules, xrefs: 00F954E4
ServiceControl, xrefs: 00F95719
MIME, xrefs: 00F9469B, 00F95060
6000, xrefs: 00F950D0
CreateFolder, xrefs: 00F94AC2, 00F94B48
AI_UninstallGroups, xrefs: 00F95DFF
RegisterMIMEInfo, xrefs: 00F9503A
AI_ChainProductsPseudo, xrefs: 00F96276
ODBCTranslator, xrefs: 00F95378
Registry, xrefs: 00F950E3
RegisterTypeLibraries, xrefs: 00F9545E
AI_DefaultActionCost, xrefs: 00F96370
30000, xrefs: 00F95156, 00F95812
RemoveEnvironmentStrings, xrefs: 00F9488D
5000, xrefs: 00F94DD3
PublishFeatures, xrefs: 00F9587C
2000, xrefs: 00F95D18, 00F95D95, 00F95E12, 00F95E8F, 00F96006, 00F96083, 00F96100
RegisterComPlus, xrefs: 00F9555C
RemoveIniValues, xrefs: 00F946FB, 00F94781
WriteEnvironmentStrings, xrefs: 00F951C9
PublishComponent, xrefs: 00F9579F
Environment, xrefs: 00F948B3, 00F951EF
500, xrefs: 00F95F89
10000, xrefs: 00F9578C, 00F96383
File, xrefs: 00F949BF, 00F94C4F
AI_CountRowAction, xrefs: 00F962F3
AI_Game, xrefs: 00F95D2B, 00F95F1F
AI_InstallPostPrerequisite, xrefs: 00F95B85
Extension, xrefs: 00F94F66
RegisterProgIdInfo, xrefs: 00F94FBD
RegisterClassInfo, xrefs: 00F94EC3
PatchFiles, xrefs: 00F94CB4
1500000, xrefs: 00F955FA
WriteRegistryValues, xrefs: 00F950BD
RemoveDuplicateFiles, xrefs: 00F94913
ODBCDriver, xrefs: 00F953FE
AI_UserAccounts, xrefs: 00F95DA8, 00F96096
BindImage, xrefs: 00F94DC0, 00F94DE6
12000, xrefs: 00F94926, 00F949AC, 00F94A32, 00F94AAF, 00F94B35, 00F94E50, 00F952DF, 00F95365, 00F953EB
1800, xrefs: 00F95C1E, 00F9617D
AI_DownloadPrereq, xrefs: 00F959F3
MsiPublishAssemblies, xrefs: 00F957FF
AI_UserGroups, xrefs: 00F95E25, 00F96019
AI_UninstallTasks, xrefs: 00F95E7C
RemoveFolders, xrefs: 00F94A9C
MsiAssembly, xrefs: 00F95825
AI_ProcessGroups, xrefs: 00F95FF3
Patch, xrefs: 00F94CDA
RegisterFonts, xrefs: 00F9524F
Feature_, xrefs: 00F94F77, 00F95836, 00F95A2C, 00F95AB2, 00F95B38, 00F95BBE
AI_XmlElement, xrefs: 00F95C31, 00F96190
MoveFile, xrefs: 00F94BCE
AI_UninstallAccounts, xrefs: 00F95D82
3000, xrefs: 00F94688, 00F948A0, 00F94ED6, 00F9504D, 00F95471, 00F95574
1500, xrefs: 00F94709, 00F94794, 00F95C9B, 00F96203
3000000, xrefs: 00F951DC
200000, xrefs: 00F9590C
Shortcut, xrefs: 00F9482D, 00F94E63
AI_XmlAttribute, xrefs: 00F95CAE, 00F96211
Feature, xrefs: 00F958A2
TypeLib, xrefs: 00F95484
InstallServices, xrefs: 00F955E7
SelfReg, xrefs: 00F9550A
AppId, xrefs: 00F94EE9
InstallFinalize, xrefs: 00F95976
AI_AppSearchEx, xrefs: 00F95F76, 00F95F9C
Location, xrefs: 00F95A53, 00F95AD9

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: 100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$8000$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$BindImage$Complus$Component_$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileSize$Font$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Patch$PatchFiles$PatchSize$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveShortcuts$SelfReg$SelfRegModules$ServiceControl$ServiceInstall$Shortcut$StartServices$TypeLib$UnregisterMIMEInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$~
API String ID: 0-1090619422
Opcode ID: 7bdbecf1c21db8a627703dd0e7f7f6f9a44154676ade73defe62e3d823de70f3
Instruction ID: 1afe2d6d27ce0415bfa8a1b5b7a50a9b5c602f4e2f235ae3475f346b75127bae
Opcode Fuzzy Hash: 7bdbecf1c21db8a627703dd0e7f7f6f9a44154676ade73defe62e3d823de70f3
Instruction Fuzzy Hash: 05E24910A783C4F9DB5AF7F92D5636DB9106F62710F10538DF2912B6C2DBB41A40ABE2

Uniqueness

Uniqueness Score: -1.00%

Function 00FBB461 Relevance: 64.6, APIs: 25, Strings: 11, Instructions: 1644memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

VariantClear.OLEAUT32 ref: 00FBB70F
VariantClear.OLEAUT32(?), ref: 00FBB86A
VariantClear.OLEAUT32(?), ref: 00FBB892
VariantClear.OLEAUT32(?), ref: 00FBBA1E
SysAllocString.OLEAUT32(00000000), ref: 00FBBA2F
VariantClear.OLEAUT32(?), ref: 00FBBA79
VariantClear.OLEAUT32(?), ref: 00FBBAA2
SysFreeString.OLEAUT32(00000000), ref: 00FBBAAD
VariantClear.OLEAUT32(?), ref: 00FBBBBB
VariantClear.OLEAUT32(?), ref: 00FBBBEC
VariantClear.OLEAUT32(?), ref: 00FBBC45
VariantClear.OLEAUT32(?), ref: 00FBBCF4
VariantClear.OLEAUT32(?), ref: 00FBB73D

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

VariantClear.OLEAUT32(?), ref: 00FBB80E
VariantClear.OLEAUT32(?), ref: 00FBB836
VariantClear.OLEAUT32(?), ref: 00FBBE38
SysAllocString.OLEAUT32(00000000), ref: 00FBBE49
VariantClear.OLEAUT32(?), ref: 00FBBE93
VariantClear.OLEAUT32(?), ref: 00FBBEBC
SysFreeString.OLEAUT32(00000000), ref: 00FBBEC7
VariantClear.OLEAUT32(?), ref: 00FBBFD5
SysAllocString.OLEAUT32(00000000), ref: 00FBBFE2
VariantClear.OLEAUT32(?), ref: 00FBC02A
VariantClear.OLEAUT32(?), ref: 00FBC052
SysFreeString.OLEAUT32(00000000), ref: 00FBC05C

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Strings

MsiSetProperty, xrefs: 00FBC10D
MsiGetBinaryPathIndirect, xrefs: 00FBC4F3
MsiGetBytesCountText, xrefs: 00FBC74E
MsiGetBinaryPath, xrefs: 00FBC42A
MessageBox, xrefs: 00FBC685
GetFontHeight, xrefs: 00FBC8E0
MsiGetFormattedError, xrefs: 00FBC817
MsiPublishEvents, xrefs: 00FBC5BC
MsiResolveFormatted, xrefs: 00FBC361
MsiGetProperty, xrefs: 00FBC1CF
MsiEvaluateCondition, xrefs: 00FBC298

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ClearVariant$String$AllocFree$HeapInit_thread_footer$AllocateFindProcessResource
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 3540692479-3153392536
Opcode ID: dac07652db4a5c13cb13c609a3a89ba2b7a3a60662cd7125e9a7aa0750d86b54
Instruction ID: 0f64a44ca8cec3df43f14b5bc0abe8ab4590544cb48bac92e35f47ba33974cab
Opcode Fuzzy Hash: dac07652db4a5c13cb13c609a3a89ba2b7a3a60662cd7125e9a7aa0750d86b54
Instruction Fuzzy Hash: 54E29B71D00249DFDB14DFA9C884BEEBBB4FF48314F248219E415AB291EB74AA45DF90

Uniqueness

Uniqueness Score: -1.00%

Function 010DD260 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 517fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(012593A8,C0000000,00000003,00000000,00000004,00000080,00000000,8C278AEA,01259384,0125939C,?), ref: 010DD2E0
GetLastError.KERNEL32 ref: 010DD2FD
OutputDebugStringW.KERNEL32(00000000,00000020), ref: 010DD376
OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 010DD47A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 010DD4EB
WriteFile.KERNEL32(00000000,01258C20,00000000,00000000,00000000,?,0000001C), ref: 010DD51B
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,011D6D60,00000002), ref: 010DD5C6
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 010DD5CF
FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 010DD520

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 010DD6C3
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,0000001D), ref: 010DD749
FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 010DD754
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,011D6D60,00000002,?,?,CPU: ,00000005), ref: 010DD7C8
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 010DD7D1
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,011D6D60,00000002), ref: 010DD856
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 010DD85F

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Strings

CPU: , xrefs: 010DD617, 010DD62D, 010DD75D
LOGGER->Reusing LOG file at:, xrefs: 010DD422, 010DD434, 010DD43E
x64, xrefs: 010DD560, 010DD56C
workstation, xrefs: 010DD56D
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 010DD596
LOGGER->Creating LOG file at:, xrefs: 010DD66B, 010DD67D, 010DD687
server, xrefs: 010DD572, 010DD57A
LOGGER->failed to create LOG at:, xrefs: 010DD331, 010DD343, 010DD34D
x86, xrefs: 010DD557

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$Init_thread_footer$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 4051163352-1312762833
Opcode ID: ff5e7de6f7042a9b770e0af1dc9258623d85ad23af8942b5af8e8c1b8f7eee18
Instruction ID: 492c54d1492cfdd4690ae1f791f42459a03cf73186f267db466b091a46507fcb
Opcode Fuzzy Hash: ff5e7de6f7042a9b770e0af1dc9258623d85ad23af8942b5af8e8c1b8f7eee18
Instruction Fuzzy Hash: 0B129E70A016099FEB10DFA8CD49BAEBBF4FF44314F1482A8E855AB2D5DB74D944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4BC0 Relevance: 22.9, APIs: 15, Instructions: 390memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA5050: EnterCriticalSection.KERNEL32(0125957C,8C278AEA,00000000,?,?,?,?,?,?,00FA487E,0116F9CD,000000FF), ref: 00FA508D
Part of subcall function 00FA5050: LoadCursorW.USER32(00000000,00007F00), ref: 00FA5108
Part of subcall function 00FA5050: LoadCursorW.USER32(00000000,00007F00), ref: 00FA51AE

SysFreeString.OLEAUT32(00000000), ref: 00FA4C63
SysAllocString.OLEAUT32(00000000), ref: 00FA4C94
GetWindowLongW.USER32(?,000000EC), ref: 00FA4D6B
GetWindowLongW.USER32(?,000000EC), ref: 00FA4D7B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FA4D86
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 00FA4D94
GetWindowLongW.USER32(?,000000EB), ref: 00FA4DA2
SetWindowTextW.USER32(?,011D446C), ref: 00FA4E41
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00FA4E76
GlobalLock.KERNEL32(00000000), ref: 00FA4E84
GlobalUnlock.KERNEL32(?), ref: 00FA4ED8
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00FA4F63
SysFreeString.OLEAUT32(00000000), ref: 00FA4F7C
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 00FA4FC3
SysFreeString.OLEAUT32(00000000), ref: 00FA4FE5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID:
API String ID: 4180125975-0
Opcode ID: d7267fdf88e70066b6d1a6a1c68c2d94d36bd3c40c41ab17d5693c8a60dbcb92
Instruction ID: 3dc720a8b3cfd1fb7e94e95b046ba635a2b318c042cff6370331fd3ea7b05b6f
Opcode Fuzzy Hash: d7267fdf88e70066b6d1a6a1c68c2d94d36bd3c40c41ab17d5693c8a60dbcb92
Instruction Fuzzy Hash: 64D1B7B1901209EFDB10DFA4DC48BAF7BB9FF86724F144158F911A7280D7B5A901DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAEAF0 Relevance: 21.6, APIs: 14, Instructions: 608COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00FAEBA3
ShowWindow.USER32(00000000,?), ref: 00FAEBC2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00FAEBD0
GetWindowRect.USER32(00000000,?), ref: 00FAEBE7
ShowWindow.USER32(00000000,?), ref: 00FAEC08
SetWindowLongW.USER32(?,000000EB,?), ref: 00FAEC1F

Part of subcall function 00FA8590: RaiseException.KERNEL32(8C278AEA,8C278AEA,00000000,00000000,01143F71,C000008C,00000001,?,01143FA2,00000000,?,?,?,00F990D7,00000000,8C278AEA), ref: 00FA859C

ShowWindow.USER32(?,?), ref: 00FAED5D
GetWindowLongW.USER32(?,000000EB), ref: 00FAED8C
ShowWindow.USER32(?,?), ref: 00FAEDA9
GetWindowRect.USER32(?,?), ref: 00FAEDCE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$LongShow$Rect$ExceptionRaise
String ID:
API String ID: 777556035-0
Opcode ID: 824349186803f3567c3df27533328746b6e3228fb3ed845bb2eb1bc2285383eb
Instruction ID: 82d98aebddeca6e48ca5b71a7529353ea7a71ce2972901f63c51983b81815904
Opcode Fuzzy Hash: 824349186803f3567c3df27533328746b6e3228fb3ed845bb2eb1bc2285383eb
Instruction Fuzzy Hash: 1E4227B1E04249DFCB24CFA8D884AADBBF5FF89314F14452DE859AB260D730A945DF50

Uniqueness

Uniqueness Score: -1.00%

Function 010B8F30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 419fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 010B92D2
FindClose.KERNEL32(00000000), ref: 010B9300
FindClose.KERNEL32(00000000), ref: 010B9389

Strings

No acceptable version found. It is already downloaded and it will be installed., xrefs: 010B9895
No acceptable version found. It must be installed from package., xrefs: 010B9879
No acceptable version found. Operating System not supported., xrefs: 010B988E
No acceptable version found., xrefs: 010B989C
No acceptable version found. It must be downloaded., xrefs: 010B9880
No acceptable version found. It must be downloaded manually from a site., xrefs: 010B9887
Not selected for install., xrefs: 010B98A3
An acceptable version was found., xrefs: 010B9872

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: 49eedb343633f283eb2e2177a6497e7c62798e0971da58afcc173ff07708c2ab
Instruction ID: 37d07766016b0d511aaae392aba0c53b67c729d09b636fc853d6d4e08a531435
Opcode Fuzzy Hash: 49eedb343633f283eb2e2177a6497e7c62798e0971da58afcc173ff07708c2ab
Instruction Fuzzy Hash: 64F1AE70A046068FEB50DF38C8887AEFBF1EF45314F1486A8D9999B391DB349A45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010BCFD0 Relevance: 19.1, APIs: 2, Strings: 8, Instructions: 1614fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

CopyFileW.KERNEL32(?,?,00000000,00000000,00000000), ref: 010BD558
CopyFileW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?), ref: 010BDA59

Part of subcall function 01094B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,01259384,010DDA40,?), ref: 01094B58
Part of subcall function 01094B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 01094B8A

Strings

instname-custom.mst, xrefs: 010BD50B, 010BDA0C
ProductName, xrefs: 010BD627, 010BD639, 010BD643, 010BDBA2, 010BDBB4, 010BDBBE
{%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}, xrefs: 010BD8A3
AI_PRODUCTNAME_ARP, xrefs: 010BD6AF, 010BD6C1, 010BD6CB, 010BDC19, 010BDC2B, 010BDC35
InstanceId, xrefs: 010BDD04, 010BDD16, 010BDD1E
\\?\, xrefs: 010BD436, 010BD930
instname-target.msi, xrefs: 010BD4CD, 010BD9CE
ProductCode, xrefs: 010BDC90, 010BDCA2, 010BDCAC

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ByteCharCopyFileHeapInit_thread_footerMultiWide$AllocateFindProcessResource
String ID: AI_PRODUCTNAME_ARP$InstanceId$ProductCode$ProductName$\\?\$instname-custom.mst$instname-target.msi${%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}
API String ID: 2868415777-2893908338
Opcode ID: 4fdfd5c8ad72c4ff189a4eff8a08af9fac5ce4a21a8aba81fbb88ee80093c404
Instruction ID: 8db91d90deba793b8d5fa133dab811f2079657e7f289483b5061155d598a35a7
Opcode Fuzzy Hash: 4fdfd5c8ad72c4ff189a4eff8a08af9fac5ce4a21a8aba81fbb88ee80093c404
Instruction Fuzzy Hash: BAD29E70A016499FDB04DFACCC88BEEFBF4EF55318F1481A9E455AB291EB749904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA44A0 Relevance: 16.9, APIs: 11, Instructions: 417nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00FA46CB
GetWindowLongW.USER32(00000000,000000EC), ref: 00FA46DB
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00FA46E6
NtdllDefWindowProc_W.NTDLL(00000000,00000000,00000001,?), ref: 00FA46F4
GetWindowLongW.USER32(00000000,000000EB), ref: 00FA4702
SetWindowTextW.USER32(00000000,011D446C), ref: 00FA47A1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00FA47D6
GlobalLock.KERNEL32(00000000), ref: 00FA47E4
GlobalUnlock.KERNEL32(?), ref: 00FA4838
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00FA489D
NtdllDefWindowProc_W.NTDLL(00000000,00000000,8C278AEA,00000000), ref: 00FA48EF

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID:
API String ID: 3555041256-0
Opcode ID: 7b013313f6d2551c4d168bb82682de4e84bbfb301303c3689f7d255e929e7ae4
Instruction ID: 27213d1f20b49af0ccd7f39febbb0cfbaef5e7e3ea785ba06eb082f535a7cff1
Opcode Fuzzy Hash: 7b013313f6d2551c4d168bb82682de4e84bbfb301303c3689f7d255e929e7ae4
Instruction Fuzzy Hash: D1E1D6B1E012469FDB14DF68DC48BAFB7B9EF86724F144129E911D7280DBB4E900DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FBC116 Relevance: 13.1, Strings: 10, Instructions: 592COMMON

Download Yara Rule

Strings

MsiGetBinaryPathIndirect, xrefs: 00FBC4F3
MsiGetBytesCountText, xrefs: 00FBC74E
MsiGetBinaryPath, xrefs: 00FBC42A
MessageBox, xrefs: 00FBC685
GetFontHeight, xrefs: 00FBC8E0
MsiGetFormattedError, xrefs: 00FBC817
MsiPublishEvents, xrefs: 00FBC5BC
MsiResolveFormatted, xrefs: 00FBC361
MsiGetProperty, xrefs: 00FBC1CF
MsiEvaluateCondition, xrefs: 00FBC298

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted
API String ID: 0-2027876840
Opcode ID: a4bc2e68a69e9eb1883177a7e462ed853864782d2e09481968b17feaadbbe2a0
Instruction ID: 40fe7e83291d87773a11eb12718d94bff791e28dda38d5c3487ccaaa4277f04f
Opcode Fuzzy Hash: a4bc2e68a69e9eb1883177a7e462ed853864782d2e09481968b17feaadbbe2a0
Instruction Fuzzy Hash: 2B4229B1D10249DFDB14CFA9C884BEEBBB1FF49314F20821AE015AB691E7746685DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00FBC127 Relevance: 13.1, Strings: 10, Instructions: 591COMMON

Download Yara Rule

Strings

MsiGetBinaryPathIndirect, xrefs: 00FBC4F3
MsiGetBytesCountText, xrefs: 00FBC74E
MsiGetBinaryPath, xrefs: 00FBC42A
MessageBox, xrefs: 00FBC685
GetFontHeight, xrefs: 00FBC8E0
MsiGetFormattedError, xrefs: 00FBC817
MsiPublishEvents, xrefs: 00FBC5BC
MsiResolveFormatted, xrefs: 00FBC361
MsiGetProperty, xrefs: 00FBC1CF
MsiEvaluateCondition, xrefs: 00FBC298

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted
API String ID: 0-2027876840
Opcode ID: 752cbb6eb7708ec7ba60f469f037ccfe8568fd4693d81e3ceacb4284ef61c25e
Instruction ID: 469185b925439dc4cc3b62abe9cd5264519b5f3a22bdc4593afb10c52e1298d1
Opcode Fuzzy Hash: 752cbb6eb7708ec7ba60f469f037ccfe8568fd4693d81e3ceacb4284ef61c25e
Instruction Fuzzy Hash: 97422AB1D10249DFDB14CFA9C884BEEBBB1FF49314F20821AE015AB690E7746685DF84

Uniqueness

Uniqueness Score: -1.00%

Function 010D9310 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

_wcsrchr.LIBVCRUNTIME ref: 010D949D
_wcsrchr.LIBVCRUNTIME ref: 010D94C5
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 010D951E
GetDriveTypeW.KERNEL32(?), ref: 010D953A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 010D95C1
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 010D9821

Strings

]%!, xrefs: 010D94B9

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection_wcsrchr$DisableHeapLogicalProcessRevertStringsType
String ID: ]%!
API String ID: 139206881-1069524040
Opcode ID: 93169cc214e99c76f7106baf30bdce5c3b982c6e4c86ecf5c72db85c8112f6f6
Instruction ID: 9df4615761a2e407615cc392b5119978fc0793a1901232999b3dce4624916ad1
Opcode Fuzzy Hash: 93169cc214e99c76f7106baf30bdce5c3b982c6e4c86ecf5c72db85c8112f6f6
Instruction Fuzzy Hash: C9F1A23190025ACFDB25DF68CC48BEDBBB5AF44318F0582E8D559AB291DB749E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0108AA20 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 373windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0108ACDA
SendMessageW.USER32(?,00000443,00000000), ref: 0108AD44
MulDiv.KERNEL32(?,00000000), ref: 0108AD7B

Strings

NumberValidationTipTitle, xrefs: 0108AA94
NumberValidationTipMsg, xrefs: 0108ABA1
Segoe UI, xrefs: 0108AD52

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSendWindow
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 701072176-2319862951
Opcode ID: b03f9b10ccb19f5083085b34994a419f3976022407bfcbac68f5dc755a84553f
Instruction ID: 7092a714b5cafb1518a09139368b278e8070523b540eeb13adc10f59bcd9f0b2
Opcode Fuzzy Hash: b03f9b10ccb19f5083085b34994a419f3976022407bfcbac68f5dc755a84553f
Instruction Fuzzy Hash: 13E1CF71A007099FEB18DF64CC99BEEBBB1EF48300F108659E595A72D0DB746A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01167AA7 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 01167C8B

Strings

1#QNAN, xrefs: 01167BBA
1#INF, xrefs: 01167BDD
1#SNAN, xrefs: 01167BB3
1#IND, xrefs: 01167BAC

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 433a0a4117339c2a626b10016efa003fd7506931173070dd3cab35956666fee5
Instruction ID: 6b6a8a2215c9ca96cbf23fefa7b0726c8b745af543daba59ac35bab69cb946d2
Opcode Fuzzy Hash: 433a0a4117339c2a626b10016efa003fd7506931173070dd3cab35956666fee5
Instruction Fuzzy Hash: 33D25A71E082298FDB69CF28DD407EAB7B9EB44305F1441EAD90DE7240E739AE918F41

Uniqueness

Uniqueness Score: -1.00%

Function 011441D9 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,011440F5,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 011441DB
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144202
HeapAlloc.KERNEL32(00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144209
InitializeSListHead.KERNEL32(00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144216
GetProcessHeap.KERNEL32(00000000,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 0114422B
HeapFree.KERNEL32(00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144232

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 0236227b3378f75e11df6a87905e2ddca8f2acb1643c4893bf617a71f877eca8
Instruction ID: f20d8785e24b93302bed3bfea2d8e8209dc0b2b4e801b80193115fd3faf6abe5
Opcode Fuzzy Hash: 0236227b3378f75e11df6a87905e2ddca8f2acb1643c4893bf617a71f877eca8
Instruction Fuzzy Hash: 9DF049756806019FE7399F79A808B167AFDFB98B1AF104438EA96D3248EB30D4418B60

Uniqueness

Uniqueness Score: -1.00%

Function 010AA850 Relevance: 7.7, APIs: 5, Instructions: 240fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 010AA8A8

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 010AA9A8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00000000), ref: 010AAA45
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 010AAA6B
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 010AAAB5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer$HeapProcess_wcsrchr
String ID:
API String ID: 352340201-0
Opcode ID: b47d860a747b8c59193778dea71ad5b05f0719f6712c96dc54db221002ef9938
Instruction ID: 669c4a07fb0dca9b4a6ea5f1ff65ccf30330b94776dbce33f235d02d56475c14
Opcode Fuzzy Hash: b47d860a747b8c59193778dea71ad5b05f0719f6712c96dc54db221002ef9938
Instruction Fuzzy Hash: E671CC31A00209DBDB24DFA8CD58BAEBBE4EF55328F508269E965972C0E7749904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0115CBBA Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0115CC47

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 4b0df9e47e3501a0fdf36530a187d8046a4d4681afede5a31496330b3cc6e4b9
Instruction ID: ed4a87a2fb2ecfd11869e8e2af52b400efa575cf32c736ff7534f4cb2e66b637
Opcode Fuzzy Hash: 4b0df9e47e3501a0fdf36530a187d8046a4d4681afede5a31496330b3cc6e4b9
Instruction Fuzzy Hash: A9B12132A0435ADFDB198E68C880BFEBFA9EF55314F15816ADD20EB241D3359901CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 010DA4B0 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230f79c281a5e16416af6d8d4b726b9ba97489245349862eb27d28b7ed5ed076
Instruction ID: a7a8bddbbe340ce4afd50578e7659d25a1ae5ff50c3ff4b64d6694f4f1ebe0ab
Opcode Fuzzy Hash: 230f79c281a5e16416af6d8d4b726b9ba97489245349862eb27d28b7ed5ed076
Instruction Fuzzy Hash: A2819B70A01219DFDB64DF68CC89B99BBF4EF45314F1482D8E858AB291DB709E84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FBDAC0 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 656COMMON

Download Yara Rule

APIs

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

__Init_thread_footer.LIBCMT ref: 00FBDB5E

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

Strings

Icon, xrefs: 00FBDF23
AiFeatIco, xrefs: 00FBDE4B

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: AiFeatIco$Icon
API String ID: 2296764815-1280411655
Opcode ID: 6adb714c7d26a3cf4887b448144771076b18082baeec92121533b6483f26a277
Instruction ID: a6566127122c2ba3fda91eae1bd4f070ed3d733a8b0a78815d8e4151f1c43b90
Opcode Fuzzy Hash: 6adb714c7d26a3cf4887b448144771076b18082baeec92121533b6483f26a277
Instruction Fuzzy Hash: 2B527970E00658DFDB28DF68CC98BEDBBB4BB49304F144199E409AB291DB746E84DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FB4200 Relevance: 5.7, Strings: 4, Instructions: 720COMMON

Download Yara Rule

Strings

AI_NO_BORDER_HOVER, xrefs: 00FB43CF
AI_NO_BORDER_NORMAL, xrefs: 00FB430E
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 00FB46F2
AI_CONTROL_VISUAL_STYLE, xrefs: 00FB426E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: b1963e6b343b95fcaa16a8d0e96fbb18be88b38c416d469529b7668a0e24ca05
Instruction ID: f2329b7ea10cca345440fe3195e150922b88d3214e280c4aa6a7a2829e64e7ef
Opcode Fuzzy Hash: b1963e6b343b95fcaa16a8d0e96fbb18be88b38c416d469529b7668a0e24ca05
Instruction Fuzzy Hash: 2B42FF71D002288BDB18CF69CD98BEEB7B1FF85314F148259E455AB382C778A905DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010DA8B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 010DA96C
FindClose.KERNEL32(00000000), ref: 010DAAB7

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Strings

%d.%d.%d.%d, xrefs: 010DAA49

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 1673784098-3491811756
Opcode ID: ee9a5e4089348bd3155a66e5d92467a25f74afc17a006edd769f3774cf4102ca
Instruction ID: 8ba410780b9310f712a81938783f3ed8f44fb6a5124fe7d48143ff8ae00c36c1
Opcode Fuzzy Hash: ee9a5e4089348bd3155a66e5d92467a25f74afc17a006edd769f3774cf4102ca
Instruction Fuzzy Hash: D6616B70A05219DFDF64DF68CD48B9DBBB4EF44314F1082D9E858AB291DB759A84CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FB8080 Relevance: 5.4, Strings: 4, Instructions: 371COMMON

Download Yara Rule

Strings

MultipleInstances, xrefs: 00FB81B9
MultipleInstancesProps, xrefs: 00FB829D
OldProductCode, xrefs: 00FB8460
ProductCode, xrefs: 00FB83F0

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: MultipleInstances$MultipleInstancesProps$OldProductCode$ProductCode
API String ID: 0-469785651
Opcode ID: bd36d26f5297aeff10ea8da182151f0e5d623a8463ef6ad19bad707cdf237725
Instruction ID: af44220bf8662da0930b7b70af8dea304c5e4597a7c808f272f445b04d7ecac5
Opcode Fuzzy Hash: bd36d26f5297aeff10ea8da182151f0e5d623a8463ef6ad19bad707cdf237725
Instruction Fuzzy Hash: 68D1E375A00206CBDB18DF59C991BEEB7B9FF94794F14855DD802AB280EB30AD06DF90

Uniqueness

Uniqueness Score: -1.00%

Function 010D30D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

GetLocaleInfoW.KERNEL32(?,00000002,011D446C,00000000), ref: 010D3141
GetLocaleInfoW.KERNEL32(?,00000002,010D2CC5,-00000001,00000078,-00000001), ref: 010D317D

Strings

%d-%s, xrefs: 010D3187

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: InfoInit_thread_footerLocale$HeapProcess
String ID: %d-%s
API String ID: 1688948774-1781338863
Opcode ID: 22f7d864f06019b510ed6aff4c0839c785907ef065de111aa8d9e827130bcf3d
Instruction ID: 8f25ce7d7120a5853f1adfeb50363e338bb2abefeb9eea378ecc1bbc899fc96a
Opcode Fuzzy Hash: 22f7d864f06019b510ed6aff4c0839c785907ef065de111aa8d9e827130bcf3d
Instruction Fuzzy Hash: 43319FB1900209AFDB14DFA9CC49BAEFBB4FF44714F10865DE115AB281DB755904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011419D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,01141916,0000001C,01141B0B,00000000,?,?,?,?,?,?,?,01141916,00000004,01257A44,01141B9B), ref: 011419E2
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,01141916,00000004,01257A44,01141B9B), ref: 011419FD

Strings

D, xrefs: 011419F1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 5eff916bcbd6d7c3456a0e900409aa22d0b54dd0a610965ab02c8ab7667fbdfc
Instruction ID: a2f187780a19dc538eecf0cf087b9332fa1e7f97c17826c6067a52076c7f9497
Opcode Fuzzy Hash: 5eff916bcbd6d7c3456a0e900409aa22d0b54dd0a610965ab02c8ab7667fbdfc
Instruction Fuzzy Hash: 8001F7766001096BDF18DE29CC05BEE7FE9AFC4328F1CC225ED59D7245EB74E8818680

Uniqueness

Uniqueness Score: -1.00%

Function 0108FE80 Relevance: 4.7, APIs: 3, Instructions: 193fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,8C278AEA,?), ref: 0108FF4C
FindNextFileW.KERNEL32(000000FF,00000010,?,8C278AEA,?), ref: 010900A5
FindClose.KERNEL32(000000FF,?,?,8C278AEA,?), ref: 01090104

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: d3999b64917474f7f4ee318de62d669361224c71900ca5d9b22a12425cbc586b
Instruction ID: fcdecd82baf451a5c23b20b17a96da7e3e104143f1f6e008dd1b99ce51dbdcb8
Opcode Fuzzy Hash: d3999b64917474f7f4ee318de62d669361224c71900ca5d9b22a12425cbc586b
Instruction Fuzzy Hash: 7781AD70D04259DFDF24EF68C859BEDBBB8EF05304F1082D9E459A7282D7746A85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FAE6B0 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 00FAE6FE
GetWindowLongW.USER32(00000004,000000FC), ref: 00FAE717
SetWindowLongW.USER32(00000004,000000FC,?), ref: 00FAE729

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 9634232b0a47fc4147e5192efe549bd8f0f3ffe73932ca0c2a243eb6a428e898
Instruction ID: 5df45d0ba6e3de56af199fb3735162ed6dd3318cb2ce418bbbca0517da225392
Opcode Fuzzy Hash: 9634232b0a47fc4147e5192efe549bd8f0f3ffe73932ca0c2a243eb6a428e898
Instruction Fuzzy Hash: C6419EB0A00746EFDB24CF68D948B5AFBB4FF05324F104268E424D7A80D776E924DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FB2390 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000003,000000FC), ref: 00FB23E6
SetWindowLongW.USER32(00000003,000000FC,?), ref: 00FB23F8
DeleteCriticalSection.KERNEL32(?,8C278AEA,?,?,?,?,01171D64,000000FF), ref: 00FB2423

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LongWindow$CriticalDeleteSection
String ID:
API String ID: 1978754570-0
Opcode ID: 970334e3390c90350d198f51728e984d6a0e3aef60bd15bad26968897c7c7996
Instruction ID: a0e80941757acab0571263f7699ec1e707c2b0a43f291b9e7babe69e409be2b9
Opcode Fuzzy Hash: 970334e3390c90350d198f51728e984d6a0e3aef60bd15bad26968897c7c7996
Instruction Fuzzy Hash: 3B31B070A04746FFCB24DF29DC48B99BFB8BF15724F148259E824A3A81D771E910DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01149913 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 01149A0B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 01149A15
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 01149A22

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d1b1dd264f1a18e530951da408cb41d338b885809cac385c8e3c07c0f6093479
Instruction ID: cc54e4432927a9a13fe6c3984b070c98d3cd88ba62ce597a8eed070cc48bca6f
Opcode Fuzzy Hash: d1b1dd264f1a18e530951da408cb41d338b885809cac385c8e3c07c0f6093479
Instruction Fuzzy Hash: C531C37590122DABCB25DF28D988BCDBBB8BF18714F5041EAE81CA7250E7709F818F45

Uniqueness

Uniqueness Score: -1.00%

Function 00F99160 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,8C278AEA,00000001,00000000,?,00000000,0116C480,000000FF,?,00F9910C,8C278AEA,?,?,*.*,?), ref: 00F9918B
LockResource.KERNEL32(00000000,?,00F9910C,8C278AEA,?,?,*.*,?,00000000,0116CB30,000000FF,?,00F992B0,?,?,*.*), ref: 00F99196
SizeofResource.KERNEL32(00000000,00000000,?,00F9910C,8C278AEA,?,?,*.*,?,00000000,0116CB30,000000FF,?,00F992B0,?,?), ref: 00F991A4

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 75dd755741ee24eacadf1182fb19248ab125917f7c1c637d57d4c77ac93b3fd9
Instruction ID: fa19effab72e4fd67da4e7faf3205eaf4e5a9d972bf74129f0d049ad812b0db9
Opcode Fuzzy Hash: 75dd755741ee24eacadf1182fb19248ab125917f7c1c637d57d4c77ac93b3fd9
Instruction Fuzzy Hash: 3511C136E04A559BDB358F69D848B66B7ECFB88724F014A7EEC1AD3240E6759C408690

Uniqueness

Uniqueness Score: -1.00%

Function 00FA7190 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000001B,000000FC), ref: 00FA71A9
SetWindowLongW.USER32(0000001B,000000FC,?), ref: 00FA71B7
DestroyWindow.USER32(0000001B), ref: 00FA71E3

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: cd83318ae61da8a1efd1f29946afd44be736c5beeb9414a3d6453be706892159
Instruction ID: 7169dd25fa3aa83465a46b20df460c3ab7f6237972233a712112167db10bd113
Opcode Fuzzy Hash: cd83318ae61da8a1efd1f29946afd44be736c5beeb9414a3d6453be706892159
Instruction Fuzzy Hash: 5AF03070008B119FD7706F28FD49F92BBE0BF05721F504718E4AA825E4D730A844EB10

Uniqueness

Uniqueness Score: -1.00%

Function 010DD180 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,8C278AEA), ref: 010DD1DE

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Strings

%04d-%02d-%02d %02d-%02d-%02d, xrefs: 010DD220

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapLocalProcessTime
String ID: %04d-%02d-%02d %02d-%02d-%02d
API String ID: 219929307-3768011868
Opcode ID: 31e4299b3d8872988e48f23229cb032187c5934b6d18383eaa10e8f2beed9f42
Instruction ID: 8dbfcba77f1dc5e7ce1be2913d8bf5dde6e265e418dc8672b5b51ce67a4a754d
Opcode Fuzzy Hash: 31e4299b3d8872988e48f23229cb032187c5934b6d18383eaa10e8f2beed9f42
Instruction Fuzzy Hash: FA217FB1D04208AFDB14DF99D941BBEB7F8EB0C710F10421EF955A7280E7785940C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 01154860 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298cd0eb4f69172c183035d0fd2b76c10ff2b175f95b85964a33c67947bd53d1
Instruction ID: 1dc0b6ad8681c0d51fde93cd22550286b937ec400feb7d13739b304167edb5e3
Opcode Fuzzy Hash: 298cd0eb4f69172c183035d0fd2b76c10ff2b175f95b85964a33c67947bd53d1
Instruction Fuzzy Hash: 59F15171E00219DFDF58CFA9C8806ADBBF1FF88324F158269D925A7785E730A941CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00FBF4E0 Relevance: 3.3, APIs: 2, Instructions: 257windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,00000001), ref: 00FBF60B
SendMessageW.USER32(?,0000102B,?,-00000002), ref: 00FBF7F5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6f11c844a85e1116c351c14b0d17070c31cb3d56be23f4d7f5f398c89090e1dc
Instruction ID: d5241425741ab05593b98c8600199b8343b98cb8b0bd682fe4624b89777d254b
Opcode Fuzzy Hash: 6f11c844a85e1116c351c14b0d17070c31cb3d56be23f4d7f5f398c89090e1dc
Instruction Fuzzy Hash: 52B1DF71A00246AFCB18CF29C995BE9FBF5FB08314F188269E859DB281D734E945DF90

Uniqueness

Uniqueness Score: -1.00%

Function 010AE5B0 Relevance: 3.1, APIs: 2, Instructions: 134windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,8C278AEA,?,00000000), ref: 010AE5FB
GetLastError.KERNEL32(?,00000000), ref: 010AE605

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AllocateErrorFormatHeapLastMessage
String ID:
API String ID: 4114510652-0
Opcode ID: aa79fcde8ee0fb9549f4e50741e02e339d09cecd535c56b211ea45c0f3d58d02
Instruction ID: 129c3be72ec0aa3811c7453ac1927b9c05aacbfd164030755fffb8c9c0ef0575
Opcode Fuzzy Hash: aa79fcde8ee0fb9549f4e50741e02e339d09cecd535c56b211ea45c0f3d58d02
Instruction Fuzzy Hash: 8041E271A052199FEB14CFA8CC057AEFBF8EF44754F5406AEE905EB380D7B559008B90

Uniqueness

Uniqueness Score: -1.00%

Function 010010D0 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 0100113F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 0100114D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2f267d4394c62eb4d0f0e8580d38759786fb6ae053a2d8f597e7f476c33ec6bd
Instruction ID: 79be3a9d65964353ba115b160e416eef5b8670b10e9ec94e72a076a11ed6e4dd
Opcode Fuzzy Hash: 2f267d4394c62eb4d0f0e8580d38759786fb6ae053a2d8f597e7f476c33ec6bd
Instruction Fuzzy Hash: F6317871900605EFDB15DF69D984B9AFBF4FF04320F5442A9E924A76D0C731EA50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD8C0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00FCD8C5
SetUnhandledExceptionFilter.KERNEL32(Function_0011A060), ref: 00FCD8DB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 709eab9d4c1ac139f3643ac7a6c17a40942d713d5a16f70c960987f69d0453ba
Instruction ID: e379ca5b0d455703eafbed27b96420b4e6492f526c704f2ae80ffa2058dd26de
Opcode Fuzzy Hash: 709eab9d4c1ac139f3643ac7a6c17a40942d713d5a16f70c960987f69d0453ba
Instruction Fuzzy Hash: 37D01274A84345DFDF295BA1A55FF283FA0E7A1B1CF44006DD48605285C7F15C84EB63

Uniqueness

Uniqueness Score: -1.00%

Function 0115F711 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0115F70C,?,?,00000008,?,?,0116A8F4,00000000), ref: 0115F93E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 22e4aa71d77edf171bd514ebb01b979367bd45ad615584a454078bfe6aef7c16
Instruction ID: e00b8636d92207d67d9a1356a350437abc742b3e1d7b93d1de40eeffca05ebca
Opcode Fuzzy Hash: 22e4aa71d77edf171bd514ebb01b979367bd45ad615584a454078bfe6aef7c16
Instruction Fuzzy Hash: 81B13D3161060ADFE759CF2CC486B657BB0FF45364F258658E9A9CF2A1C335E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010045B0 Relevance: 1.8, Strings: 1, Instructions: 521COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 01004795, 01004982

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ExceptionRaise__floor_pentium4
String ID: unordered_map/set too long
API String ID: 996205981-306623848
Opcode ID: 3d125a80e6361d34c245b7be1c22cfe611bd13d9a15bba308c5eed249d234eca
Instruction ID: daba2876f908469baf63b1efe0bae5ad5cfb4f19800721af9584b53a6310dd38
Opcode Fuzzy Hash: 3d125a80e6361d34c245b7be1c22cfe611bd13d9a15bba308c5eed249d234eca
Instruction Fuzzy Hash: EF12D171A002099FDB1ADF68C880AADFBF5FF48310F14826AE955EB391D735E941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00FB7AC0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,00FB60F7,?,?,?,?,?,?,?,?,00FB5F68,?,?), ref: 00FB7B10

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: e87fc440e6792d1d58b477bd8e7024a131078bb6c8e04f4e946e05c38daf34a9
Instruction ID: f27501b1783b77bef2f22f5442dd78a0a97fd38f3b96f34176f179e9c7469c9d
Opcode Fuzzy Hash: e87fc440e6792d1d58b477bd8e7024a131078bb6c8e04f4e946e05c38daf34a9
Instruction Fuzzy Hash: BDF05E70008345DED711BB15D898AA9BBA6FBC4315F4485E5E044C5469C2398E44EF10

Uniqueness

Uniqueness Score: -1.00%

Function 01161639 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11bfd95d153fbcc8800d30bf3e19b851f8d9a6afebc8e1bcd8c14d2212a2947
Instruction ID: e8f6b32ee6286f5a8653d60644a41365786196710a9f2ab311bab57c7300b75c
Opcode Fuzzy Hash: c11bfd95d153fbcc8800d30bf3e19b851f8d9a6afebc8e1bcd8c14d2212a2947
Instruction Fuzzy Hash: 5B322621D2AF414DD72B5538C822339AA4DAFB73C5F15D737F82AB599AEB29C4D34200

Uniqueness

Uniqueness Score: -1.00%

Function 010FC010 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0cf873ce5ce24cf5cdf6b31c8e242ed30d4079ac5e5b7bc595c0271f0b9d3a
Instruction ID: 6a755e8260896ab57fce5e9d21bbba1c09e1df2edae2b7fb19104c0b46addd19
Opcode Fuzzy Hash: aa0cf873ce5ce24cf5cdf6b31c8e242ed30d4079ac5e5b7bc595c0271f0b9d3a
Instruction Fuzzy Hash: F90268B1D002089FEB14CFA8C94ABEEBBF5FF48308F14465DD559AB680D775AA44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0114CEC0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d0f29648b79e64e64f6ec946172529454e792f52270b8e945f5408c182bd98
Instruction ID: cb52b8265edaab2ebf8d15505c9ea6a964382f7bc68dbb074eec39312a8a9676
Opcode Fuzzy Hash: 26d0f29648b79e64e64f6ec946172529454e792f52270b8e945f5408c182bd98
Instruction Fuzzy Hash: 20C12F70A006068FDF2CCFACD480BBEBBB1AF65F04F144619D9569B291C735E846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5220 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff728348b4ae81dcacabfeecc8e0052547c9acfe313c7cba267e55af0b7f68ae
Instruction ID: a5b8fd352df047ed14d13967a3733c99f721a7ef2db20a91d80d5e1f8524d34e
Opcode Fuzzy Hash: ff728348b4ae81dcacabfeecc8e0052547c9acfe313c7cba267e55af0b7f68ae
Instruction Fuzzy Hash: FF7106B1801B48CFE761CF78C94478ABBF0BB05324F148A5DD4A99B3D1D3B9A608CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0104C330 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289d11a16a7cf125df69cbe4eefe899ca272d195ee382718a23f274eec50da66
Instruction ID: 2ec0363b95fde3773d5b09dbf534383bbd4c3468ba89cce36368b6cba9464bb8
Opcode Fuzzy Hash: 289d11a16a7cf125df69cbe4eefe899ca272d195ee382718a23f274eec50da66
Instruction Fuzzy Hash: E441F4B0905B49EED708CF69C51878AFBF0BB19318F20825DC4589B781D3BAA618CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00FAE540 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b742a5d34a6b512a06841696f0b6e2e737d216985ba5aa01dc56fab2a5cac0b
Instruction ID: 6d06baffa349fa203b9aa9fccfb19ddd45029019c9e8beba48b0b46eae50b312
Opcode Fuzzy Hash: 9b742a5d34a6b512a06841696f0b6e2e737d216985ba5aa01dc56fab2a5cac0b
Instruction Fuzzy Hash: 7D31F0B0405B84DEE321CF29C258747BFF0BB05718F108A4DD4A25BB91C3BAA508CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FA78B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09b008c3fc8068dcaf0405b91c1c240c634994071fa3f7f0f93d00db96ee55f
Instruction ID: 7aaad036656b20b7c9714f0b2912f0763050e0e575158caf3b9a1df146079c4e
Opcode Fuzzy Hash: a09b008c3fc8068dcaf0405b91c1c240c634994071fa3f7f0f93d00db96ee55f
Instruction Fuzzy Hash: C12188B1804788CFD710CF68C54478ABBF4FF09314F1186AED455AB791E3B9AA08CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA7E70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908c1b5eaa8893369df03222eb1e502052715513b711cefceec384db7a5b8e1d
Instruction ID: 6f199939a5d0dc99debe8d877689fdf242f6394947d61d73a45c312abd34b4b1
Opcode Fuzzy Hash: 908c1b5eaa8893369df03222eb1e502052715513b711cefceec384db7a5b8e1d
Instruction Fuzzy Hash: 482158B1804788DFD710CF68C94478ABBF4FF19314F11869ED455AB791E7B9AA08CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC58F0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76ece4f9fa682e40eb23374e441ee2830fde15e2d10a4999d3ae9b6b2c70d4f
Instruction ID: 6d09396771e4fcbe315c3bfa5a67f563e30b87dbc904cdd89acac54e1cfd8e17
Opcode Fuzzy Hash: b76ece4f9fa682e40eb23374e441ee2830fde15e2d10a4999d3ae9b6b2c70d4f
Instruction Fuzzy Hash: 66110CB1905248DFC754CF58D544789BBF4FB09328F2086AEE8189B381D37A9A0ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 0115E8FB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5208ff93917cac1753a3486b25e3d61fbebd09851aa9bcef3d1636bce1243e35
Instruction ID: 88ea0ed027d177714e6f4f6d66835ff0e4d7b55d2feec33463bf43377f864987
Opcode Fuzzy Hash: 5208ff93917cac1753a3486b25e3d61fbebd09851aa9bcef3d1636bce1243e35
Instruction Fuzzy Hash: 71F0A031A16320EBCBAACA4DC444A48B3B8EB08A14F111096F910D7251D3B0DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0115E93F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: c3be4d16a1f33a9bd6e804fed5cdc17f526322db21d4042f9250bd53649c163d
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: 43E04632912228EBCBA8DB98890498AF7BCEB44A04B150896BA11E3200E270DF00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0114FDF7 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a962eb7063aa5dac9a286c1eb4be0eb6ad47394398426903ba7e2235a18e8e
Instruction ID: 043b286046ed2c6eb58c67df2b639c68290dcf373974c8a9ba5d9c8ea0de71f5
Opcode Fuzzy Hash: 16a962eb7063aa5dac9a286c1eb4be0eb6ad47394398426903ba7e2235a18e8e
Instruction Fuzzy Hash: BBC08C34002961CBCE3E891C93703E53364A391E83F80148CC9030B743EB1E9C83D600

Uniqueness

Uniqueness Score: -1.00%

Function 010E4100 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 335COMMON

Download Yara Rule

Strings

powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 010E425F
Unable to create process: , xrefs: 010E4304
Unable to retrieve PowerShell output from file: , xrefs: 010E445E
Unable to get a temp file for script output, temp path: , xrefs: 010E420F
Unable to find file , xrefs: 010E4133
txt, xrefs: 010E41D3
Unable to retrieve exit code from process., xrefs: 010E4481
ps1, xrefs: 010E41A6, 010E41B8, 010E41C2

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: 4affc7058e6b59d594be9887708975e6956e7633bf8ea283a4e01b8535a33fb6
Instruction ID: d87e328176124536fcb9e65b4bc1b74be625ee020914b4fe7f6d79aaedf2877c
Opcode Fuzzy Hash: 4affc7058e6b59d594be9887708975e6956e7633bf8ea283a4e01b8535a33fb6
Instruction Fuzzy Hash: 7DC19E71E01609AFDF14DFA9CD49BAEBBF4AF09314F108299E554E7291DB749A00CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA71F0 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 460stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FA7290
GetParent.USER32(?), ref: 00FA72D1
lstrcmpW.KERNEL32(?,#32770), ref: 00FA72F1

Strings

#32770, xrefs: 00FA72E8

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ParentWindowlstrcmp
String ID: #32770
API String ID: 3676684576-463685578
Opcode ID: b893f4b051a3a3f6201a5e5795a9cc3392f792cbacbe72d11b149a508c2294a4
Instruction ID: 0419a5446c9042da0c6969d791ef04b73a3c70da1b406390e464f3b5c031e5b2
Opcode Fuzzy Hash: b893f4b051a3a3f6201a5e5795a9cc3392f792cbacbe72d11b149a508c2294a4
Instruction Fuzzy Hash: 8B028FB1A04309EFDB14DFA8DD48FAEBBF5EF4A314F144158E815A7290DB75A940EB20

Uniqueness

Uniqueness Score: -1.00%

Function 010B6CC0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 259COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000001F6), ref: 010B6D0E
GetDlgItem.USER32(?,000001F8), ref: 010B6D1B
GetDlgItem.USER32(?,000001F7), ref: 010B6D6C
SetWindowTextW.USER32(00000000,00000000), ref: 010B6D7B
ShowWindow.USER32(?,00000005), ref: 010B6DE1
GetDlgItem.USER32(?,000001F7), ref: 010B6E03
SetWindowTextW.USER32(00000000,00000000), ref: 010B6E12
ShowWindow.USER32(?,00000000), ref: 010B6E77
ShowWindow.USER32(?,00000000), ref: 010B6E7E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 010B6EC7
GetDlgItem.USER32(?,00000000), ref: 010B6EF9
IsWindow.USER32(00000000), ref: 010B6F03
SetWindowPos.USER32(?,00000000,10C25DE5,01F66800,76FF0000,E815FF24,00000014,?,00000000,?,?,00000616), ref: 010B6F50

Strings

Details >>, xrefs: 010B6DEA
Details <<, xrefs: 010B6D53

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Item$Show$Text
String ID: Details <<$Details >>
API String ID: 2476474966-3763984547
Opcode ID: 549f6e3a6d19fd65081f5c4a9278512c92c20b44e5835006bf3291e09622092f
Instruction ID: 45dda575dfc119d578b38b6c61998e101b48707a1a7c78cf37a5709eb0f0ad72
Opcode Fuzzy Hash: 549f6e3a6d19fd65081f5c4a9278512c92c20b44e5835006bf3291e09622092f
Instruction Fuzzy Hash: A591B071D0020AAFDF14DFA8DC99BEEBBB5FF08314F148219E915A7690D731A990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010DE0A0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,8C278AEA), ref: 010DE152
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,8C278AEA), ref: 010DE163
LocalAlloc.KERNEL32(00000040,00000014), ref: 010DE1D8
GetLastError.KERNEL32 ref: 010DE1F6
LocalFree.KERNEL32(00000000), ref: 010DE207
GetLastError.KERNEL32 ref: 010DE226
LocalFree.KERNEL32(00000000), ref: 010DE237
CreateDirectoryW.KERNEL32(?,?), ref: 010DE260
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,8C278AEA), ref: 010DE2B4
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,8C278AEA), ref: 010DE317
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,8C278AEA), ref: 010DE321

Strings

Everyone, xrefs: 010DE13A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Local$Free$ErrorLast$AllocCreateDirectory
String ID: Everyone
API String ID: 2702579218-3285609282
Opcode ID: b8d0bdfcc780939deb2362f78081a94f0867ab4c8498fa173671083af78c56a6
Instruction ID: 763ac19d18326e498e27f15c61761f32847f6cd31188b950a9f8e8736a8cc32e
Opcode Fuzzy Hash: b8d0bdfcc780939deb2362f78081a94f0867ab4c8498fa173671083af78c56a6
Instruction Fuzzy Hash: 6F9119B0E00349AFEF24DFE9D888BEEBFF8AF04704F144059E551AB280DBB595448B91

Uniqueness

Uniqueness Score: -1.00%

Function 010C8270 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 439COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,8C278AEA), ref: 010C82D9
IsWow64Process.KERNEL32(00000000), ref: 010C82E0

Part of subcall function 010AAB00: _wcsrchr.LIBVCRUNTIME ref: 010AAB39

_wcsrchr.LIBVCRUNTIME ref: 010C8361
_wcsrchr.LIBVCRUNTIME ref: 010C83F7

Strings

"%s" , xrefs: 010C859D
/p //, xrefs: 010C84A1
%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s", xrefs: 010C862F
TRANSFORMS=":%d", xrefs: 010C8450
/fvomus //, xrefs: 010C84AA, 010C84FF, 010C8500
.x64, xrefs: 010C8342
/i //, xrefs: 010C84AF
EXE_CMD_LINE="%s ", xrefs: 010C8682

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: _wcsrchr$Process$CurrentWow64
String ID: "%s" $ /fvomus //$ /i //$ /p //$ EXE_CMD_LINE="%s "$ TRANSFORMS=":%d"$%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"$.x64
API String ID: 657290924-2074823060
Opcode ID: 8c76a83c63eccf4c0e5bbf8987547b3155b8c6b8a4fa3ace5d03d97f393aae7f
Instruction ID: b35c8500da5712501f87f008e550cf93a7ece1201279e134ccf618f74a24baed
Opcode Fuzzy Hash: 8c76a83c63eccf4c0e5bbf8987547b3155b8c6b8a4fa3ace5d03d97f393aae7f
Instruction Fuzzy Hash: A4F1B130A006069FEB04DFA8CC48BAEBBE5BF55314F1486ADE955AB2D1DB74D904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FCAFF0 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 353libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00000043), ref: 00FCB127
GetProcAddress.KERNEL32(00000000,InitializeEmbeddedUI), ref: 00FCB13F
GetProcAddress.KERNEL32(00000000,ShutdownEmbeddedUI), ref: 00FCB149
GetProcAddress.KERNEL32(00000000,EmbeddedUIHandler), ref: 00FCB154

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Strings

build , xrefs: 00FCB23F
INAN, xrefs: 00FCB027
EmbeddedUIHandler, xrefs: 00FCB14B
InitializeEmbeddedUI, xrefs: 00FCB139
ShutdownEmbeddedUI, xrefs: 00FCB141
SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll', xrefs: 00FCB084
19.7.1, xrefs: 00FCB22A
e09f3004, xrefs: 00FCB24E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressProc$HeapInit_thread_footer$AllocateLibraryLoadProcess
String ID: build $19.7.1$EmbeddedUIHandler$INAN$InitializeEmbeddedUI$SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'$ShutdownEmbeddedUI$e09f3004
API String ID: 2564778481-2055252535
Opcode ID: 06b665e74efa10f6d9089f67fae3e02034a0159332009e236addcf95c2557aac
Instruction ID: 6a454c8303dc4cebfe76d07da75f98ab46e8f24731951883b99ae03005c43c17
Opcode Fuzzy Hash: 06b665e74efa10f6d9089f67fae3e02034a0159332009e236addcf95c2557aac
Instruction Fuzzy Hash: 75D17F75E0020A9FDB14DFA8CD56BEEBBB4FF04314F14462DE915A7281EB74AA04DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9DE70 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,8C278AEA,011EB768,?,?,?,?,?,?,?,?,8C278AEA,0116E035,000000FF), ref: 00F9DED8
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00F9DEDE
LoadLibraryW.KERNEL32(00000000,.dll,-00000001,00000000,?,011D446C,00000000,00000000,00000000), ref: 00F9E07D

Strings

RoGetActivationFactory, xrefs: 00F9DECE
CoIncrementMTAUsage, xrefs: 00F9DF78
DllGetActivationFactory, xrefs: 00F9E0C0
combase.dll, xrefs: 00F9DED3, 00F9DF7D
.dll, xrefs: 00F9E064

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LibraryLoad$AddressProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 1469910268-2454113998
Opcode ID: 409b6fb9fba9d74d6aca2dc9905131bfec736b042799f9f1f449518917ecb55a
Instruction ID: d6f53ea25676bd79b2d562ef33c17ea3c7132ad1a1d8164f8feaca78af7872fb
Opcode Fuzzy Hash: 409b6fb9fba9d74d6aca2dc9905131bfec736b042799f9f1f449518917ecb55a
Instruction Fuzzy Hash: D6A18F71E00209DFEF14DFA9C984BEEBBB5EF58714F244029E411B7290DB746944DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010DCF60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(01259384,8C278AEA,?,00000010), ref: 010DCF9C

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

EnterCriticalSection.KERNEL32(00000010,8C278AEA,?,00000010), ref: 010DCFA9
WriteFile.KERNEL32(00000000,?,?,000000FF,00000000), ref: 010DCFDB
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 010DCFE4
WriteFile.KERNEL32(00000000,010D2D47,9384B9EC,011B5BDD,00000000,011D443C,00000001,?,?,000000FF,00000000), ref: 010DD066
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 010DD06F
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 010DD0A5
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 010DD0AE
WriteFile.KERNEL32(00000000,?,?,?,00000000,011D6D60,00000002,?,?,?,00000000,?,?,000000FF,00000000), ref: 010DD10F
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 010DD118
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 010DD148

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Strings

v, xrefs: 010DD148

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
String ID: v
API String ID: 201293332-3261393531
Opcode ID: d8a6cf88b6791e2c959ba7ee0022f5b86450a2e2f5da433c7477ca49607d0466
Instruction ID: b0bba32458b9438f11d3364a108b32502e1ebfd582fac54d5aec6d197bbf685d
Opcode Fuzzy Hash: d8a6cf88b6791e2c959ba7ee0022f5b86450a2e2f5da433c7477ca49607d0466
Instruction Fuzzy Hash: 7A61DD30900648AFEB10CFA8CD49BAEBFB8FF45314F1481A8F951A7291DB759854DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 010B9470 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 410libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 010D3C70: GetSystemDefaultLangID.KERNEL32(8C278AEA,?,?,?,?), ref: 010D3CA6

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00000000), ref: 010B95D3
GetProcAddress.KERNEL32(00000000), ref: 010B95DA
__Init_thread_footer.LIBCMT ref: 010B95F1
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000), ref: 010B9610

Strings

IsWow64Process2, xrefs: 010B95C9
Search result:, xrefs: 010B9849
kernel32, xrefs: 010B95CE
Searching for:, xrefs: 010B96C9
Undefined, xrefs: 010B98AA
Wrong OS or Os language for:, xrefs: 010B993B
Not selected for install., xrefs: 010B98C3, 010B98C4

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressCurrentDefaultHandleInit_thread_footerLangModuleProcProcessSystem
String ID: IsWow64Process2$Not selected for install.$Search result:$Searching for:$Undefined$Wrong OS or Os language for:$kernel32
API String ID: 52476621-4272450043
Opcode ID: cf5484a3efc492bab6d6e4d30bf8a2ed8f07f0c6b8fa0d50e40b9cba04c38c91
Instruction ID: 0bd2da449492198d621da4a6a63911784fbfcf4cc95683940c41845df24f3c8d
Opcode Fuzzy Hash: cf5484a3efc492bab6d6e4d30bf8a2ed8f07f0c6b8fa0d50e40b9cba04c38c91
Instruction Fuzzy Hash: 41F19FB0900606CFDB64DFACC884BEEBBF1BF44318F14825DD6969B295DB34A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010B4730 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 340threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0125944C,8C278AEA,?,?,?), ref: 010B4852
EnterCriticalSection.KERNEL32(?,8C278AEA,?,?,00000000,?,?,?,?,?,00000000,011AD8F7,000000FF), ref: 010B4864
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000,011AD8F7,000000FF), ref: 010B4871
GetCurrentThread.KERNEL32 ref: 010B487C
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,011D446C,00000000), ref: 010B4AAE
LeaveCriticalSection.KERNEL32(?,00000000), ref: 010B4BDC

Strings

v, xrefs: 010B4BDC
[0x%.8Ix] , xrefs: 010B4550, 010B4AB5
*** Stack Trace (x86) ***, xrefs: 010B49AD
<--------------------MORE--FRAMES-------------------->, xrefs: 010B4A52
MODULE_BASE_ADDRESS, xrefs: 010B4AFB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: eb17ca2d99cbe912f3436b34a070b705d80fbd7f58ccdf67147f96f2619399a4
Instruction ID: f24bbf7328d073fa6faa07012fc2b179a074b3f18e48f21dc73eb96df6fff70b
Opcode Fuzzy Hash: eb17ca2d99cbe912f3436b34a070b705d80fbd7f58ccdf67147f96f2619399a4
Instruction Fuzzy Hash: 70D199706003889FEF29DF68CC99BEE7BA8FF45708F104158E9599B282DB755B04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010B47E0 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 265threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0125944C,8C278AEA,?,?,?), ref: 010B4852
EnterCriticalSection.KERNEL32(?,8C278AEA,?,?,00000000,?,?,?,?,?,00000000,011AD8F7,000000FF), ref: 010B4864
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000,011AD8F7,000000FF), ref: 010B4871
GetCurrentThread.KERNEL32 ref: 010B487C
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,011D446C,00000000), ref: 010B4AAE
LeaveCriticalSection.KERNEL32(?,00000000), ref: 010B4BDC

Strings

v, xrefs: 010B4BDC
[0x%.8Ix] , xrefs: 010B4AB5
*** Stack Trace (x86) ***, xrefs: 010B49AD
<--------------------MORE--FRAMES-------------------->, xrefs: 010B4A52
MODULE_BASE_ADDRESS, xrefs: 010B4AFB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 39655e90e9a328cf9544374fa6f8bf457d217251a01f452c31565fd0fbce53fb
Instruction ID: 56148d1299086c42347f1d07323dfb8f56c4d074b5623f32c66d39480c979a2e
Opcode Fuzzy Hash: 39655e90e9a328cf9544374fa6f8bf457d217251a01f452c31565fd0fbce53fb
Instruction Fuzzy Hash: 2CB19C705003889FEF2ADF64CC99BEE7BB8EF45308F104158EA49AB282DB755B04CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010B69C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 010AE740: LoadLibraryW.KERNEL32(ComCtl32.dll,8C278AEA,?,?,00000000), ref: 010AE77E
Part of subcall function 010AE740: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 010AE7A1
Part of subcall function 010AE740: FreeLibrary.KERNEL32(00000000), ref: 010AE81F

GetDlgItem.USER32(?,000001F4), ref: 010B6A01
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 010B6A12
MulDiv.KERNEL32(00000009,00000000), ref: 010B6A2A
GetDlgItem.USER32(?,000001F6), ref: 010B6A64
IsWindow.USER32(00000000), ref: 010B6A6D
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 010B6A84
GetDlgItem.USER32(?,000001F8), ref: 010B6A8E
GetWindowRect.USER32(?,?), ref: 010B6A9F
GetWindowRect.USER32(?,?), ref: 010B6AB2
GetWindowRect.USER32(00000000,?), ref: 010B6AC2

Strings

Courier New, xrefs: 010B6A30

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$ItemRect$LibraryMessageSend$AddressFreeLoadProc
String ID: Courier New
API String ID: 1717253393-2572734833
Opcode ID: 370d42ed14aa570e0349d07d19235276b586ec047bf6096e572b19a045555c41
Instruction ID: 8c029cad4376915e774aceb2a6806efd768011f4e8da932d470870c6ea7adf41
Opcode Fuzzy Hash: 370d42ed14aa570e0349d07d19235276b586ec047bf6096e572b19a045555c41
Instruction Fuzzy Hash: 2F41D671BC43097FEB249F259C86FEE7AA9EF58B04F400529BB057A1C0DAB1A8408B54

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4DB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,8C278AEA), ref: 00FC4E38

Part of subcall function 00FA68F0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00FA6926

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00FC4F3B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00FC4F4F
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00FC4F64
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00FC4F79
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00FC4F90
GetWindowRect.USER32(?,?), ref: 00FC4FC2
SendMessageW.USER32(00000000,00000412,00000000), ref: 00FC5024
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00FC5034

Strings

tooltips_class32, xrefs: 00FC4E32

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: tooltips_class32
API String ID: 1954517558-1918224756
Opcode ID: 085a1caf56b82808e800d1c14f8fbee1fbbcb0b068e50fea8d851d1b310023f9
Instruction ID: c1e9406e3880701c955e87835b1c2c31bbb04913b9d4be049c105c3ce4d4bb45
Opcode Fuzzy Hash: 085a1caf56b82808e800d1c14f8fbee1fbbcb0b068e50fea8d851d1b310023f9
Instruction Fuzzy Hash: 6C915E71A40309AFDB24CFA4DD95FAEBBF8FB08700F44452EE516EA294D774A904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01006CB0 Relevance: 16.7, APIs: 11, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 01006CF7
GetParent.USER32 ref: 01006D0D
GetWindowRect.USER32(?,?), ref: 01006D18
GetParent.USER32(?), ref: 01006D20
GetWindow.USER32(?,00000004), ref: 01006D52
GetWindowRect.USER32(?,?), ref: 01006D60
GetWindowLongW.USER32(00000000,000000F0), ref: 01006D6D
MonitorFromWindow.USER32(?,00000002), ref: 01006D85
GetMonitorInfoW.USER32(00000000,00000004), ref: 01006D9F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 01006E4D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$LongMonitorParentRect$FromInfo
String ID:
API String ID: 1820395375-0
Opcode ID: 2e28dcbc3efdc88b46be7a15e89c4306176993e1ae215bb25cb6c2674bc55151
Instruction ID: dbe8182a0f66e9cc60e0effccb7c37300c8a8a2a5f148d32f6621a54fe1b5b01
Opcode Fuzzy Hash: 2e28dcbc3efdc88b46be7a15e89c4306176993e1ae215bb25cb6c2674bc55151
Instruction Fuzzy Hash: ED518272D002599FDB21CF68DD88AEDBBB9FB48710F544229E915F3284DB31AD54CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010B6070 Relevance: 16.6, APIs: 11, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 010B60AF
GetWindowLongW.USER32(010B69AC,000000F0), ref: 010B60C0
SetWindowLongW.USER32(010B69AC,000000F0,00000000), ref: 010B60D2
GetWindowLongW.USER32(010B69AC,000000EC), ref: 010B60E5
SetWindowLongW.USER32(010B69AC,000000EC,00000000), ref: 010B60F4
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 010B6108
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 010B6117
GetWindowRect.USER32(?,?), ref: 010B6156
GetDlgItem.USER32(?,?), ref: 010B6192
IsWindow.USER32(00000000), ref: 010B619D
GetWindowRect.USER32(?,?), ref: 010B61B8

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long$MessageRectSend$Item
String ID:
API String ID: 661679956-0
Opcode ID: b3b083760ae728e1a69af6becb4728b04ad9374f5f0cbbb8493ea15be60b010a
Instruction ID: b104579887e0b5797bd3b9c5ce8438c61559b9fa6bfac0820711511c33e29c14
Opcode Fuzzy Hash: b3b083760ae728e1a69af6becb4728b04ad9374f5f0cbbb8493ea15be60b010a
Instruction Fuzzy Hash: F341BE715043069FD720DF68EC84B6BB7E4BF98710F144A2DF9D592191DB31E8848B62

Uniqueness

Uniqueness Score: -1.00%

Function 010DE730 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 01067A10: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 01067A51

GetLastError.KERNEL32(8C278AEA,?,?,?,011B602D,000000FF,?,010C2852,?), ref: 010DE79D
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 010DE92D
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 010DE986
FreeLibrary.KERNEL32(00000000,?,?,?,?,011B602D,000000FF,?,010C2852,?), ref: 010DEA74

Strings

x64, xrefs: 010DE816
GetPackagePath, xrefs: 010DE927, 010DE980
Kernel32.dll, xrefs: 010DE771
x86, xrefs: 010DE7E5
neutral, xrefs: 010DE832

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem
String ID: GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 2155880084-4043905686
Opcode ID: 9c826dedab7428af8254c5feeea5944510671fc5fdfea8c7366e42820a82ecd3
Instruction ID: 3040b3e0d79f394661b9e9c44c9adc8d6f0662f4badb3bfdac6edc353b37d81f
Opcode Fuzzy Hash: 9c826dedab7428af8254c5feeea5944510671fc5fdfea8c7366e42820a82ecd3
Instruction Fuzzy Hash: 35C15970A0120ADFDF18CFA8C984B9DBBF5BF48314F14816DE805AB291DB75A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010C06D0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 283COMMON

Download Yara Rule

APIs

Part of subcall function 010B5290: LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,010C0731,?,8C278AEA,?,?), ref: 010B52AB
Part of subcall function 010B5290: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 010B52C1
Part of subcall function 010B5290: FreeLibrary.KERNEL32(00000000), ref: 010B52FA

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000104,8C278AEA,?,?), ref: 010C0910

Strings

Shlwapi.dll, xrefs: 010C0727
AppDataFolder, xrefs: 010C0878, 010C08B5
PROGRAMFILES, xrefs: 010C08ED
ProgramFiles, xrefs: 010C0810, 010C0825, 010C082D
AI_BOOTSTRAPPERLANGS, xrefs: 010C09E2, 010C0A2A
APPDATA, xrefs: 010C0907, 010C090F
ProgramFilesFolder, xrefs: 010C0797
Shell32.dll, xrefs: 010C0753

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Library$AddressEnvironmentFreeLoadProcVariable
String ID: AI_BOOTSTRAPPERLANGS$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFilesFolder$Shell32.dll$Shlwapi.dll
API String ID: 788177547-1020860216
Opcode ID: 7dc5fc6ac482058ee82427b5f03acea14b9b35398fe3c75645be0667b53432b6
Instruction ID: 6597f5ae2554456e28d0e323c3191384d83b2a6a943170093fe7321402da07f3
Opcode Fuzzy Hash: 7dc5fc6ac482058ee82427b5f03acea14b9b35398fe3c75645be0667b53432b6
Instruction Fuzzy Hash: 83911779A00205DBEB289F68D8487EEB3E5FF50B14F0086ADE986D7299D731D944CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5050 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0125957C,8C278AEA,00000000,?,?,?,?,?,?,00FA487E,0116F9CD,000000FF), ref: 00FA508D
LoadCursorW.USER32(00000000,00007F00), ref: 00FA5108
LoadCursorW.USER32(00000000,00007F00), ref: 00FA51AE
LeaveCriticalSection.KERNEL32(0125957C), ref: 00FA5203

Strings

v, xrefs: 00FA5203
AtlAxWin140, xrefs: 00FA50BF, 00FA5123
WM_ATLGETCONTROL, xrefs: 00FA50A4
WM_ATLGETHOST, xrefs: 00FA5099
AtlAxWinLic140, xrefs: 00FA516F, 00FA51C5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: v$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-4127849342
Opcode ID: 7ef87bd07037344ca84656633e5c42ae5f99b1fe930a54fc5ef7af5919c8b821
Instruction ID: 95011f45e72732043b581310738dbadc7eff76a0bd558a947beb1c7e83fc2229
Opcode Fuzzy Hash: 7ef87bd07037344ca84656633e5c42ae5f99b1fe930a54fc5ef7af5919c8b821
Instruction Fuzzy Hash: B95107B1D503199FDB51CFA4E8887EEBBF8BB09718F50411AE804B7280DBB55A05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 010ED8D0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,010D098B,?,?,?,?,?), ref: 010ED8E5

Strings

GetTotalFilesSize, xrefs: 010ED925
InitExtraction, xrefs: 010ED91D
ExtractAllFiles, xrefs: 010ED937
EndExtraction, xrefs: 010ED949

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LibraryLoad
String ID: EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-3462492388
Opcode ID: f8b1889717639c65153f08f9c49dd525041ba5fc0fda17a8c25d350d735dfa4c
Instruction ID: 14a3423019111363c90903831b2be5bd71c9718b0f87f79b0dc7e6044cb30853
Opcode Fuzzy Hash: f8b1889717639c65153f08f9c49dd525041ba5fc0fda17a8c25d350d735dfa4c
Instruction Fuzzy Hash: C2017C79900365DFCF78AF66F88C9657FB2F71831A300916EE94543248D7348891DF80

Uniqueness

Uniqueness Score: -1.00%

Function 010E9380 Relevance: 15.3, APIs: 10, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbbd5b59468f23e8a39118f48e668bc377c992e65f623406b1669c570f60fe2
Instruction ID: 67e3af7ac0885f30c9c20d3269ae8ab2f1a9c7c660cc403789a62db9df2e0f22
Opcode Fuzzy Hash: 3dbbd5b59468f23e8a39118f48e668bc377c992e65f623406b1669c570f60fe2
Instruction Fuzzy Hash: 9FA11771640205AFEB21AF69EC88FAEBBE4FF44718F1041A9FD459B291DB75D900CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FA32F0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FA3335
SysAllocString.OLEAUT32(?), ref: 00FA3349
VariantInit.OLEAUT32(?), ref: 00FA3384
VariantClear.OLEAUT32(?), ref: 00FA33DA
VariantClear.OLEAUT32(?), ref: 00FA33E4
VariantClear.OLEAUT32(?), ref: 00FA33EE
VariantClear.OLEAUT32(?), ref: 00FA33FB

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Strings

<body><h3 style="color:green;">Error loading resource:</h3><p style="white-space:nowrap">"%s"</p></body>, xrefs: 00FA347B

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Variant$Clear$AllocAllocateHeapInitString
String ID: <body><h3 style="color:green;">Error loading resource:</h3><p style="white-space:nowrap">"%s"</p></body>
API String ID: 1547307772-1571955069
Opcode ID: 0fe0251f502d673207adc05731594d2169fdefd3fdae2706de82c5b061cd66ee
Instruction ID: 8945f3bd041e79e838b350b0bdcd53fd7fb86810acca79dde97da2b6e0b5537f
Opcode Fuzzy Hash: 0fe0251f502d673207adc05731594d2169fdefd3fdae2706de82c5b061cd66ee
Instruction Fuzzy Hash: 0D916CB1D04249DFDB14DFA8D948BEEBBB8FF49324F148259E415E7290D774AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010E3EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,010C30A8), ref: 010E3FE3
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 010E4027
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 010E4044
CloseHandle.KERNEL32(00000000), ref: 010E405E
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 010E409D

Strings

Unable to save script file , xrefs: 010E406D
Unable to get temp file , xrefs: 010E3FC4
ps1, xrefs: 010E3F59, 010E3F6B, 010E3F75, 010E3F86

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: 72f012ffeb32ff85a458b44a9fa14a37f6d63ea0a007cfeb9ce57d01e332318e
Instruction ID: 07b67638a008d9a6047a1e1aa8c5427f78e504892e79de39180f42eb6cfacf3b
Opcode Fuzzy Hash: 72f012ffeb32ff85a458b44a9fa14a37f6d63ea0a007cfeb9ce57d01e332318e
Instruction Fuzzy Hash: 1351D470A00649AFEB14CBA9CD49BEEBFF8AF05714F148198F950EB2C1D7759904CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 010D2DC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 010D2DFC
GetUserDefaultLangID.KERNEL32 ref: 010D2E09
LoadLibraryW.KERNEL32(kernel32.dll), ref: 010D2E1B
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 010D2E2F
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 010D2E44

Strings

GetSystemDefaultUILanguage, xrefs: 010D2E29
GetUserDefaultUILanguage, xrefs: 010D2E3E
kernel32.dll, xrefs: 010D2E12

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 245dcdcab58e9ebdc1c9f7541b682958ed9ef4a5b589dfafe315f72efbc26cde
Instruction ID: 5bab1d30eb93c4d6b3dc94a9b97ed7275b18c1a4ddf7a21c0b2eadb4e6f4d1e0
Opcode Fuzzy Hash: 245dcdcab58e9ebdc1c9f7541b682958ed9ef4a5b589dfafe315f72efbc26cde
Instruction Fuzzy Hash: 1D419E306083419FCB98EF28D4547BAB7E1AF98315F91086EF8C9C7241EB31D985CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01148400 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 01148437
___except_validate_context_record.LIBVCRUNTIME ref: 0114843F
_ValidateLocalCookies.LIBCMT ref: 011484C8
__IsNonwritableInCurrentImage.LIBCMT ref: 011484F3
_ValidateLocalCookies.LIBCMT ref: 01148548
___vcrt_initialize_locks.LIBVCRUNTIME ref: 0114855E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 01148573

Strings

csm, xrefs: 011484DD

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: f55f9171345388cb6dde1b72d9f33c060789d8ff0b9204ea5b5ddcea3ef026a6
Instruction ID: 207e5c40b30f7e0a1b44cbb5238832f36d7aad8c53d5cc97f088281bd2f75cef
Opcode Fuzzy Hash: f55f9171345388cb6dde1b72d9f33c060789d8ff0b9204ea5b5ddcea3ef026a6
Instruction Fuzzy Hash: 3E41E434A002499FCF18EFA8C880BAEBFB4AF45B2CF048059E9189B356D731D915CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01092AF0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 248fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000), ref: 01092BDF
CloseHandle.KERNEL32(00000000), ref: 01092C07
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 01092C49
CloseHandle.KERNEL32(?), ref: 01092C9E

Strings

EXE, xrefs: 01092B43
.bat, xrefs: 01092B3E
open, xrefs: 01092CC8

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID: .bat$EXE$open
API String ID: 3602564925-2898749727
Opcode ID: 0bcdd15a8de4829a75faef883a23ab35a74cf3fea16ccba7891807fb0e735498
Instruction ID: 164bc7c05591c5c3a8b4ab64eb2c9f0aa05ad0c281d44ccbfa18fcb077aa31e3
Opcode Fuzzy Hash: 0bcdd15a8de4829a75faef883a23ab35a74cf3fea16ccba7891807fb0e735498
Instruction Fuzzy Hash: 19A1C970902648EFEB14DFA8CD48B9EBBF4FF45314F2482A9E455AB291DB749904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA8680 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,8C278AEA,?,?,00000000,?), ref: 00FA86BE
GetCurrentThreadId.KERNEL32 ref: 00FA86FF
EnterCriticalSection.KERNEL32(0125957C), ref: 00FA871F
LeaveCriticalSection.KERNEL32(0125957C), ref: 00FA8743
CreateWindowExW.USER32(00000000,00000000,00000000,0125957C,?,80000000,00000000,80000000,00000000,00000000,00000000), ref: 00FA879E

Part of subcall function 01144245: GetProcessHeap.KERNEL32(00000008,00000008,00000000,010D35FE,?,?,?,?,?,?), ref: 0114424A
Part of subcall function 01144245: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?), ref: 01144251

Strings

AXWIN UI Window, xrefs: 00FA8815
v, xrefs: 00FA8743

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateCurrentEnterErrorLastLeaveProcessThreadWindow
String ID: v$AXWIN UI Window
API String ID: 213679520-2690018532
Opcode ID: 60f603ebfc695ff23a2f53d2616c0a378bc59bc104fd8d5615c30c1c3b140d11
Instruction ID: 68747eca88f4f1e07a4d21664d7c3b1c7bd461b67dee828b60554d5f0f25723d
Opcode Fuzzy Hash: 60f603ebfc695ff23a2f53d2616c0a378bc59bc104fd8d5615c30c1c3b140d11
Instruction Fuzzy Hash: 8651B271A00305AFDB20CF55ED44B9ABBF8FB49B64F104129FD15A7380D7B1A811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FAC6D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00FAC7BF

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?,8C278AEC), ref: 00FAC813
CloseHandle.KERNEL32(00000000), ref: 00FAC870

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 00FAC8D4
CloseHandle.KERNEL32(00000000,753CE610), ref: 00FAC8FA

Strings

aix, xrefs: 00FAC7D1
html, xrefs: 00FAC7CC

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html
API String ID: 2030708724-2369804267
Opcode ID: e4226c8501839aeee9cae3bf612dacaf8af82af9cd964c0770b6f831e0afdb79
Instruction ID: d95aa22bb058cb215821dee82760c723ceff70c3126bd5637a327f6f4349d95e
Opcode Fuzzy Hash: e4226c8501839aeee9cae3bf612dacaf8af82af9cd964c0770b6f831e0afdb79
Instruction Fuzzy Hash: 56617AB0900348DFEF28CFA4E998B9EBBB4BB1571CF10415DE401AB684D7B96948CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D970 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 139COMMON

Download Yara Rule

Strings

RoGetActivationFactory, xrefs: 00F9D603
CoIncrementMTAUsage, xrefs: 00F9D639
DllGetActivationFactory, xrefs: 00F9D7C2
combase.dll, xrefs: 00F9D608, 00F9D63E
Windows.Foundation.Uri, xrefs: 00F9DA3A
.dll, xrefs: 00F9D766

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID:
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$Windows.Foundation.Uri$combase.dll
API String ID: 0-3956872289
Opcode ID: 32978f79d8c9a7d61508651175caa308f6551cb7899dca89627c93e6befbde3f
Instruction ID: 40317aeeef14aa18422bb662927651dffe566260597ad896d76c0833be6ef6ee
Opcode Fuzzy Hash: 32978f79d8c9a7d61508651175caa308f6551cb7899dca89627c93e6befbde3f
Instruction Fuzzy Hash: 19518D71D01219DFDF04DF95C945BAEBBB4FB05714F20452AE911A7380CBB96A04DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F92860 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(01259358,00000000,8C278AEA,00000000,011A84A3,000000FF,?,8C278AEA), ref: 00F929D3
GetLastError.KERNEL32(?,8C278AEA), ref: 00F929DD

Strings

VolumeCostSize, xrefs: 00F92897
VolumeCostRequired, xrefs: 00F928A9
VolumeCostVolume, xrefs: 00F9288D, 00F92945
VolumeCostDifference, xrefs: 00F928B3
VolumeCostAvailable, xrefs: 00F928A0

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: 6cedeb8f20b4ef4f14b92b1c8b52da72477a97b836c81a5e28c616dd405fef8b
Instruction ID: 7c9f26e4cecaf48df78891bbc4499231d1ca4f6cc48552ca9c780f266135713f
Opcode Fuzzy Hash: 6cedeb8f20b4ef4f14b92b1c8b52da72477a97b836c81a5e28c616dd405fef8b
Instruction Fuzzy Hash: CF51BFB1D00709EBDF28CFA5E94979EBBF4FB04728F104229D815A7280E7799A44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 010F0940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?), ref: 010F0950
LoadLibraryW.KERNEL32(Shell32.dll), ref: 010F0963
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 010F0973
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 010F09FC
SHGetMalloc.SHELL32(?), ref: 010F0A3E

Strings

SHGetSpecialFolderPathW, xrefs: 010F096D
Shell32.dll, xrefs: 010F095E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressFolderFromLibraryListLoadLocationMallocPathProcSpecial
String ID: SHGetSpecialFolderPathW$Shell32.dll
API String ID: 2352187698-2988203397
Opcode ID: bb5e877feefd4b13a56c0489b6a721ac8537e9ae892f4d2938c89dffa378803a
Instruction ID: 27de4b9916e8ee4f97de8affb220334789eac87524cc364a9e72ee4e59a6a7ef
Opcode Fuzzy Hash: bb5e877feefd4b13a56c0489b6a721ac8537e9ae892f4d2938c89dffa378803a
Instruction Fuzzy Hash: 7731F271A007029BFB259F18D84AB2B7BF6AF84710F44846CFAC587589FBB19485CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0108A4D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0108A560

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

GetProcAddress.KERNEL32(SetWindowTheme), ref: 0108A59D
__Init_thread_footer.LIBCMT ref: 0108A5B4
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 0108A5DF

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

Part of subcall function 01067A10: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 01067A51

Strings

explorer, xrefs: 0108A5C7
SetWindowTheme, xrefs: 0108A592
UxTheme.dll, xrefs: 0108A531

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3410024541-3123591815
Opcode ID: 1e396aae0e9b8c684a0972f81706b1e86171232229a1fae06fc752b6bdfa2bd5
Instruction ID: 8cafc524777b3eeeb6442f506a3d4ce74e44185650cb1fa787467f4962e34056
Opcode Fuzzy Hash: 1e396aae0e9b8c684a0972f81706b1e86171232229a1fae06fc752b6bdfa2bd5
Instruction Fuzzy Hash: 8021F670B44701EFDB24EF59E88DB9977E4E710B28F100619E960A3B84D774A980CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010B6800 Relevance: 12.2, APIs: 8, Instructions: 155COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 010B6811
EndDialog.USER32(?,00000000), ref: 010B68E9

Part of subcall function 010B6210: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 010B6242
Part of subcall function 010B6210: GetWindowLongW.USER32(?,000000F0), ref: 010B6248
Part of subcall function 010B6210: GetDlgItem.USER32(?,?), ref: 010B62BA
Part of subcall function 010B6210: GetWindowRect.USER32(00000000,?), ref: 010B62D2

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Long$DialogItemMessageRectSend
String ID:
API String ID: 188208873-0
Opcode ID: da70eb1639392fb55a130b4ae27c095339ab30e6d3a53c05c09c8998d2d7ae23
Instruction ID: a0d6d8e4769475113bb5ca06024b11ae8953c23358084d6d2325f1bdbc258832
Opcode Fuzzy Hash: da70eb1639392fb55a130b4ae27c095339ab30e6d3a53c05c09c8998d2d7ae23
Instruction Fuzzy Hash: 8A4103323402145BDB349E6CAC88BFB3BDCDB85331F00076AFEA2C76D0C663981196A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAF720 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FAF74A
GetWindow.USER32(?,00000005), ref: 00FAF757
GetWindow.USER32(00000000,00000002), ref: 00FAF892

Part of subcall function 00FAF5A0: GetWindowRect.USER32(?,?), ref: 00FAF5CC
Part of subcall function 00FAF5A0: GetWindowRect.USER32(?,?), ref: 00FAF5DC

GetWindowRect.USER32(?,?), ref: 00FAF7EB
GetWindowRect.USER32(00000000,?), ref: 00FAF7FB
GetWindowRect.USER32(00000000,?), ref: 00FAF815

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: 898322a9217ea142705acab94d68d3b9173b6298c456f4df672f53cdbd2bbeee
Instruction ID: 60ead627702c114ff21a2cdc36a0d9afcbb43d0510f204bf13f39fa2a3267b10
Opcode Fuzzy Hash: 898322a9217ea142705acab94d68d3b9173b6298c456f4df672f53cdbd2bbeee
Instruction Fuzzy Hash: BD41AC719047009FC321DF68C980A6BF7E9BF9A744F504A2DF4869B521EB34F988CB52

Uniqueness

Uniqueness Score: -1.00%

Function 011440E3 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144107
HeapAlloc.KERNEL32(00000000,?,0114428D,?,?,?,?,?,?,?), ref: 0114410E

Part of subcall function 011441D9: IsProcessorFeaturePresent.KERNEL32(0000000C,011440F5,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 011441DB

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 0114411E
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,0114428D,?,?,?,?,?,?,?), ref: 01144145
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,0114428D,?,?,?,?,?,?,?), ref: 01144159
InterlockedPopEntrySList.KERNEL32(00000000,?,0114428D,?,?,?,?,?,?,?), ref: 0114416C
VirtualFree.KERNEL32(00000000,00000000,00008000,?,0114428D,?,?,?,?,?,?,?), ref: 0114417F

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 731211d00b8c6ca742a6e258937fc2ce49fda00125b69c530fdb8f6cc070f0cd
Instruction ID: 67be2c43d8e205b8b54fb320f1f8891681fa58ccd7d95de7a8617da22d5b29f5
Opcode Fuzzy Hash: 731211d00b8c6ca742a6e258937fc2ce49fda00125b69c530fdb8f6cc070f0cd
Instruction Fuzzy Hash: 3011E771B41615BFF3395B68AC48F6A3AADFB54F99F150030FA51E6648DB20EC4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5820 Relevance: 10.9, APIs: 7, Instructions: 431memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

CreateThread.KERNEL32(00000000,00000000,00FD5970,011D8DD8,00000000,?), ref: 00FD58EA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00FD5903
CloseHandle.KERNEL32(00000000), ref: 00FD5919
GetProcessHeap.KERNEL32(?,00000000), ref: 00FD5ACB
HeapFree.KERNEL32(00000000,?,00000000), ref: 00FD5AD1
GetProcessHeap.KERNEL32(?,00000000), ref: 00FD5B4A
HeapFree.KERNEL32(00000000,?,00000000), ref: 00FD5B50

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseCreateHandleObjectSingleThreadWait
String ID:
API String ID: 351222376-0
Opcode ID: 24c3d86281177d8052369426ff2da7818b7619a598e0bf051085fc92c8c79311
Instruction ID: 7d164d02bd2023baf7b5ea3bdbc22068dbe44ef311bcac468cf14c8e8bdb89c9
Opcode Fuzzy Hash: 24c3d86281177d8052369426ff2da7818b7619a598e0bf051085fc92c8c79311
Instruction Fuzzy Hash: B7028DB0D00249DFDB14DFA8C944BEEBBB9FF44714F24815AE415AB381DB74AA44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010AEA80 Relevance: 10.9, APIs: 7, Instructions: 413fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,8C278AEA), ref: 010AEBC9
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 010AEC3B
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,00000000,00000000), ref: 010AEEDC
CloseHandle.KERNEL32(?), ref: 010AEF3A

Part of subcall function 010AEA80: LoadStringW.USER32(000000A1,?,00000514,8C278AEA), ref: 010AE9E6

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$Init_thread_footerRead$CloseCreateHandleHeapLoadProcessString
String ID:
API String ID: 1714711150-0
Opcode ID: 04f3a30419d9fdecdae7ac8efc493eea6dbf99491d8410f007b3a652377bd4e0
Instruction ID: 4d314c6d7ca7738084e6cd47b86bda627c245f460cb0ee1c783e91ef661a7d67
Opcode Fuzzy Hash: 04f3a30419d9fdecdae7ac8efc493eea6dbf99491d8410f007b3a652377bd4e0
Instruction Fuzzy Hash: 54F1BD71E00318DBEB24CFA8C848BAEBBF5FF45314F64825DE555AB281D774AA44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010DEAB0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 319synchronizationfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,?,?), ref: 010DEDBA

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

ResetEvent.KERNEL32(00000000,8C278AEA,?,?,00000000,011B614D,000000FF,?,80004005), ref: 010DEE4F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,011B614D,000000FF,?,80004005), ref: 010DEE6F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,011B614D,000000FF,?,80004005), ref: 010DEE7A

Strings

tin9999.tmp, xrefs: 010DEC09
TEST, xrefs: 010DEC02

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: HeapInit_thread_footerObjectSingleWait$AllocateDeleteEventFileFindProcessResetResource
String ID: TEST$tin9999.tmp
API String ID: 3248508590-3424081289
Opcode ID: b8d3ca3f649bd296f9a6b9c59b920c28072f51f6b4e5765fa0297a3f9bd19c03
Instruction ID: deaefc222f35409197fc870d4681571e39c88b853178789fe358df8975fa1303
Opcode Fuzzy Hash: b8d3ca3f649bd296f9a6b9c59b920c28072f51f6b4e5765fa0297a3f9bd19c03
Instruction Fuzzy Hash: 03C1C271905649DFDB14DF68CD48BAEBBF4EF04320F1486ADE856AB280DB74AA04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FAC940 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,8C278AEA), ref: 00FAC9CE
GetLastError.KERNEL32 ref: 00FAC9ED
RegCloseKey.ADVAPI32(?,011D446C,00000000,011D446C,00000000,00000000,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 00FACC7D
CloseHandle.KERNEL32(00000005,8C278AEA,?,?,00000000,01170F5D,000000FF,?,011D446C,00000000,011D446C,00000000,00000000,80000001,00000001,00000000), ref: 00FACD0E

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00FACA35
Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00FAC9C3

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Close$CreateErrorEventHandleLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1253123496-2079760225
Opcode ID: 3583b31ded7a7edf5c460dac6f5be72b3622751a60309450bd3040de8567441c
Instruction ID: ddb7a8bd45da5cfd7e8baaa62fa1c9a80ab9fc99950e9636a496219f6313f034
Opcode Fuzzy Hash: 3583b31ded7a7edf5c460dac6f5be72b3622751a60309450bd3040de8567441c
Instruction Fuzzy Hash: 46C1ADB0E10348DFDB14CFA8C988BAEBBB4FF45714F24425DE459A7680D7786A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAAAC0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(01259338,8C278AEA,?,?,?,?,?,?,?,?,?,?,?,?,00000000,01170855), ref: 00FAAB2A
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,01170855), ref: 00FAABAA
EnterCriticalSection.KERNEL32(01259354,?,?,?,?,?,?,?,?,?,?,?,00000000,01170855,000000FF), ref: 00FAAD63
LeaveCriticalSection.KERNEL32(01259354,?,?,?,?,?,?,?,?,?,?,00000000,01170855,000000FF), ref: 00FAAD84

Strings

v, xrefs: 00FAAD7D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 28130a8ad9c0a8bd06de08363464216845e5f9d184fdd7637333d697c4a39a80
Instruction ID: 274d1950f8ada05026f87e0309919bd3327d1ecae413621c66238e62e13f7e42
Opcode Fuzzy Hash: 28130a8ad9c0a8bd06de08363464216845e5f9d184fdd7637333d697c4a39a80
Instruction Fuzzy Hash: 95B181B0E00349DFDB21CFA4D888BAEBBB4BF49314F144199E845AB281D775AD48DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F710 Relevance: 10.7, APIs: 7, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00F9F804
SysFreeString.OLEAUT32(00000000), ref: 00F9F879
GetProcessHeap.KERNEL32(?,?), ref: 00F9F8E9
HeapFree.KERNEL32(00000000,?,?), ref: 00F9F8EF
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000,00000000,8C278AEA,011EB768,00000000), ref: 00F9F91C
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,8C278AEA,011EB768,00000000), ref: 00F9F922
SysFreeString.OLEAUT32(00000000), ref: 00F9F93A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: a2669711a94edc704d3c338c6df4123becbe0bccc25d77f746114dc5d7285442
Instruction ID: d67851ffa5343602b46c4f21d66c2f6df9f691f9d1c7eaa72abea45276b9caec
Opcode Fuzzy Hash: a2669711a94edc704d3c338c6df4123becbe0bccc25d77f746114dc5d7285442
Instruction Fuzzy Hash: E0814F70D0025ADFEF14DFA8C844BEEBBB4BF15724F244569E414E7281D778AA08DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010AADE0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,011A8D5D,000000FF,?,010AB0F6,?), ref: 010AAE83

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

RemoveDirectoryW.KERNEL32(?,8C278AEA,?,?,?,?,011A8D5D,000000FF,?,010AB0F6,?,00000000), ref: 010AAEB2
GetLastError.KERNEL32(?,8C278AEA,?,?,?,?,011A8D5D,000000FF,?,010AB0F6,?,00000000), ref: 010AAEC2
DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,011A8D5D,000000FF,?,80004005,8C278AEA,?), ref: 010AAF93
GetLastError.KERNEL32(?,?,?,00000000,011A8D5D,000000FF,?,80004005,8C278AEA,?,?,?,?,011A8D5D,000000FF), ref: 010AAFD2

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Strings

\\?\, xrefs: 010AAE44, 010AAE56, 010AAE60, 010AAF54, 010AAF66, 010AAF70

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DirectoryErrorInit_thread_footerLastRemove$DeleteFileFindHeapProcessResource
String ID: \\?\
API String ID: 34920479-4282027825
Opcode ID: e95715159e7cb0d2b290d80edaf3410c25be06112829ff919c055e65884ece2e
Instruction ID: 1846469b1713e6a461853e0f593a5a107ab0cba2d26dbd905efc6c41f18b9914
Opcode Fuzzy Hash: e95715159e7cb0d2b290d80edaf3410c25be06112829ff919c055e65884ece2e
Instruction Fuzzy Hash: A451AF71A01615DFDB18DFA8C848BAEB7E8EF05321F504A9AE9A1D72D0DB759900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA8120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0125957C,8C278AEA,00000000,01259598), ref: 00FA8193
LeaveCriticalSection.KERNEL32(0125957C), ref: 00FA81F8
LoadCursorW.USER32(00F90000,?), ref: 00FA8254
LeaveCriticalSection.KERNEL32(0125957C), ref: 00FA82EB

Strings

ATL:%p, xrefs: 00FA8274
v, xrefs: 00FA81F8, 00FA82EB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: v$ATL:%p
API String ID: 2080323225-109518622
Opcode ID: 6158ca28a0c4abdc259bcf0f3d52a17ed7e5e508da57b8b4ea9c811d17500dc8
Instruction ID: ca0c69402b013941f7e00cf5c9b9b120b93a64b2da196c166b2a0c75473e5ba1
Opcode Fuzzy Hash: 6158ca28a0c4abdc259bcf0f3d52a17ed7e5e508da57b8b4ea9c811d17500dc8
Instruction Fuzzy Hash: 53518CB1D04B449BDB21CF69D9457AABBF4FF19764F00461DE896A3640EB70A980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3970 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 00FC39E5
lstrcpynW.KERNEL32(?,?,00000020), ref: 00FC3A5B
MulDiv.KERNEL32(?,00000048,00000000), ref: 00FC3A98
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 00FC3ACA

Strings

t, xrefs: 00FC3AA6
?, xrefs: 00FC3A9E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$lstrcpyn
String ID: ?$t
API String ID: 3928028829-1995845436
Opcode ID: 8dd43aedadde88d179f0823a72e852279aba598b55eea5940aedd55b1b503101
Instruction ID: 39fb58a89e743a5289522afbfcfc4ed351bb5a551f756e4787460b825f148692
Opcode Fuzzy Hash: 8dd43aedadde88d179f0823a72e852279aba598b55eea5940aedd55b1b503101
Instruction Fuzzy Hash: 23515F71A04341AFE730DF64D94AF9BBBE8EB88705F00491DF699D6181D774E508CB52

Uniqueness

Uniqueness Score: -1.00%

Function 010AC720 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,8C278AEA,00000010), ref: 010AC767
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,8C278AEA,011AC52D), ref: 010AC7DF
GetLastError.KERNEL32 ref: 010AC7F0
WaitForSingleObject.KERNEL32(011AC52D,000000FF), ref: 010AC80C
GetExitCodeProcess.KERNEL32(011AC52D,00000000), ref: 010AC81D
CloseHandle.KERNEL32(011AC52D), ref: 010AC827
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 010AC842

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: 1b3321cc9191e2c6a171aca9f10c45b11bd3d74cb4549a69a444da41d45dfb79
Instruction ID: 09e44c3c1e7b720d9f35aa550571e02da20539e01cf1b1e4280f3c32808f03f7
Opcode Fuzzy Hash: 1b3321cc9191e2c6a171aca9f10c45b11bd3d74cb4549a69a444da41d45dfb79
Instruction Fuzzy Hash: 04416F71E04389AFEB14CFA9C9087EEBBF8BF49314F144269E865A7184D7749940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010B5290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,010C0731,?,8C278AEA,?,?), ref: 010B52AB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 010B52C1
FreeLibrary.KERNEL32(00000000), ref: 010B52FA
FreeLibrary.KERNEL32(00000000,?,?,?,?,010C0731,?,8C278AEA,?,?), ref: 010B5316

Strings

Shlwapi.dll, xrefs: 010B52AA
DllGetVersion, xrefs: 010B52BB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 065bb92d5ba056543fcd7173f517cb25edb44065b83e01662b272dbd9ff196b2
Instruction ID: 1a6344a7b85358db96dc81116ec8aff4f167834351663fe6febaf64d7bd2cc32
Opcode Fuzzy Hash: 065bb92d5ba056543fcd7173f517cb25edb44065b83e01662b272dbd9ff196b2
Instruction Fuzzy Hash: 3321D4766003058BD314AF29E8846AFB7E4BFEDA04F8009ADF585C3300FB71D84487A2

Uniqueness

Uniqueness Score: -1.00%

Function 0115E202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0115E30F,?,?,?,00000000,00000000,?,0115E579,00000021,FlsSetValue,011CE06C,011CE074,?), ref: 0115E2C3

Strings

api-ms-, xrefs: 0115E259
ext-ms-, xrefs: 0115E26D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2991ef1415898f2a092113abb37764776f0408d5101e3a12228d12125ff387eb
Instruction ID: cee6f5be863a0c91cde6a36f03624b401016fe0e47bb885158226b0e3cdc4438
Opcode Fuzzy Hash: 2991ef1415898f2a092113abb37764776f0408d5101e3a12228d12125ff387eb
Instruction Fuzzy Hash: 22213D32E02215EFDB7E9B69EC45A5ABB699B417E4F110120ED35A7288D770EF00C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0114191C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,01141997,011418FA,01141B9B), ref: 01141933
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 01141949
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0114195E

Strings

AcquireSRWLockExclusive, xrefs: 01141943
KERNEL32.DLL, xrefs: 0114192E
ReleaseSRWLockExclusive, xrefs: 01141953

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: d15ee01ebe5ce263f57d3f0e6c4a8a491ea0cde439d2be5754b081abb78663cd
Instruction ID: eeb73e8e665fe4f2bfb18f8898d4cd893395df9ebb7917c5ffd9eeef9d17d106
Opcode Fuzzy Hash: d15ee01ebe5ce263f57d3f0e6c4a8a491ea0cde439d2be5754b081abb78663cd
Instruction Fuzzy Hash: 8FF0AF296A1226FB5F3D5DA8D8C567ABADE5B05E58309003EDD42D3504F720A5C1CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC64D0 Relevance: 9.2, APIs: 6, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00FC6537
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00FC655F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FC6577
SendMessageW.USER32(?,0000130A,00000000,?), ref: 00FC65A8
GetParent.USER32(?), ref: 00FC6684
SendMessageW.USER32(00000000,00000136,?,?), ref: 00FC6695

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$Parent
String ID:
API String ID: 1020955656-0
Opcode ID: 3af9d01e9cb2433b09c3e50d24fe3fb5343be71e6040b81f5657750672ac2c7a
Instruction ID: 1b70593ee8b6e6f1a452791b59ace358bf6391edaffa9eda66fabe9b58c76f5d
Opcode Fuzzy Hash: 3af9d01e9cb2433b09c3e50d24fe3fb5343be71e6040b81f5657750672ac2c7a
Instruction Fuzzy Hash: 81610772940318AFDB229FE4DD49FAEBBB9FF08710F540119FA19AB294D7706911CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010B6210 Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 010B6242
GetWindowLongW.USER32(?,000000F0), ref: 010B6248
GetDlgItem.USER32(?,?), ref: 010B62BA
GetWindowRect.USER32(00000000,?), ref: 010B62D2
SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 010B635F
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 010B6393

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$MessageSend$ItemLongRect
String ID:
API String ID: 3432912040-0
Opcode ID: 16d4fcddda63fc44bf9cab0a73e36277b6a9d43b1ba7e67a081a8d04abe5e500
Instruction ID: c65dc831b95903e788510a4676229ea96e160639ff4bdf000810688b69c2c6b1
Opcode Fuzzy Hash: 16d4fcddda63fc44bf9cab0a73e36277b6a9d43b1ba7e67a081a8d04abe5e500
Instruction Fuzzy Hash: 8F514A302043019FE724CF28D9C9B6ABBE1FF84B04F548A5DFA859B295DB72E844CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0108A2A0 Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 0108A30B
GetParent.USER32(00000000), ref: 0108A35E
GetWindowRect.USER32(00000000), ref: 0108A361
GetParent.USER32(00000000), ref: 0108A370

Part of subcall function 010439A0: GetWindowRect.USER32(?,?), ref: 01043A32
Part of subcall function 010439A0: GetWindowRect.USER32(?,?), ref: 01043A4A

SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 0108A460
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 0108A473

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageRectSendWindow$Parent
String ID:
API String ID: 425339167-0
Opcode ID: 38fc9fcaab09d84db1757be95403981ffae818eb13ea3679a4630549bc76377b
Instruction ID: 1377a32ad84d20187d877585fdb1a5c17525ca42e2638556b418c597a1826f2a
Opcode Fuzzy Hash: 38fc9fcaab09d84db1757be95403981ffae818eb13ea3679a4630549bc76377b
Instruction Fuzzy Hash: A8514C71D00748AFDB21DFA8D949BDEBBF8EF59710F14435AE805A7291E7706980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FCDCC0 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FCDD0A
std::_Lockit::_Lockit.LIBCPMT ref: 00FCDD2C
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCDD54
__Getctype.LIBCPMT ref: 00FCDE35
std::_Facet_Register.LIBCPMT ref: 00FCDE97
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCDEC1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: dba289a5073400cbf0ed8bd33f188c1add5fa9eb2fbe3104e92fe487e70f8025
Instruction ID: c21e0b2ddeeec5c62e5d1bf71b3c505f9ac494c23ec7b7168df38d0925df7493
Opcode Fuzzy Hash: dba289a5073400cbf0ed8bd33f188c1add5fa9eb2fbe3104e92fe487e70f8025
Instruction Fuzzy Hash: 6761BFB1D0074ACFDB14CF58D945B9EBBF0AF24714F14829DD845AB341E734AA84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FCDAC0 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FCDAFD
std::_Lockit::_Lockit.LIBCPMT ref: 00FCDB1F
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCDB47
__Getcoll.LIBCPMT ref: 00FCDC11
std::_Facet_Register.LIBCPMT ref: 00FCDC56
std::_Lockit::~_Lockit.LIBCPMT ref: 00FCDC8E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 19199762a7db182dc780336827a55bdfc1888874f958e990f88950927a8ae5e1
Instruction ID: 5050d4f0bd80e198ca381b17e3f16f483c7d145dcfaac37b17b4ef7de775b986
Opcode Fuzzy Hash: 19199762a7db182dc780336827a55bdfc1888874f958e990f88950927a8ae5e1
Instruction Fuzzy Hash: B651A8B0C01209DFDB15CF98EA81B9DBBB0FF54328F24416EE815AB280D774AA45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010B63D0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 327COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 010B66BB

Strings

Details >>, xrefs: 010B6641
Copy, xrefs: 010B66A2
Send Error Report, xrefs: 010B661D
Close, xrefs: 010B65D4

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: 10a5698262d2f726fc774537045e62761d84aa4592aacb4e98190d97397ad4e3
Instruction ID: 2a7aabf1d365863f882765171e487b518ecb9271620cf9a216fccd09a48b7e41
Opcode Fuzzy Hash: 10a5698262d2f726fc774537045e62761d84aa4592aacb4e98190d97397ad4e3
Instruction Fuzzy Hash: 86C19E70A41605EBEB14CF68CC95BEEB7B5BF54710F104269F551BB2C0EBB1A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01146303 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,011462FA,011462C6,?,?,00FCAEBD,010A9A40,?,00000008), ref: 01146311
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0114631F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01146338
SetLastError.KERNEL32(00000000,011462FA,011462C6,?,?,00FCAEBD,010A9A40,?,00000008), ref: 0114638A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 13d7b039324152123ccf017c65d10008df1c29bdef37b30f314ea48cd11dd47d
Instruction ID: 2bfb5bc3088661e53ef159b96567317f2f9532b5ab61ff5af4a1eef4a5025c09
Opcode Fuzzy Hash: 13d7b039324152123ccf017c65d10008df1c29bdef37b30f314ea48cd11dd47d
Instruction Fuzzy Hash: B701FC3220D7565FA73D16B8BCC96972B98EB06EBC720033EF924550D8EF654C10D690

Uniqueness

Uniqueness Score: -1.00%

Function 00F987E0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00F988C5
__Init_thread_footer.LIBCMT ref: 00F9893F

Strings

<a href=", xrefs: 00F98887
<a>, xrefs: 00F98AF1
</a>, xrefs: 00F98A49

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 7da1aec38fe1c9fb3a724c2d6b7f75d516fa98a4f89d19d6d97663bdf78e084c
Instruction ID: 975ac1d3291c1262911265d6d6ad919726b876b4ec809fbc46b85108a0464fe0
Opcode Fuzzy Hash: 7da1aec38fe1c9fb3a724c2d6b7f75d516fa98a4f89d19d6d97663bdf78e084c
Instruction Fuzzy Hash: FCA1D370A10305DFDF18DF64E898BADB7B1FF45328F104219E425AB390EB74A985DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC62C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 00FC63BD
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00FC63D2
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00FC63DA

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Part of subcall function 00FC8190: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FC81D8

Strings

TabHost, xrefs: 00FC6349, 00FC635B, 00FC6365
SysTabControl32, xrefs: 00FC63B5

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 2359350451-2872506973
Opcode ID: 637360fc3a3b23fa5d9029a206d67a2074a7c28324057fdf9bd47e83d1f60b49
Instruction ID: a49108e37d9f1a42a53b20f481a8e9a386c9c39da98e7c16947befb795d119cb
Opcode Fuzzy Hash: 637360fc3a3b23fa5d9029a206d67a2074a7c28324057fdf9bd47e83d1f60b49
Instruction Fuzzy Hash: C3519B35A00206AFDB14DF68C884BAEBBF8FF49310F10425DE915AB390DB75AC00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010AC870 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 010AC9F7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 010ACA13
GetExitCodeProcess.KERNEL32(00000000,011AC5B7), ref: 010ACA24
CloseHandle.KERNEL32(00000000), ref: 010ACA32

Strings

open, xrefs: 010AC907

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID: open
API String ID: 2321548817-2758837156
Opcode ID: 1f31b77f181cde4671b65330ce5c532705d78b2918b65fe9e80255381e4148c0
Instruction ID: 4cbb8d10e9b3308552754b1b4006e2d75e3eb082a34f764e43532504f1acda8f
Opcode Fuzzy Hash: 1f31b77f181cde4671b65330ce5c532705d78b2918b65fe9e80255381e4148c0
Instruction Fuzzy Hash: 67618A71E00249CFEB10CFA9C9487AEBBF4FF59328F158259E865AB390D7749901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0114FE19 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8C278AEA,?,?,00000000,011C72FA,000000FF,?,0114FDA9,?,?,0114FD7D,?), ref: 0114FE4E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0114FE60
FreeLibrary.KERNEL32(00000000,?,?,00000000,011C72FA,000000FF,?,0114FDA9,?,?,0114FD7D,?), ref: 0114FE82

Strings

CorExitProcess, xrefs: 0114FE58
mscoree.dll, xrefs: 0114FE47

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 54cf1707be8e198c2ed18c5c55a9ba3622c58a964f34e7f6445102b329562180
Instruction ID: 095d09588d14a9ba7aaff8ff3274250576f8567713105e6fc8051145875eafa1
Opcode Fuzzy Hash: 54cf1707be8e198c2ed18c5c55a9ba3622c58a964f34e7f6445102b329562180
Instruction Fuzzy Hash: A501A732944669AFDB298F58DC05BAE7FBDFB04F15F000529F921E2280D7749900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010B3C20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 01144BA2: EnterCriticalSection.KERNEL32(01257FD8,?,00000000,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BAD
Part of subcall function 01144BA2: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144BEA

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 010B3C7E
GetProcAddress.KERNEL32(00000000), ref: 010B3C85
__Init_thread_footer.LIBCMT ref: 010B3C9C

Part of subcall function 01144B58: EnterCriticalSection.KERNEL32(01257FD8,00000000,?,010B3CA1,01259C74), ref: 01144B62
Part of subcall function 01144B58: LeaveCriticalSection.KERNEL32(01257FD8,?,010B3CA1,01259C74), ref: 01144B95
Part of subcall function 01144B58: RtlWakeAllConditionVariable.NTDLL ref: 01144C0C

Strings

SymFromAddr, xrefs: 010B3C74
Dbghelp.dll, xrefs: 010B3C79

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: cc0e0e84da5c3bae65fbab70a3ea7413a7a8e83dd58779efc04baf9c37f4f0d5
Instruction ID: 15e2fb02f2268dd248737ff2560b8b0d6b14d6b1faa8db2ee8f4d8e9272162df
Opcode Fuzzy Hash: cc0e0e84da5c3bae65fbab70a3ea7413a7a8e83dd58779efc04baf9c37f4f0d5
Instruction Fuzzy Hash: 9401B171A44748DFCF24CFA9E989B44B7E4E708B29F1003ADE92693784CB3564408B01

Uniqueness

Uniqueness Score: -1.00%

Function 01144C2A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,01144BC7,00000064), ref: 01144C4D
LeaveCriticalSection.KERNEL32(01257FD8,?,?,01144BC7,00000064,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?), ref: 01144C57
WaitForSingleObjectEx.KERNEL32(?,00000000,?,01144BC7,00000064,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?), ref: 01144C68
EnterCriticalSection.KERNEL32(01257FD8,?,01144BC7,00000064,?,010B3C61,01259C74,8C278AEA,?,011AD6C1,000000FF,?,010B3F54,8C278AEA,?,00000000), ref: 01144C6F

Strings

v, xrefs: 01144C57

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: v
API String ID: 3269011525-3261393531
Opcode ID: d61a3234cc6886fbfb6ced76d549c26cf1026ba3167248279e21f67735105f52
Instruction ID: 99b709210b4be7debf62da33aae6dd3057cd62890edd510787ce93ef2e828f0d
Opcode Fuzzy Hash: d61a3234cc6886fbfb6ced76d549c26cf1026ba3167248279e21f67735105f52
Instruction Fuzzy Hash: 08E09A325C1228BBCF299B81FC4CA8D3F2DAB08B56B440020FE1566518CB7048508BD8

Uniqueness

Uniqueness Score: -1.00%

Function 010E1FC0 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 693a9f4fd98a9d8507f61345b49b9959ac293a518d03c92a75f10c3a476e2d54
Instruction ID: 541826d3e3a6d1a262c72c003ea95503e8a74d94c8d3c9fade6fb994d53f8918
Opcode Fuzzy Hash: 693a9f4fd98a9d8507f61345b49b9959ac293a518d03c92a75f10c3a476e2d54
Instruction Fuzzy Hash: 0C818A71900249DFDB15CFA9C98879DBFF8FF49324F1482A8E914AB395D7749940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010AABE0 Relevance: 7.7, APIs: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?), ref: 010AAD04
SetFileAttributesW.KERNEL32(?,00000000), ref: 010AAD11
GetFileAttributesW.KERNEL32(?,?,?,011E9138,00000001,8C278AEA,?,?,00000000,00000000,011AC175,000000FF), ref: 010AAD20
SetFileAttributesW.KERNEL32(?,00000000), ref: 010AAD2D
FindNextFileW.KERNEL32(?,?), ref: 010AAD6B

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: File$Attributes$FindNext
String ID:
API String ID: 3019667586-0
Opcode ID: 38c8ab2546f5757462ed8bff445c81305d0d2f50185a41def230f15dec94bb9c
Instruction ID: 4d456042bdb08b2b9a566610d0a96a048b36a67435143e5d1542b3e3e0df5efc
Opcode Fuzzy Hash: 38c8ab2546f5757462ed8bff445c81305d0d2f50185a41def230f15dec94bb9c
Instruction Fuzzy Hash: 1751A13060064ADFEB68EFA8CC54BED7BA4FF50311F504669E9A6971E0EB349A04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010E1670 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 136COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 010E16D1

Strings

HTTP/1.0, xrefs: 010E24C8
FTP Server, xrefs: 010E20B8, 010E20CA, 010E20D4
GET, xrefs: 010E1859
Local Network Server, xrefs: 010E1E58, 010E1E6A, 010E1E74

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ErrorLast
String ID: FTP Server$GET$HTTP/1.0$Local Network Server
API String ID: 1452528299-797884378
Opcode ID: 0331c4f4c7584a428b597d2e5fa0930ed5981f843f0479d29c43de79deda8c1d
Instruction ID: 8825a3fbe5e1b06271e1681847f47b631ea79845877883851de84be019ad564b
Opcode Fuzzy Hash: 0331c4f4c7584a428b597d2e5fa0930ed5981f843f0479d29c43de79deda8c1d
Instruction Fuzzy Hash: 2C41E371A0020A9FEB14DFA9DC49BAEBBF8FF45714F10456DE950AB280DB749901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5780 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FA57DE
GetDlgItem.USER32(?,?), ref: 00FA5803
SendMessageW.USER32(?,?,?,?), ref: 00FA58CD

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: 4e6e6621afe0321c6bb5851a5fc71062a498e8d2211c76c0ac317677f61f5686
Instruction ID: 249c4791d025fc3e71b68943f5e9b29ebe997ac2dde660cd2d2d3be1cadeff35
Opcode Fuzzy Hash: 4e6e6621afe0321c6bb5851a5fc71062a498e8d2211c76c0ac317677f61f5686
Instruction Fuzzy Hash: A54113B2740A05DFC7148F18D898B66B7F9FB46B21F14852AE446CA561C735E814FB60

Uniqueness

Uniqueness Score: -1.00%

Function 010A5610 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 010A5644
std::_Lockit::_Lockit.LIBCPMT ref: 010A5666
std::_Lockit::~_Lockit.LIBCPMT ref: 010A568E
std::_Facet_Register.LIBCPMT ref: 010A5777
std::_Lockit::~_Lockit.LIBCPMT ref: 010A57A1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 3852393a8f0c059c0bb7563827b84df8120632f2ac864f0ac57bedbbca3ef7b1
Instruction ID: 4db2a3977eb81a4c322614bd78224176ca5a2fcca46a38b581af491d83167e3c
Opcode Fuzzy Hash: 3852393a8f0c059c0bb7563827b84df8120632f2ac864f0ac57bedbbca3ef7b1
Instruction Fuzzy Hash: 2B517DB0900649DFDB15CF98E884BAEBBF0FF04718F648199E845AB381D775AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F230 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F9F27A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00F9F280
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00F9F2A3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,0116E1F6,000000FF), ref: 00F9F2CB
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,0116E1F6,000000FF), ref: 00F9F2D1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: dc65f5989d24b2b6a35b2c5cab75e71913a3471ea8ac9dbf7ed89f50914e8a6e
Instruction ID: 6dfefa0b9dc07befda523d6ac100db20d50a58886db4f7759cfe3328b1360ae1
Opcode Fuzzy Hash: dc65f5989d24b2b6a35b2c5cab75e71913a3471ea8ac9dbf7ed89f50914e8a6e
Instruction Fuzzy Hash: F7113DB1E44259ABEB14DFA4CC45BAFBBBCEB04B14F100519F914EB2C0D7B6A90487E1

Uniqueness

Uniqueness Score: -1.00%

Function 00FB71B0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00FB71BB
SendMessageW.USER32(?,?,?,0000102B), ref: 00FB7218
SendMessageW.USER32(?,?,?,0000102B), ref: 00FB7267
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00FB7278
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00FB7285

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a7420a9da6611d000365ff427e814d4ad720ca69bc268c80f60e937bc583ae85
Instruction ID: 12c915f60e41b9d6a383b5186e99c7d13a6bc9afde8247336dbff41e135db345
Opcode Fuzzy Hash: a7420a9da6611d000365ff427e814d4ad720ca69bc268c80f60e937bc583ae85
Instruction Fuzzy Hash: 80213E31958386AAE220DF11CD44B5ABBF5BFED758F206B0EF1D0211A4E7F195848E86

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3570 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 319windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,RichEdit20W,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00FC371C
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00FC3731
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00FC3739

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Strings

RichEdit20W, xrefs: 00FC3714

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: RichEdit20W
API String ID: 2359350451-4173859555
Opcode ID: 0348e75d2fd178675d4130c7fc8b9a872202eabc3336617ca6e23861b7696037
Instruction ID: 419471aec1aaae842a0e9178b7f8436b83f5e4199d3a9ae8e8cdfc3f54901fcb
Opcode Fuzzy Hash: 0348e75d2fd178675d4130c7fc8b9a872202eabc3336617ca6e23861b7696037
Instruction Fuzzy Hash: 81B18971E002099FDB19CFA8C995FAEBBB4EF48750F14416DE905AB390DB71AD00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD870 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Part of subcall function 0108A0B0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00FB66F8,00000000,80004005), ref: 0108A118
Part of subcall function 0108A0B0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0108A148

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00FBDA2D
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00FBDA44
SendMessageW.USER32(?,00001061,00000000,?), ref: 00FBDAA0

Strings

QuickSelectionList, xrefs: 00FBD962, 00FBD974, 00FBD97E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID: QuickSelectionList
API String ID: 3168177373-3633591268
Opcode ID: 6e5a943c98beadf4e0de39f288f76a6d4b3eb585920bca95654b7e29f4ad232d
Instruction ID: fe0a5f6c81dbc15d9d0f83456f5b1bdd3ecbd116239b8fa078d43e6dccb6c82e
Opcode Fuzzy Hash: 6e5a943c98beadf4e0de39f288f76a6d4b3eb585920bca95654b7e29f4ad232d
Instruction Fuzzy Hash: 8F819971A04205AFDB18DF69C884BEAF7F4FF88324F148259E565A7290DB74AD04CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010DE3A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,8C278AEA,74DEF530,00000000), ref: 010DE3F2
CloseHandle.KERNEL32(?,8C278AEA,00000000,?,00000000,011B5F93,000000FF,?), ref: 010DE570
CloseHandle.KERNEL32(?,8C278AEA,00000000,?,00000000,011B5F93,000000FF,?), ref: 010DE59F

Strings

LOG, xrefs: 010DE45A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: LOG
API String ID: 3884789274-429402703
Opcode ID: c70076712e6c2e87b04dfe97880382037e9cd9669c58265dcbe531f446bcb7ea
Instruction ID: 9cd777f8a626a4b3b3e6f23e7372f8c2b811539ac2cf8b817bf3d37910b559d3
Opcode Fuzzy Hash: c70076712e6c2e87b04dfe97880382037e9cd9669c58265dcbe531f446bcb7ea
Instruction Fuzzy Hash: CA51C171A003449FDB29DF28C9047AABBF5EF44710F14466DE956DB680EBB49A04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010AAEF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,011A8D5D,000000FF,?,80004005,8C278AEA,?), ref: 010AAF93

Part of subcall function 00F992A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00FB1134,00000000,?,00000010,?,*.*,?,80070057), ref: 00F992C3

DeleteFileW.KERNEL32(?,8C278AEA,?,74DF3340,?,00000000,011A8D5D,000000FF,?,010AAD37), ref: 010AAFC2
GetLastError.KERNEL32(?,?,?,00000000,011A8D5D,000000FF,?,80004005,8C278AEA,?,?,?,?,011A8D5D,000000FF), ref: 010AAFD2

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

Strings

\\?\, xrefs: 010AAE44, 010AAE56, 010AAE60, 010AAF54, 010AAF66, 010AAF70

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: DeleteFileInit_thread_footer$ErrorFindHeapLastProcessResource
String ID: \\?\
API String ID: 1908169709-4282027825
Opcode ID: 90f047298ef46110e72204faf34a969ee3c3f2c344c515b70fc050874b54d420
Instruction ID: 3b1922604e1ad1e8ec6d6cb34e14b2f0aca2396e3c7aed5f801256f47452ca40
Opcode Fuzzy Hash: 90f047298ef46110e72204faf34a969ee3c3f2c344c515b70fc050874b54d420
Instruction Fuzzy Hash: 5B219FB1A01619DFDB18DFA9C848BADBBE8EF04321F50465AF8A1D72D0DB359900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00F9F642
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00F9F648

Strings

RoOriginateLanguageException, xrefs: 00F9F638
combase.dll, xrefs: 00F9F63D

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: b84ece3a89f0013095a9edd86d41d119d447e71344b750134476066bcb487e76
Instruction ID: abb24845914f2af8df6921c66778e6a8d27e20aa1df305be269e8c831a5b0c6b
Opcode Fuzzy Hash: b84ece3a89f0013095a9edd86d41d119d447e71344b750134476066bcb487e76
Instruction Fuzzy Hash: 24315071904209EFEF24DF69C845BEEB7B4EB04324F10863AE825E72D0DB795A44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 010E14E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,010DF23A,?,8C278AEA,?,?,?,?,011B62A5,000000FF), ref: 010E14ED
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,010DF23A,?,8C278AEA,?,?,?,?,011B62A5,000000FF,?), ref: 010E150E
GetLastError.KERNEL32(?,8C278AEA,?,?,?,?,011B62A5,000000FF,?,010DEB6D,?,?,00000000,?,?), ref: 010E156E

Strings

AdvancedInstaller, xrefs: 010E1556

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: c09f421d653cdd284e58f487d506ca4d94635a7a084ac4785b3e0d4cab30b71c
Instruction ID: af3b55aa2387803687a0af92ba6c5af73b680073df0e5f633b74cf0ce8d1692e
Opcode Fuzzy Hash: c09f421d653cdd284e58f487d506ca4d94635a7a084ac4785b3e0d4cab30b71c
Instruction Fuzzy Hash: 60114C72340602EFE724CB36DD8DF1ABBE8FB88705F244529E6169B280D771E851CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01089FC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0108A4D0: __Init_thread_footer.LIBCMT ref: 0108A560
Part of subcall function 0108A4D0: GetProcAddress.KERNEL32(SetWindowTheme), ref: 0108A59D
Part of subcall function 0108A4D0: __Init_thread_footer.LIBCMT ref: 0108A5B4
Part of subcall function 0108A4D0: SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 0108A5DF

CreateWindowExW.USER32(80000000,SysListView32,?,00000000,00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0108A012
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 0108A030
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 0108A038

Part of subcall function 00FA68F0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00FA6926

Strings

SysListView32, xrefs: 0108A009

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$Init_thread_footerWindow$AddressCreateLongProc
String ID: SysListView32
API String ID: 605634508-78025650
Opcode ID: cbb9fd6e880b895dcf039f468f1e19bdb4cbf25582ef43e71e9ad295a090fab3
Instruction ID: f5ac323aed5cdb58fc3b77ddd33138b143f50b5fc084536592b813b45d1784e6
Opcode Fuzzy Hash: cbb9fd6e880b895dcf039f468f1e19bdb4cbf25582ef43e71e9ad295a090fab3
Instruction Fuzzy Hash: D7118B31340310BFD624AA19CC09F6BFBA9FFC9750F054659FA45AB290C7B1AC00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA8320 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0125957C), ref: 00FA835C
GetCurrentThreadId.KERNEL32 ref: 00FA8370
LeaveCriticalSection.KERNEL32(0125957C), ref: 00FA83AF

Strings

v, xrefs: 00FA83AF

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 917f4681525eb512417152d3b3ed7599b4d1eb757ed5cb42794d1aeab7a1fc9b
Instruction ID: ec65ffd704130ff376acfaf50190eed343327720e1ff1cc3a6e4e8fd49f5c0bd
Opcode Fuzzy Hash: 917f4681525eb512417152d3b3ed7599b4d1eb757ed5cb42794d1aeab7a1fc9b
Instruction Fuzzy Hash: 7311D071E04354CFCF24CF59E80475ABBF8EB49B68F14466ED86693340CBB25900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0114942C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,011493DD,?,?,00000000,?,?,?,01149507,00000002,FlsGetValue,011CB154,011CB15C), ref: 01149439
GetLastError.KERNEL32(?,011493DD,?,?,00000000,?,?,?,01149507,00000002,FlsGetValue,011CB154,011CB15C,?,?,01146324), ref: 01149443
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 0114946B

Strings

api-ms-, xrefs: 01149450

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 22584e72f60a8d70dc41f3c1b256ee33e6aaffcf8789e3fe89a686c9c9d0f03d
Instruction ID: 71c6cc2ed7aeffddd5e71f1d218372d35b81d2692a35405c3c9cee33430a239c
Opcode Fuzzy Hash: 22584e72f60a8d70dc41f3c1b256ee33e6aaffcf8789e3fe89a686c9c9d0f03d
Instruction Fuzzy Hash: FBE04F3028020DBBEF291F65FD06B5D3F5D9B00F4CF148071FA4DE8495E761E6608649

Uniqueness

Uniqueness Score: -1.00%

Function 00FB6560 Relevance: 6.3, APIs: 4, Instructions: 320windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 00FB66A8
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 00FB66BD

Part of subcall function 00F99980: RtlAllocateHeap.NTDLL(?,00000000,00000000,8C278AEA,00000000,0116C6B0,000000FF,?,?,0124C42C,00000000,00FB095C,80070057,?,00000000), ref: 00F999CA

Part of subcall function 0108A0B0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00FB66F8,00000000,80004005), ref: 0108A118
Part of subcall function 0108A0B0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0108A148

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00FB67F3
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 00FB68EF

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID:
API String ID: 3168177373-0
Opcode ID: 0e0ff753002ad306693298032882515670fb099643801c3aa09a2b313fa496e0
Instruction ID: 6c9dfc1ca87c3d248af8c91f8072b2420cc790d14699d9072dbdd778a8f75942
Opcode Fuzzy Hash: 0e0ff753002ad306693298032882515670fb099643801c3aa09a2b313fa496e0
Instruction Fuzzy Hash: A8C16D71A00209DFDB18DFA9C898BEEFBB5FF48314F144219E515AB290DB75A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA49D0 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00FA4A9A
SysFreeString.OLEAUT32(00000000), ref: 00FA4AE6
SysFreeString.OLEAUT32(00000000), ref: 00FA4B08
SysFreeString.OLEAUT32(00000000), ref: 00FA4C63

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 6493c9b69fe51c6c67e8c65447a2e2bec3c2ddc07e4782e95ec17f3b557640c4
Instruction ID: 54b680a2f9eba93ef9a45212047e33c01adad77b6faa4c298afe205195a7b7b7
Opcode Fuzzy Hash: 6493c9b69fe51c6c67e8c65447a2e2bec3c2ddc07e4782e95ec17f3b557640c4
Instruction Fuzzy Hash: 44A172B1A00259DFDB14DFA8C844FAEBBB8EF85724F10411DE515E7280E7B4AA05DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC0050 Relevance: 6.2, APIs: 4, Instructions: 246windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000001,0000110A,00000004,?), ref: 00FC0125
SendMessageW.USER32(00000001,0000110A,00000001,00000000), ref: 00FC0157
SendMessageW.USER32(?,0000110A,00000004,?), ref: 00FC02CE
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00FC02F6

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 13ead978dde12a9949c9a5b9a72d6f51cc6a15489125c586e57e824cff0e2d32
Instruction ID: ba2e17e40767a8de5e08d0807fcfae3ead295e4db6eb4f95a20283b41322d951
Opcode Fuzzy Hash: 13ead978dde12a9949c9a5b9a72d6f51cc6a15489125c586e57e824cff0e2d32
Instruction Fuzzy Hash: 7C915C71A00216DFCB25DFA8D986FEEB7F5BF49320F04456DE501AB291DB30A846DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD470 Relevance: 6.2, APIs: 4, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FAD5A8
SysAllocString.OLEAUT32(00000000), ref: 00FAD5BB
VariantClear.OLEAUT32(00000000), ref: 00FAD5DD
VariantClear.OLEAUT32(?), ref: 00FAD60E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ClearVariant$AllocString
String ID:
API String ID: 2502263055-0
Opcode ID: d96f4d3858cfd62029d881a96823207c3c749d517d61ecb8959318dab6438c24
Instruction ID: e5788b72ef8f162cc85e3b6b1306954441eeaebc8168a109141317b056deae85
Opcode Fuzzy Hash: d96f4d3858cfd62029d881a96823207c3c749d517d61ecb8959318dab6438c24
Instruction Fuzzy Hash: 8F5191B5E002199BDB20CF64CC40B99B7B8EF49714F1085ADEA19EB640E735E984CF94

Uniqueness

Uniqueness Score: -1.00%

Function 010C2010 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(8C278AEA,00000000,00000000), ref: 010C2070
GetShortPathNameW.KERNEL32(?,80004005,?), ref: 010C20DE
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?), ref: 010C212E
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,00000000,00000000), ref: 010C2164

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ByteCharMultiNamePathShortWide
String ID:
API String ID: 3379522384-0
Opcode ID: ed1259535af63c473183a2b4448a755b2694d1512d3c2a0e92ab7b5950ff8277
Instruction ID: 7ac1ee6f07583836d0d441e3f0801580ceefa83889835ee5aa31e27697654b6b
Opcode Fuzzy Hash: ed1259535af63c473183a2b4448a755b2694d1512d3c2a0e92ab7b5950ff8277
Instruction Fuzzy Hash: 8D51BE75600206AFDB14CF58CC89B6EFBB5EF94720F11866DEA619B690DB75A800CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010DACF0 Relevance: 6.2, APIs: 4, Instructions: 157registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,8C278AEA), ref: 010DAD66
_wcsrchr.LIBVCRUNTIME ref: 010DAD90
RegQueryValueExW.ADVAPI32(00000000,8C278AEA,00000000,00000000,00000000,00000000,8C278AEA,00000001,?,00000000,00000000), ref: 010DAE13
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 010DAE5F

Part of subcall function 010DAC10: RegOpenKeyExW.ADVAPI32(00000000,8C278AEA,00000000,00020019,00000002,8C278AEA,00000001,00000010,00000002,010D9F3C,8C278AEA,00000000,00000000), ref: 010DACAC

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Close$OpenQueryValue_wcsrchr
String ID:
API String ID: 213811329-0
Opcode ID: b788bf49a649fd71758d28439af0d9150c90706395eb3df627ac64bc450dfe23
Instruction ID: 2f989daddb891a7275450a3c904d48c7e582c33ceadfa357df28a15d6e365842
Opcode Fuzzy Hash: b788bf49a649fd71758d28439af0d9150c90706395eb3df627ac64bc450dfe23
Instruction Fuzzy Hash: 9E51CF71A05749DFEB10CF68C948B9EBBF8EB45720F14826AEC61A73D0D7759A04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010439A0 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 01043A32
GetWindowRect.USER32(?,?), ref: 01043A4A
GetWindowRect.USER32(?,?), ref: 01043AB6
GetWindowLongW.USER32(?,000000EC), ref: 01043ADA

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Window$Rect$Long
String ID:
API String ID: 3486571012-0
Opcode ID: 25e53faf3476e6054a921234759e7623aac6286b8882aeb33221290f711f2d62
Instruction ID: d2b781b1d7b0d7d6dbb25fbe97442f0b05ecb8268915f3c77cfb7d527556b294
Opcode Fuzzy Hash: 25e53faf3476e6054a921234759e7623aac6286b8882aeb33221290f711f2d62
Instruction Fuzzy Hash: 2C41C072A483159FC710DF28E888A6BB7E8FF99704F04466DF989D7200E730E950CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FB2BA0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(8C278AEA,8C278AEA,?), ref: 00FB2BDF
EnterCriticalSection.KERNEL32(?,8C278AEA,?), ref: 00FB2BEC
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00FB2CC3

Strings

v, xrefs: 00FB2CC3

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 944006419d498ff14e1b21a58556039ad3f40ec22431a77e9861ca3740f474a7
Instruction ID: 16b5e59cc360605cdf7ef61a38780b052f0fc7763c95b59a1d3b37f22c47832a
Opcode Fuzzy Hash: 944006419d498ff14e1b21a58556039ad3f40ec22431a77e9861ca3740f474a7
Instruction Fuzzy Hash: E04112746007058FCB229F29C840BEABBB5FF45324F204829E8A6D7381CB31A815EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FB29D0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,8C278AEA), ref: 00FB2A3A
EnterCriticalSection.KERNEL32(?,8C278AEA), ref: 00FB2A47
LeaveCriticalSection.KERNEL32(?), ref: 00FB2A98

Strings

v, xrefs: 00FB2A98

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: b215606809631155a4507da4ed9d89f6beb18b509859b3572e3f2ce61d738be3
Instruction ID: 4aa11ad91b95a91b26aeb6675500f6cb4009c2ad420e6dd07937398786a37aa4
Opcode Fuzzy Hash: b215606809631155a4507da4ed9d89f6beb18b509859b3572e3f2ce61d738be3
Instruction Fuzzy Hash: 0021D176D002459FDF21CF64D840BE9BBB8FF16324F5005A9DC59AB386C732A906DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FB2AC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,8C278AEA), ref: 00FB2B2A
EnterCriticalSection.KERNEL32(?,8C278AEA), ref: 00FB2B37
LeaveCriticalSection.KERNEL32(?), ref: 00FB2B7E

Strings

v, xrefs: 00FB2B7E

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 5a9b0712af0b184fcf001456edda789651caca69bb00d10a2e61fca92f69e31b
Instruction ID: 36112ca133058d66ce7d8eb1a8b5c25e62ecc3a3eb31306085f08758cd93d448
Opcode Fuzzy Hash: 5a9b0712af0b184fcf001456edda789651caca69bb00d10a2e61fca92f69e31b
Instruction Fuzzy Hash: EB21C1769003459FDF15CF24D884BE9BBB4FF55328F1005A9EC59AB386DB32A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010E2FF0 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,010E2422,?,?,?,?,?,00000003,00000000,8C278AEA,00000000), ref: 010E3002
GetLastError.KERNEL32(?,?,?,010E2422,?,?,?,?,?,00000003,00000000,8C278AEA,00000000), ref: 010E302F
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,010E2422,?,?,?,?,?,00000003,00000000,8C278AEA,00000000), ref: 010E3065
SetEvent.KERNEL32(?,?,?,?,010E2422,?,?,?,?,?,00000003,00000000,8C278AEA,00000000), ref: 010E3088

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Event$ErrorLastObjectResetSingleWait
String ID:
API String ID: 708712559-0
Opcode ID: 1944912e800086fd260d6968376aa629eecfe1613b5e8e7d7bb84e5ca3b1de4f
Instruction ID: 5337a2b1effd78069fc15fd913913293347cdf7bd197961d318a8cffa48db0fa
Opcode Fuzzy Hash: 1944912e800086fd260d6968376aa629eecfe1613b5e8e7d7bb84e5ca3b1de4f
Instruction Fuzzy Hash: B61191312047448EEBB59A2AE55CB577FE5BF90324F0048AEF0C28B966C360E4D1C750

Uniqueness

Uniqueness Score: -1.00%

Function 00FB2910 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,8C278AEA,?), ref: 00FB296D
EnterCriticalSection.KERNEL32(?,8C278AEA,?), ref: 00FB297A
LeaveCriticalSection.KERNEL32(?), ref: 00FB29A2

Strings

v, xrefs: 00FB29A2

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: e79ad17637ab4257d1fa71dcfd761bf47ade11f5e059743fc493e160e2cf776e
Instruction ID: e3b2578ca1e2475f7c5e2343c324a3c4042ec2725eee47a06abb3d39c7f67a0e
Opcode Fuzzy Hash: e79ad17637ab4257d1fa71dcfd761bf47ade11f5e059743fc493e160e2cf776e
Instruction Fuzzy Hash: 8A21E1369043489FCF15CF24C840BEABF78EB16324F2002A9D869A7346C7329A05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010EEDB0 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,?,8C278AEA,?,?,00000000,0116C4E0,000000FF,00000000,010EED98,00000000,C000008C,00000001,00000000,?), ref: 010EEDE7
GetExitCodeThread.KERNEL32(00000000,8C278AEA,?,?,00000000,0116C4E0,000000FF,00000000,010EED98,00000000,C000008C,00000001,00000000,?,?,?), ref: 010EEE01
TerminateThread.KERNEL32(00000000,00000000,?,?,00000000,0116C4E0,000000FF,00000000,010EED98,00000000,C000008C,00000001,00000000,?,?,?), ref: 010EEE19
CloseHandle.KERNEL32(00000000,?,?,00000000,0116C4E0,000000FF,00000000,010EED98,00000000,C000008C,00000001,00000000,?,?,?,80004005), ref: 010EEE22

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: a41e7a12be6a6761f82a1e42fe02c6bed22c7838808cf90b72c7a20e152bf3f0
Instruction ID: 8112c748dc202b01ece2e8e883055ba5eaa0b17e7d7942363268242277455551
Opcode Fuzzy Hash: a41e7a12be6a6761f82a1e42fe02c6bed22c7838808cf90b72c7a20e152bf3f0
Instruction Fuzzy Hash: 9B018C31504609EFDB388F59DD09B66BBFCFB08714F004A2DE9B692690D775A860CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3060 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 00FA30D6
SendMessageW.USER32(?,00000000,00000000), ref: 00FA31D2

Part of subcall function 00FA4BC0: SysFreeString.OLEAUT32(00000000), ref: 00FA4C63

Strings

AtlAxWin140, xrefs: 00FA30CE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140
API String ID: 4045344427-3842940177
Opcode ID: 1c6d065658adc0afb551c4bf09922cd92cc9bdcf166c505e7e67cf3f7ad10614
Instruction ID: 75ccd1309ca6171659dfdb21a406d9c756d41048e65b0b53af5df6ff85c16827
Opcode Fuzzy Hash: 1c6d065658adc0afb551c4bf09922cd92cc9bdcf166c505e7e67cf3f7ad10614
Instruction Fuzzy Hash: 7D9125B4600205EFDB14CF68C888F5ABBB9FF49724F108599F9199B391CB71EA01DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0115871D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 011587AD

Strings

pow, xrefs: 01158785, 011587A2

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1669b2d4075313019ffbd1506943dc26b7981179713c07bec7fde70a67930672
Instruction ID: c339afce0e40305e6f9c5245a257034f3543d38ca64805440eb45ac2d7b489da
Opcode Fuzzy Hash: 1669b2d4075313019ffbd1506943dc26b7981179713c07bec7fde70a67930672
Instruction Fuzzy Hash: 72519D61A05502CADB6E761DD90176A7F98DB50701F204D78EDB1822D9EF3688F18B47

Uniqueness

Uniqueness Score: -1.00%

Function 0109D5D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,8C278AEA), ref: 0109D671

Strings

\\?\UNC\, xrefs: 0109D698, 0109D6F9
\\?\, xrefs: 0109D7B3, 0109D7DE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: eb6138f087dcbfb487c74f2337207ebee14628c0cedbe431677ff81e44cd20d8
Instruction ID: a049cfd64445d66f2648186ac931d4294ac17a44b9760a8f60051fb8586547c6
Opcode Fuzzy Hash: eb6138f087dcbfb487c74f2337207ebee14628c0cedbe431677ff81e44cd20d8
Instruction Fuzzy Hash: EA61D270A002049BDF18DFA8D895BAEFBF5FF88314F10851CD955A7281EB75A944DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 010DCB90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

CloseHandle.KERNEL32(?,8C278AEA,000000C9,00000000), ref: 010DCD13
DeleteCriticalSection.KERNEL32(?,8C278AEA,000000C9,00000000), ref: 010DCDA1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 010DCC7F

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: bb857fc25c6dc79f50e3e8e24fd39c667c6dad353e37ac890c143176456af51e
Instruction ID: 117a11b963a3faa3beded0a13f49e4f3cdbf19ee38bdaaa409decbec9835c96f
Opcode Fuzzy Hash: bb857fc25c6dc79f50e3e8e24fd39c667c6dad353e37ac890c143176456af51e
Instruction Fuzzy Hash: 6D61D030905745EFEB04DF6CDA8879ABBF4EF45318F14829DE8009B782DB759944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010E3110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00F99CC0: GetProcessHeap.KERNEL32 ref: 00F99D15
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99D47
Part of subcall function 00F99CC0: __Init_thread_footer.LIBCMT ref: 00F99DD2

GetLastError.KERNEL32(?,00000000,FTP Server,0000000A), ref: 010E3194
WaitForSingleObject.KERNEL32(?,0000000A,?,00000000,FTP Server,0000000A), ref: 010E31CD

Strings

REST %u, xrefs: 010E3161

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Init_thread_footer$ErrorHeapLastObjectProcessSingleWait
String ID: REST %u
API String ID: 1670056567-3183379045
Opcode ID: 3f5cccbaa4b0ca856c772d2d14f8fb1e15ba15c0d948840ebef8d0ffcf4ef8ca
Instruction ID: 0e993dd72d638ed5f5a02c15e4501bb830ea7e0bf24a550adf17ec093784d5b2
Opcode Fuzzy Hash: 3f5cccbaa4b0ca856c772d2d14f8fb1e15ba15c0d948840ebef8d0ffcf4ef8ca
Instruction Fuzzy Hash: 8851F3316006049FEB65CB6ECC88B6ABBF4FF41324F1486ADE5A68F691D775E900CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010FF900 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000000,_pbl_evt,00000008,?,?,011EBE58,00000001,8C278AEA,00000000), ref: 010FF9AE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 010FF9CB

Strings

_pbl_evt, xrefs: 010FF982

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 2156783f277c3300c3e8e5f89984fc9928b572a9581b452d47e07e128bf55f62
Instruction ID: 89b8ce27221886e5a59578e4306402601156f6f7e052f9b3689c267a4b983fe4
Opcode Fuzzy Hash: 2156783f277c3300c3e8e5f89984fc9928b572a9581b452d47e07e128bf55f62
Instruction Fuzzy Hash: DB518D71D14609EFDB14DFA8CC45BEEB7B4EF04714F108219E925B7680E7746A04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 010DDEE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,8C278AEA,?,?,01259384), ref: 010DDF1F
CreateDirectoryW.KERNEL32(?,00000000,?,01259384), ref: 010DDF80

Strings

ADVINST_LOGS, xrefs: 010DDF58

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: b15490538469c7266bfcd026dd5df26c0d480c02c700a9ef1e2e0080fb9952bf
Instruction ID: 8b250b0e8d72858ec70a70b675e7cb918b0ce0651af3122c6f7ed42ce900cca3
Opcode Fuzzy Hash: b15490538469c7266bfcd026dd5df26c0d480c02c700a9ef1e2e0080fb9952bf
Instruction Fuzzy Hash: FF51BD75900319CADB709F68C848BBAB7F4FF14714F1446EEE8999B291EB3499C1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010B3620 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,8C278AEA,011EB190), ref: 010B3678
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 010B3782

Part of subcall function 010A3110: std::locale::_Init.LIBCPMT ref: 010A31ED

Part of subcall function 010A0BA0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 010A0C75

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 010B3696

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-3373098694
Opcode ID: 1cab4a8d3c4395303174e6b93fc82a809ed50772ed04e1845aa352f2669e3410
Instruction ID: cf57b921d918acb666185e7a836355049e27894e312570b2ad7416411de62c47
Opcode Fuzzy Hash: 1cab4a8d3c4395303174e6b93fc82a809ed50772ed04e1845aa352f2669e3410
Instruction Fuzzy Hash: BB417E70A003199BDB20DFA8C949BEFBBF8FF44704F104599E455EB290D7B4AA08CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FD532B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00FD538E

Strings

bad locale name, xrefs: 00FD53B1

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 23bbd4f5d328860fc7dfdc3d67594e6d58a9fbc3e4e448a6fe4bbf5f7f9c4bc3
Instruction ID: 8f8ddca018e9b910b3dd099df5572413a9a9ef509b834f0cccb52287ccea2f89
Opcode Fuzzy Hash: 23bbd4f5d328860fc7dfdc3d67594e6d58a9fbc3e4e448a6fe4bbf5f7f9c4bc3
Instruction Fuzzy Hash: 6721E070A05B84DFD720CF69C50475ABBF4AF15714F14869EE48587781D3B5EA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FB7710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

GetParent.USER32(00000005), ref: 00FB7784

Strings

d, xrefs: 00FB7750
C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00FB7759

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-572215800
Opcode ID: 1662f3844aaf86fef192194ed5a78130974f18bc538126d43bec1bd4630f4363
Instruction ID: e6f8f4bf64d86861780b16cc01285fba328b6e9d82fb02d32b3b5b17450c679c
Opcode Fuzzy Hash: 1662f3844aaf86fef192194ed5a78130974f18bc538126d43bec1bd4630f4363
Instruction Fuzzy Hash: 08213470D19398EEDB08DBE4D988BDDBBB1AF55308F608048D005AB294DBB95A08DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FA266B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00FA26D9

Strings

d, xrefs: 00FA26AB
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00FA26B4

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-506145171
Opcode ID: b876e05b8fb5ee191eb6f0391a4cfe3d64858e661ef26b614b60ca4f57f0a5a7
Instruction ID: 63beb18c9bac3349baafe86316f16b7682103db9afc610fc12b94843231a9820
Opcode Fuzzy Hash: b876e05b8fb5ee191eb6f0391a4cfe3d64858e661ef26b614b60ca4f57f0a5a7
Instruction Fuzzy Hash: 34214770D15298DFDF08DBE4E99879DBBB1BF16308F608088D005BB295D7B95A08DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2A59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00FA2ACA

Strings

C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00FA2AA5
d, xrefs: 00FA2A99

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-506145171
Opcode ID: 03821b5d2122154ceb0e353a7d546af829e8bc36cef82a83fb0c761d783f5980
Instruction ID: 64f3f08e4aeb7b7c592b24c6adf92ee63b2c08691fe66b5fec0a88bba2e64a5c
Opcode Fuzzy Hash: 03821b5d2122154ceb0e353a7d546af829e8bc36cef82a83fb0c761d783f5980
Instruction Fuzzy Hash: 2B217770D15298DFCF08DFE4E98879DBBB1BF15308F608088D001BB294DBB95A08DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FB77EB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000D), ref: 00FB785C

Strings

C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00FB782F
d, xrefs: 00FB7826

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-572215800
Opcode ID: dd726f9ba65522ac658a1903886d0ff96eefb49b07ff755357e6cf2b2a599e3f
Instruction ID: 744245e4c4a2b93d528d0895fa5e3667f8e39b6ae65d03046fc61828f26d7e41
Opcode Fuzzy Hash: dd726f9ba65522ac658a1903886d0ff96eefb49b07ff755357e6cf2b2a599e3f
Instruction Fuzzy Hash: EA215470D05288EFDF08DFE4D988BDCBBB0BF55308F608048E001AB295DBB99A08DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00FA27AB

Strings

d, xrefs: 00FA277B
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00FA2784

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-506145171
Opcode ID: d5c625558ceb13b4c231971d01d44d27f0c9bf7075b54f84456b81d36d3aefa5
Instruction ID: c6eba525f7eec4af07f5c4c374e459fa4b48022c4e6b899949e791af20db9dff
Opcode Fuzzy Hash: d5c625558ceb13b4c231971d01d44d27f0c9bf7075b54f84456b81d36d3aefa5
Instruction Fuzzy Hash: 17216770D15288EEDF08DFE8E9987DDBBB1BF55308F608048E0057B295DBB94A08DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2B31 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00FA2B9F

Strings

d, xrefs: 00FA2B6C
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00FA2B78

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-506145171
Opcode ID: 458d5aa40c97c111be89c278c697c0ad3995caaf895f33472aa3ba86ed61e394
Instruction ID: 3cf3b8513b7035b36c2b77fb4f642a3d2f26cb84057830dc86eac4bd274d1c0a
Opcode Fuzzy Hash: 458d5aa40c97c111be89c278c697c0ad3995caaf895f33472aa3ba86ed61e394
Instruction Fuzzy Hash: 80213670D15298EEDF08DFE4D9987DDBBB1BF55308F608088D0057B295DBB94A08DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FB78C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000013), ref: 00FB78F6

Strings

Unknown exception, xrefs: 00FB78CB
C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00FB78DB

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-9186675
Opcode ID: b3c9e344da412d5c9b4a587abbeb5f4e12aeb1187e937ea81d6b5e9686c19b6a
Instruction ID: 4534dbf3a7f607a8f2396e4103d545db3971e83b8f3eb3bfcd26f8b57aaf3337
Opcode Fuzzy Hash: b3c9e344da412d5c9b4a587abbeb5f4e12aeb1187e937ea81d6b5e9686c19b6a
Instruction Fuzzy Hash: FB018030D15388EFDF05EBE8C919ADDBFB0AF55304F948088D0016B296DBB55E08EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2C06 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00FA2C36

Strings

Unknown exception, xrefs: 00FA2C0E
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00FA2C21

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: fa67f7f2f1d32c5e0526e6326f47164ae25c3e8301fb458c5825c7e3c0d9c6a3
Instruction ID: 3f2481e868dc4ba357ac2bbc9fd5f8d427993c784fa161e108121efb22cebc8c
Opcode Fuzzy Hash: fa67f7f2f1d32c5e0526e6326f47164ae25c3e8301fb458c5825c7e3c0d9c6a3
Instruction Fuzzy Hash: 9D015230D15388DBDF05EBE8CD556DEBBB0AF56304F64819CD0016B296DB745B08E792

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2812 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00FA283F

Strings

Unknown exception, xrefs: 00FA281A
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00FA282A

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: 31ae2124adc1c023f2a84b0815f4a4d7326228ac63934812bf9c023a93d0abbe
Instruction ID: f5e94cc08603d16e241d54405cd582ccfc49b6a66df68684200db60353663f5f
Opcode Fuzzy Hash: 31ae2124adc1c023f2a84b0815f4a4d7326228ac63934812bf9c023a93d0abbe
Instruction Fuzzy Hash: AD015270D15388DBDF05EBE8D9586DDBFB0AF56304F54809CD0016B295D7B45A08D792

Uniqueness

Uniqueness Score: -1.00%

Function 01143EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9260: InitializeCriticalSectionAndSpinCount.KERNEL32(01257F5C,00000000,8C278AEA,00F90000,Function_001DC6B0,000000FF,?,01143EF0,?,?,?,00F96508), ref: 00FA9285
Part of subcall function 00FA9260: GetLastError.KERNEL32(?,01143EF0,?,?,?,00F96508), ref: 00FA928F

IsDebuggerPresent.KERNEL32(?,?,?,00F96508), ref: 01143EF4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F96508), ref: 01143F03

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 01143EFE

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: de4ae61e3abff0b3dd038804127f7ad0b32b364f002a7b14d8d869e171b78763
Instruction ID: 98eb5a4045f944330df5647754a670cc93770844f696d11e6434fb6340b1e994
Opcode Fuzzy Hash: de4ae61e3abff0b3dd038804127f7ad0b32b364f002a7b14d8d869e171b78763
Instruction Fuzzy Hash: 3EE030701007214FDB299F29E4083427AF4BF04B04B00896CE5A5C3645EBB4E444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5970 Relevance: 5.3, APIs: 4, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000), ref: 00FD5ACB
HeapFree.KERNEL32(00000000,?,00000000), ref: 00FD5AD1
GetProcessHeap.KERNEL32(?,00000000), ref: 00FD5B4A
HeapFree.KERNEL32(00000000,?,00000000), ref: 00FD5B50

Memory Dump Source

Source File: 00000000.00000002.1828568796.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1828550392.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828720398.00000000011C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828778099.0000000001251000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828797097.0000000001256000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828813027.0000000001257000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1828828570.000000000125A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_fxsound_setup.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 61ef626c72895f2f2b86157d118c3701e4d97e1e923620e793d6b120be4bb763
Instruction ID: d9880026e09975035ea7d7cc85b16d1459b58c0a1c5f9696ea3f19552cc18a1c
Opcode Fuzzy Hash: 61ef626c72895f2f2b86157d118c3701e4d97e1e923620e793d6b120be4bb763
Instruction Fuzzy Hash: C4B1AFB0D00259DFDB14CFA4C844FEEBBB9BF44714F24825AE415AB281DB74AA05DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fxdevcon64.exePID: 7676, Parent PID: 7356COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	651
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF7E06F8C60 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF7E06F8DF1
SetupDiRemoveDevice.SETUPAPI ref: 00007FF7E06F8E3E
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF7E06F8E4B

Strings

install, xrefs: 00007FF7E06F8CA0
, xrefs: 00007FF7E06F8D5F
Success, xrefs: 00007FF7E06F8CD5, 00007FF7E06F8E51
Please specify a paramter : install or remove, xrefs: 00007FF7E06F8C89
Syntax: fxdevcon install <inf path>, xrefs: 00007FF7E06F8CB5
Root\FXVAD, xrefs: 00007FF7E06F8D27
Driver removal failed, xrefs: 00007FF7E06F8DF7
FxSound driver installation failed, xrefs: 00007FF7E06F8CE8
remove, xrefs: 00007FF7E06F8D02

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: DeviceSetup$DestroyInfoList$Remove
String ID: $Driver removal failed$FxSound driver installation failed$Please specify a paramter : install or remove$Root\FXVAD$Success$Syntax: fxdevcon install <inf path>$install$remove
API String ID: 1552884366-1548843805
Opcode ID: 5cacbce7fdb70afc9de623bb55feab5698695e2e0fb7f17144c4357e18d40dac
Instruction ID: 353ab2972bc858d792936bb65c7e47080b52215d65f297c4e9fdd1ae25a4457f
Opcode Fuzzy Hash: 5cacbce7fdb70afc9de623bb55feab5698695e2e0fb7f17144c4357e18d40dac
Instruction Fuzzy Hash: DA512361B0CA4389EE50BF25E8003B9E262EF89794FC44177D65D467E5DE3CF8268722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070C06C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7E070C820,?,?,?,?,00007FF7E0704AAD,?,?,?,?,00007FF7E06FB788), ref: 00007FF7E070C1EB
GetProcAddress.KERNEL32(?,?,?,00007FF7E070C820,?,?,?,?,00007FF7E0704AAD,?,?,?,?,00007FF7E06FB788), ref: 00007FF7E070C1F7

Strings

ext-ms-, xrefs: 00007FF7E070C148
api-ms-, xrefs: 00007FF7E070C135
ios_base::failbit set, xrefs: 00007FF7E070C082

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-$ios_base::failbit set
API String ID: 3013587201-4272397935
Opcode ID: 90ce76c3d5789e183d277d1c9b9ecc3a2879266a461235551c0db5cdac2e1d32
Instruction ID: 83f7e0137b362706a2e86cfd4aa1034ec326b16c92ea9a11ae4b8ad6083c6e43
Opcode Fuzzy Hash: 90ce76c3d5789e183d277d1c9b9ecc3a2879266a461235551c0db5cdac2e1d32
Instruction Fuzzy Hash: A2410171B1960291FE12AB169C043B5A396BF4CBE4F884637DD0D8B789DE3CF4618362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06FC8C8 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7E06FC8DC

Part of subcall function 00007FF7E06FCA94: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E06FCAB6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E06FC8F1
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E06FC95F

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: b9f438afba0401649940148789875f37fa25fc3ddfad57d9fea010e1fd8731c6
Instruction ID: 60b5c6151bdbd0666799e2d6259d9744e32f361b315f02145121099bc054fad6
Opcode Fuzzy Hash: b9f438afba0401649940148789875f37fa25fc3ddfad57d9fea010e1fd8731c6
Instruction Fuzzy Hash: F8315921A0854349FA40BF24D6123BAD292AF49798FC41137EA8D473D7CEBCB8258273

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0708C18 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7E0708C14), ref: 00007FF7E0708C29
TerminateProcess.KERNEL32(?,?,?,00007FF7E0708C14), ref: 00007FF7E0708C34
ExitProcess.KERNEL32 ref: 00007FF7E0708C43

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 69820d1b6aa14f4cd529ff87106b00f14374be80dc92e6562831604f876a292e
Instruction ID: cea0e41e45048b557fa674b36671f03cfdcb092b0782ba6704a727d0447c3637
Opcode Fuzzy Hash: 69820d1b6aa14f4cd529ff87106b00f14374be80dc92e6562831604f876a292e
Instruction Fuzzy Hash: ADD09E20B1960652FE987B705C5537AA2217F4D745F84157AC89B063E3CDBDB86A8232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070CBA8 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF7E070CC21
GetFileType.KERNELBASE ref: 00007FF7E070CC37

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4286f1c0d31b7823e1c077a77f67fe1494a7b09971722fc1b5ed72947fb83f15
Instruction ID: 847556ef3d83106b0b6d39ea38dd80f981fc07bfbef471287ee04023bf97e970
Opcode Fuzzy Hash: 4286f1c0d31b7823e1c077a77f67fe1494a7b09971722fc1b5ed72947fb83f15
Instruction Fuzzy Hash: B2316831A18B4551EF605B15D980279B650FB49BB4BA81336DB5E473E0CF38F4B1D362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0708B49 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E0708B77

Part of subcall function 00007FF7E0708C7C: GetModuleHandleExW.KERNEL32 ref: 00007FF7E0708CA1
Part of subcall function 00007FF7E0708C7C: GetProcAddress.KERNEL32 ref: 00007FF7E0708CB7
Part of subcall function 00007FF7E0708C7C: FreeLibrary.KERNEL32 ref: 00007FF7E0708CDE

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 13d2b715926206afaca5db3d0266dd2789bd6b5ebdeaa94b62f7cffdfdefcb66
Instruction ID: 3a424183f776fe69f5ea894562fb40fb070ff4d4ff54a5b5dfd2f40f5e6a12cb
Opcode Fuzzy Hash: 13d2b715926206afaca5db3d0266dd2789bd6b5ebdeaa94b62f7cffdfdefcb66
Instruction Fuzzy Hash: 66218DB2A056018AEFA4AF64C8403BC73A0FB4831CF844636D69C06BC5DFB8E454CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0712EA4 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E0712ECF

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 76c1d8289a632c5555ac3f4d244e84e2a89d35e61f60168d1cb1fbab7ef4d6a0
Instruction ID: 8fad739bd2b2e3bbc6de15e1e73d63bdd68fd46ea2bd53b17897acf26eec7a80
Opcode Fuzzy Hash: 76c1d8289a632c5555ac3f4d244e84e2a89d35e61f60168d1cb1fbab7ef4d6a0
Instruction Fuzzy Hash: A0116D72A2D64282EB10BF14A440669E3A4FF58780FC50536E68D577D6DF3CF8728B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070BF44 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E070BB52,?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000), ref: 00007FF7E070BF99

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6379b2c65bd0b3b2ad55a001232f8e897d6bfc83adecff3030938788b245065b
Instruction ID: 0baf6bee6ee003431156461408ee901d692ce47dd26d0d2aa170941b4d957239
Opcode Fuzzy Hash: 6379b2c65bd0b3b2ad55a001232f8e897d6bfc83adecff3030938788b245065b
Instruction Fuzzy Hash: 7DF04954B1920352FE58B6619DA07B596906F9CB88FCC5632C90E873D1EE3CB6A04A32

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7E06F5950 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 250commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF7E06F59A7
SysAllocString.OLEAUT32 ref: 00007FF7E06F59E8
SysFreeString.OLEAUT32 ref: 00007FF7E06F5A55
CoSetProxyBlanket.OLE32 ref: 00007FF7E06F5AAD
SysFreeString.OLEAUT32 ref: 00007FF7E06F5B9B
SysFreeString.OLEAUT32 ref: 00007FF7E06F5BDB
VariantInit.OLEAUT32 ref: 00007FF7E06F5C49
VariantClear.OLEAUT32 ref: 00007FF7E06F5C9A

Strings

Version, xrefs: 00007FF7E06F5C67
10., xrefs: 00007FF7E06F5C82
ROOT\CIMV2, xrefs: 00007FF7E06F59E1
WQL, xrefs: 00007FF7E06F5B3A
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF7E06F5AEC

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: String$Free$Variant$AllocBlanketClearCreateInitInstanceProxy
String ID: 10.$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$Version$WQL
API String ID: 121300105-1391451428
Opcode ID: 4287cc933073fbf66d222fe55d1b0870b89548397402497fbe2d0d9785210a3a
Instruction ID: 8e9c205e3701b2e5fdd6e52ab1a3154fca9776fbcd1e1283c4bca5a8589feb33
Opcode Fuzzy Hash: 4287cc933073fbf66d222fe55d1b0870b89548397402497fbe2d0d9785210a3a
Instruction Fuzzy Hash: 86B16D32609B428AEB14EF30D490368B3A5FF48B48F444536DB4D57B94DF38E961D762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070EBEC Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E070F01E

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e945abf026ddcfb20bf71390c4bc86717e187da024ff9f74110b7522c535ef87
Instruction ID: 3564ac059df8b12fa3b2b9abccef27c85e882f423e8a7f53067db4f6301db0be
Opcode Fuzzy Hash: e945abf026ddcfb20bf71390c4bc86717e187da024ff9f74110b7522c535ef87
Instruction Fuzzy Hash: 17C1A022A1868A55FF616B11D8443BEAB91FB897C8FC40232DA4D077D5CE7CF4748722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0714CCC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7E070B978: GetLastError.KERNEL32 ref: 00007FF7E070B987
Part of subcall function 00007FF7E070B978: FlsGetValue.KERNEL32 ref: 00007FF7E070B99C
Part of subcall function 00007FF7E070B978: SetLastError.KERNEL32 ref: 00007FF7E070BA27

TranslateName.LIBCMT ref: 00007FF7E0714D39
TranslateName.LIBCMT ref: 00007FF7E0714D74
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7E0709674), ref: 00007FF7E0714DB9
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7E0709674), ref: 00007FF7E0714DE1

Strings

utf8, xrefs: 00007FF7E0714EC5

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 36a26457d1f9c02225d0b6437f8a570135b8742c890c7b7a0194f055b9aaf380
Instruction ID: 406773ad6fd34076f21b1fd19da50dc1912fd21382b97d62f5c0b9c777a4e46c
Opcode Fuzzy Hash: 36a26457d1f9c02225d0b6437f8a570135b8742c890c7b7a0194f055b9aaf380
Instruction Fuzzy Hash: 72915C72B0868285EF24AF21E4107B9A6A5FB48B84FC44132DA4C477C5DF3CF5A5C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0702AA8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E0702B21
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E0702B39
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E0702B74
IsDebuggerPresent.KERNEL32 ref: 00007FF7E0702BAD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E0702BB7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E0702BC2

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b1c8c8f8b375ac6f319b1b11e49860d25bec8279c134c21c3cb9df2fe06294b9
Instruction ID: 6de62301de22ac76e04ff4b5bb1c1b533b1a4917322c295ea26447eb64e282ba
Opcode Fuzzy Hash: b1c8c8f8b375ac6f319b1b11e49860d25bec8279c134c21c3cb9df2fe06294b9
Instruction Fuzzy Hash: D8316532618B8196DB60DF25E8443AEB3A5FB88758F900137EA8D43B94EF3CE556C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07111E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ad451ad47c9280789075182ca75454652736b7409ccfcbfdc3738f6058a9d4
Instruction ID: c0889b9bc94e782fd88351865a5d2d51b8f2d5a290b89814d60ebd7f6c4fef7b
Opcode Fuzzy Hash: 23ad451ad47c9280789075182ca75454652736b7409ccfcbfdc3738f6058a9d4
Instruction Fuzzy Hash: 95F044F1B192558ADB949F38A4026297790F7483C0B90853AD5C983B08DA3CA4618F15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F5D20 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 293registrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E06F6270: CoCreateInstance.OLE32 ref: 00007FF7E06F62CB

RegOpenKeyExW.ADVAPI32 ref: 00007FF7E06F6021

Part of subcall function 00007FF7E06F6D90: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F6E76
Part of subcall function 00007FF7E06F6D90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E06F6E7C

RegSetValueExW.ADVAPI32 ref: 00007FF7E06F605B
RegCloseKey.ADVAPI32 ref: 00007FF7E06F6065
Sleep.KERNEL32 ref: 00007FF7E06F6070
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F618D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F6193
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F619F

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\, xrefs: 00007FF7E06F5F91
FxSound Audio Enhancer, xrefs: 00007FF7E06F5E06
DeviceState, xrefs: 00007FF7E06F6050

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseConcurrency::cancel_current_taskCreateInstanceOpenSleepValue
String ID: DeviceState$FxSound Audio Enhancer$SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\
API String ID: 2776398970-4141637846
Opcode ID: 1ab0e312d252be52c08c94058e6ce984907a42243d809da510a881fa29a8dd14
Instruction ID: d712dd6e206a9ab5bdfe61f71cab833a9bf3b951eef93d853a249ddffa9ef8c7
Opcode Fuzzy Hash: 1ab0e312d252be52c08c94058e6ce984907a42243d809da510a881fa29a8dd14
Instruction Fuzzy Hash: 50C1A262F186428AEF10AF69D4053AC6362AB447A8F904333EE2D17BD9DE7CF551C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F51F0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 275COMMON

Download Yara Rule

Strings

" /st 10:00 /f, xrefs: 00007FF7E06F52B9
updater.exe /silent, xrefs: 00007FF7E06F5287
schtasks /create /sc daily /tn "FxSound\Update" /tr ", xrefs: 00007FF7E06F52E8
Update scheduled!, xrefs: 00007FF7E06F54CB, 00007FF7E06F54E2

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID:
String ID: " /st 10:00 /f$Update scheduled!$schtasks /create /sc daily /tn "FxSound\Update" /tr "$updater.exe /silent
API String ID: 0-1398903112
Opcode ID: 6c1df07fcf038a025bb021b8500e1dc84086515086949eeea7b73094087dbed4
Instruction ID: a7fc8133bdb57eb7b1050fd4e32f72594e32aa7144c2bc88c06200ce48cc2055
Opcode Fuzzy Hash: 6c1df07fcf038a025bb021b8500e1dc84086515086949eeea7b73094087dbed4
Instruction Fuzzy Hash: 26C19062B1878189EB00EF64D4443ADA362FB457A8F904232EB6C07BE9DF7CE590C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070AD2C Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E070AD70
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E070B148
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E070B3F3

Strings

p, xrefs: 00007FF7E070AE9A
p, xrefs: 00007FF7E070AE22
0, xrefs: 00007FF7E070B198
f, xrefs: 00007FF7E070AE92

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 7641c8648b7efcd30edb5bca624bfc67ce53e5304b06a8e13b3d4dd96697a68c
Instruction ID: e24577afbd1b5a9fd4ea4dcaadea9756afc4e687b5a50ba54a50e1750d3a3762
Opcode Fuzzy Hash: 7641c8648b7efcd30edb5bca624bfc67ce53e5304b06a8e13b3d4dd96697a68c
Instruction Fuzzy Hash: 6C129161E0814785FF247A14E86437AFA91FB58758FD44233E699467C4DF3CFAA08722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06FFD48 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7E06FFDA5

Part of subcall function 00007FF7E0702038: __GetUnwindTryBlock.LIBCMT ref: 00007FF7E070207B
Part of subcall function 00007FF7E0702038: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7E07020A0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E06FFE7D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7E07000D2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E07001DE

Strings

csm, xrefs: 00007FF7E06FFEA0
csm, xrefs: 00007FF7E06FFDBF
csm, xrefs: 00007FF7E06FFE26

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: ca4f61dff3b8fc280efab72020162da1ad8cbccf0416b3fc8cf581f48c58a58e
Instruction ID: a7783fd66b8ec113db1f035efe97f42f103b9ab71c9da06ab1eb2ca8292d4b0d
Opcode Fuzzy Hash: ca4f61dff3b8fc280efab72020162da1ad8cbccf0416b3fc8cf581f48c58a58e
Instruction Fuzzy Hash: 4CE1B772A087418AEB20AF65D8403ADB7A1FB49798F900236DE8D57755CF38F4A0C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F61B0 Relevance: 12.4, APIs: 8, Instructions: 382comCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F6260
CoCreateInstance.OLE32 ref: 00007FF7E06F62CB

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: CreateInstance_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2179885484-0
Opcode ID: d93ed6c9676b63b4b319c6182a98a12869c31be6ea6884b18b9bca695c5a07ca
Instruction ID: 3c0ce73c565967cc5c50d8147f6c7b82c870f1d9bfb7f5335b65a3975dc3a9d0
Opcode Fuzzy Hash: d93ed6c9676b63b4b319c6182a98a12869c31be6ea6884b18b9bca695c5a07ca
Instruction Fuzzy Hash: E9F18462B04B8689EF10AF65D4443AD6362FB44BA8F904236EE6D177D9DF7CE4A0C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F6270 Relevance: 10.9, APIs: 7, Instructions: 384comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF7E06F62CB
PropVariantClear.OLE32 ref: 00007FF7E06F6439
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F684E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F6854
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F685A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F6866

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ClearCreateInstancePropVariant
String ID:
API String ID: 1364504209-0
Opcode ID: 666a723333afe2dcd93cd6ebccdbaab6ad92268da4100d7eeb55d9a170064dad
Instruction ID: 1dcc6032f2e9f3e43b316d5bac8ce30608ce07e68cbdd8026d53fdb02155204f
Opcode Fuzzy Hash: 666a723333afe2dcd93cd6ebccdbaab6ad92268da4100d7eeb55d9a170064dad
Instruction Fuzzy Hash: 1F029062B04B4689EF00AF65D4443ADA372FB44BA8F904236EE6C57BD9DF78E094C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070B978 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E070B987
FlsGetValue.KERNEL32 ref: 00007FF7E070B99C
FlsSetValue.KERNEL32 ref: 00007FF7E070B9BD
FlsSetValue.KERNEL32 ref: 00007FF7E070B9EA
FlsSetValue.KERNEL32 ref: 00007FF7E070B9FB
FlsSetValue.KERNEL32 ref: 00007FF7E070BA0C
SetLastError.KERNEL32 ref: 00007FF7E070BA27

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: fb4e550bf99a22131a26c2a4006765fdec2468d1ba92cb98c5d9e0e2d07275e0
Instruction ID: b017e51f74e266bf58fcd697967e4d42bafab5ab4046d40d813c43d8d879dbb8
Opcode Fuzzy Hash: fb4e550bf99a22131a26c2a4006765fdec2468d1ba92cb98c5d9e0e2d07275e0
Instruction Fuzzy Hash: 0F216A20A1864282FE5877319A61339E981BF4C7A8FD44B36E92E467C6DE3CB5214232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E071722C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7E071725D
GetLastError.KERNEL32 ref: 00007FF7E0717269
CloseHandle.KERNEL32 ref: 00007FF7E0717281
CreateFileW.KERNEL32 ref: 00007FF7E07172AC
WriteConsoleW.KERNEL32 ref: 00007FF7E07172CB

Strings

CONOUT$, xrefs: 00007FF7E071728D

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c056c7e5a93971e588737a7e7096c3cdc855db5ca779e6adab342eed491a0c4a
Instruction ID: d63dbe2e01c9c218c9f6f1827f0c0be37be6cb889d02762989cb9cc9daaebf1d
Opcode Fuzzy Hash: c056c7e5a93971e588737a7e7096c3cdc855db5ca779e6adab342eed491a0c4a
Instruction Fuzzy Hash: EF11B921B18B4286EB509B56E844325E2B0FB5CFE4F844236E91D877D4CF7CE865C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06FC1A0 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E06FC212
MultiByteToWideChar.KERNEL32 ref: 00007FF7E06FC2BA
LCMapStringEx.KERNEL32 ref: 00007FF7E06FC2F1
LCMapStringEx.KERNEL32 ref: 00007FF7E06FC34A
LCMapStringEx.KERNEL32 ref: 00007FF7E06FC3F7
WideCharToMultiByte.KERNEL32 ref: 00007FF7E06FC439

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 38bd61bef191184f734a909da2f32b7306bcb79d2b8c5594b038505220876b37
Instruction ID: 71cd28613033614211c7263e7b8f8f1c19eee8699638a3fa20d0aaa2744d3f63
Opcode Fuzzy Hash: 38bd61bef191184f734a909da2f32b7306bcb79d2b8c5594b038505220876b37
Instruction Fuzzy Hash: 8D81AF32A087428AEB209F25A550379B2D2FF45BA8F844636EA5D17BC8DF3CE4158721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F9BE8 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E06F9BFD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E06F9C22
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7E06F9C4C
std::_Facet_Register.LIBCPMT ref: 00007FF7E06F9CC3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7E06F9CE4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E06F9CF7

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 25b88cca3772fad18d3be151d16eb436910067b57649ac8224c2d7cf50bf3e19
Instruction ID: 0ed5a33095aa1f4eb12a64fd8fc0277a529fab3549ae4e93f3598834a822c32f
Opcode Fuzzy Hash: 25b88cca3772fad18d3be151d16eb436910067b57649ac8224c2d7cf50bf3e19
Instruction Fuzzy Hash: 99318865A0864284EB15BF26E440379E3A3EB44794F980133DE5D477A5DE7CF862C332

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0700220 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E07003BE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E07006E1

Strings

csm, xrefs: 00007FF7E0700305
csm, xrefs: 00007FF7E07003E5
csm, xrefs: 00007FF7E0700367

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: a241bea0d555bf563b67b28f604847d48eec0c189418ebd67fcfc27d62fe9f6a
Instruction ID: 0739be02892ead9874e8f19d4736c824c2b194326427a495c18cf701c58e5e87
Opcode Fuzzy Hash: a241bea0d555bf563b67b28f604847d48eec0c189418ebd67fcfc27d62fe9f6a
Instruction Fuzzy Hash: B0E1B3339087818AEB10AF78D8403ADB7A2FB49758F500236DA8D57795DF38F5A1C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070BAF0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000,00007FF7E07159DF,?,?,?), ref: 00007FF7E070BAFF
FlsSetValue.KERNEL32(?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000,00007FF7E07159DF,?,?,?), ref: 00007FF7E070BB35
FlsSetValue.KERNEL32(?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000,00007FF7E07159DF,?,?,?), ref: 00007FF7E070BB62
FlsSetValue.KERNEL32(?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000,00007FF7E07159DF,?,?,?), ref: 00007FF7E070BB73
FlsSetValue.KERNEL32(?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000,00007FF7E07159DF,?,?,?), ref: 00007FF7E070BB84
SetLastError.KERNEL32(?,?,?,00007FF7E0705811,?,?,?,?,00007FF7E0710FAE,?,?,00000000,00007FF7E07159DF,?,?,?), ref: 00007FF7E070BB9F

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 850620a25cc186c6d5aa04b06bd85e6e95a09bee33cab364583ca0caa063847f
Instruction ID: 694c9ce0ce07ff1aa0958b578ff9e3df88084ebd0059dac636bc8f0f24ef30e9
Opcode Fuzzy Hash: 850620a25cc186c6d5aa04b06bd85e6e95a09bee33cab364583ca0caa063847f
Instruction Fuzzy Hash: B8113B61A0864282FE5477319D66339EA81BF4C7A8FD40736E82E467DADE3CB5214232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F79A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E06F7AEB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E06F7AF1

Strings

vector too long, xrefs: 00007FF7E06F7F94

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: vector too long
API String ID: 73155330-2873823879
Opcode ID: 344f6a62dd7d7d4e5c57b7df5badfd375c5a814b808239213295afc975ef631f
Instruction ID: 038b316ee465ab1181f4c3cf7642f3af295ce266b6b4801b3b1d8cf36f3f7ec9
Opcode Fuzzy Hash: 344f6a62dd7d7d4e5c57b7df5badfd375c5a814b808239213295afc975ef631f
Instruction Fuzzy Hash: 9E61E12270968648EE14BF1695443BCA293AB04BE0F880B32DE6D0B7D5DE7CF5A18311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0708C7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E0708CA1
GetProcAddress.KERNEL32 ref: 00007FF7E0708CB7
FreeLibrary.KERNEL32 ref: 00007FF7E0708CDE

Strings

mscoree.dll, xrefs: 00007FF7E0708C98
CorExitProcess, xrefs: 00007FF7E0708CB0

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e2801b8962c173120b6250a09cd05782673051676052e0d3477918a418d61920
Instruction ID: 16dc946c1fb1b8bcdf241ad8c29ebe13d1aedea3e2ce86fea4a7918a28a2526a
Opcode Fuzzy Hash: e2801b8962c173120b6250a09cd05782673051676052e0d3477918a418d61920
Instruction Fuzzy Hash: D6F0AF21A0960681FE10AB20A84437AA370BF4C7A4F94033ACAAE053E4CF3CF5598332

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F9460 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E06F94E7
MultiByteToWideChar.KERNEL32 ref: 00007FF7E06F9569
SysAllocString.OLEAUT32 ref: 00007FF7E06F9576

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: bf7c9dc0997b71d2ad92a24002422879e1bb65315cf06abf4bc1308abdba6b8b
Instruction ID: a74f3f529ae373ef8be39c41c78f6d2d02a3950047961076bf8ca7801730fb45
Opcode Fuzzy Hash: bf7c9dc0997b71d2ad92a24002422879e1bb65315cf06abf4bc1308abdba6b8b
Instruction Fuzzy Hash: 2141C421A0864689FB15AF7594003B9A393FF08BA8F944636EA6D477D5DE3CF4628331

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0716374 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7E071639C
_set_statfp.LIBCMT ref: 00007FF7E07163B7
_set_statfp.LIBCMT ref: 00007FF7E07163D3
_set_statfp.LIBCMT ref: 00007FF7E071640F

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 2ffb4cd4f7d9e36cf2b63db92282a9528ee9d22ad656a8471120c4c59ac44d49
Instruction ID: af175dd9493b944e23a6e4e749c118871cc01db178ae25ef0ed273576867131f
Opcode Fuzzy Hash: 2ffb4cd4f7d9e36cf2b63db92282a9528ee9d22ad656a8471120c4c59ac44d49
Instruction Fuzzy Hash: 8011E023E1CA1301FEA43568E44A3799040AF5C374FC80277EA7E463E78E7CB8624223

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070BBB8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7E0702A37,?,?,00000000,00007FF7E0702CD2,?,?,?,?,?,00007FF7E0702C5E), ref: 00007FF7E070BBD7
FlsSetValue.KERNEL32(?,?,?,00007FF7E0702A37,?,?,00000000,00007FF7E0702CD2,?,?,?,?,?,00007FF7E0702C5E), ref: 00007FF7E070BBF6
FlsSetValue.KERNEL32(?,?,?,00007FF7E0702A37,?,?,00000000,00007FF7E0702CD2,?,?,?,?,?,00007FF7E0702C5E), ref: 00007FF7E070BC1E
FlsSetValue.KERNEL32(?,?,?,00007FF7E0702A37,?,?,00000000,00007FF7E0702CD2,?,?,?,?,?,00007FF7E0702C5E), ref: 00007FF7E070BC2F
FlsSetValue.KERNEL32(?,?,?,00007FF7E0702A37,?,?,00000000,00007FF7E0702CD2,?,?,?,?,?,00007FF7E0702C5E), ref: 00007FF7E070BC40

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 059dc9fd2d32d1d8938a86f0bb982eebb3fd52d546959566c0048c4ebc7d0a44
Instruction ID: 1bc8c9bf9da15e50966bb53fa7426b2fc36e5051615d3bc56eebdfea04bff43f
Opcode Fuzzy Hash: 059dc9fd2d32d1d8938a86f0bb982eebb3fd52d546959566c0048c4ebc7d0a44
Instruction Fuzzy Hash: 11115E50A0864241FE587335ADA137AA981BF4C7A8FC45736E82D467D5DE3CB5614232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070BA4C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7E070BA5D
FlsSetValue.KERNEL32 ref: 00007FF7E070BA7C
FlsSetValue.KERNEL32 ref: 00007FF7E070BAA4
FlsSetValue.KERNEL32 ref: 00007FF7E070BAB5
FlsSetValue.KERNEL32 ref: 00007FF7E070BAC6

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5a9e4bac08b1be5f503661beccdcab3b4cde65c0739c0026db715b3f24f3a7cd
Instruction ID: c9043498f48125857ad473f4947bad51f46c3af4753ef1a8ac5051977c56d0a3
Opcode Fuzzy Hash: 5a9e4bac08b1be5f503661beccdcab3b4cde65c0739c0026db715b3f24f3a7cd
Instruction Fuzzy Hash: 0811C590B0824741FD58B3719C6237A9981BF5D368ED85736E93E4A3C2DE3CBA614233

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0700938 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7E07009A8
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E07009F3

Strings

MOC, xrefs: 00007FF7E07009BC
RCC, xrefs: 00007FF7E07009C4

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 45c4e34ea31391c9bb8b02ac6a98fa332e9bed55f89d90ca25ba3f251d741e92
Instruction ID: 4983962fec613832e67ddfbdbefc392ce6e0c18f618109c987c397849b913961
Opcode Fuzzy Hash: 45c4e34ea31391c9bb8b02ac6a98fa332e9bed55f89d90ca25ba3f251d741e92
Instruction Fuzzy Hash: 4291B073A087858AEB10DFA5D8403ADBBA1F70879CF50422AEE8D57754DF38E1A1C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06F9E14 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E06F9E2B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7E06F9E6A

Part of subcall function 00007FF7E06FBB30: _Yarn.LIBCPMT ref: 00007FF7E06FBB5E

__std_exception_copy.LIBVCRUNTIME ref: 00007FF7E06F9EB0

Strings

bad locale name, xrefs: 00007FF7E06F9E7E

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn__std_exception_copy
String ID: bad locale name
API String ID: 2575539487-1405518554
Opcode ID: 4abf526b639ac6ea22c817c47533857365642cc31ec0e510a186371400347c3d
Instruction ID: 82037afa0d03a223dff29da07d4cc0e19cc9417118cb4b8d751ba6b1651ae76e
Opcode Fuzzy Hash: 4abf526b639ac6ea22c817c47533857365642cc31ec0e510a186371400347c3d
Instruction Fuzzy Hash: A111E922605B81C9DB45EF75E44029873A6EB58B44B585136DB8C4735AEF38E5F4C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E070D9E0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E070D980), ref: 00007FF7E070DB03
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E070D980), ref: 00007FF7E070DB8D

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1e6cc54a878dc36fb54de9a964a7e3c3d195cfbd839d7535b114edb649fc7176
Instruction ID: fe4ebcbca391552967cd7db2bf3c924425ce90a9853646a09311dc5da3d3970b
Opcode Fuzzy Hash: 1e6cc54a878dc36fb54de9a964a7e3c3d195cfbd839d7535b114edb649fc7176
Instruction Fuzzy Hash: 3091B562A1875289FF50AB6598403BEB7A0FB0879CF844237DD4E53794DE78F861C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07084A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E07084D2

Part of subcall function 00007FF7E070BEA8: HeapFree.KERNEL32(?,?,0236E42583480000,00007FF7E0713A9A,?,?,?,00007FF7E0713E17,?,?,00000000,00007FF7E0714360,?,?,00007FF7E070AB22,00007FF7E0714293), ref: 00007FF7E070BEBE
Part of subcall function 00007FF7E070BEA8: GetLastError.KERNEL32(?,?,0236E42583480000,00007FF7E0713A9A,?,?,?,00007FF7E0713E17,?,?,00000000,00007FF7E0714360,?,?,00007FF7E070AB22,00007FF7E0714293), ref: 00007FF7E070BEC8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E06FC839), ref: 00007FF7E07084F0

Strings

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe, xrefs: 00007FF7E07084DE

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
API String ID: 3580290477-3631637693
Opcode ID: 18a2ff2341f3d6128a1b7c13e65fc5da732e727ac7582aeb1bb9bcddbd8779e6
Instruction ID: 5ce0ca7caa72e0dc89f245c472212e6037a90ba0788d99182fcf73f3e3b64906
Opcode Fuzzy Hash: 18a2ff2341f3d6128a1b7c13e65fc5da732e727ac7582aeb1bb9bcddbd8779e6
Instruction Fuzzy Hash: 73416272A08B1286EF54EF219C502B9A794FB487C8B944137EE4D47785DF7CF4618721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E06FE350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E06F9946), ref: 00007FF7E06FE394
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E06F9946), ref: 00007FF7E06FE3DA

Strings

csm, xrefs: 00007FF7E06FE3C7

Memory Dump Source

Source File: 00000006.00000002.1727733509.00007FF7E06F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7E06F0000, based on PE: true

Associated: 00000006.00000002.1727719717.00007FF7E06F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727759501.00007FF7E0719000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727781123.00007FF7E072C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1727793912.00007FF7E072F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7e06f0000_fxdevcon64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: fab7ff32eb11efe1b8ddc5ac539c5f4c1b687a5b802cc3f22dfa6d35eb09f5ad
Instruction ID: 2480ec6d110b6f4a5f70ca88414e6f5429fbef02f646a367c89660deea44cb58
Opcode Fuzzy Hash: fab7ff32eb11efe1b8ddc5ac539c5f4c1b687a5b802cc3f22dfa6d35eb09f5ad
Instruction Fuzzy Hash: 0D114F32A08B4182EB119F15F544369BBA5FB88B84F584232DE8D07B98DF3CE961CB01

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fxsound_setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\Config.Msi\4cce4c.rbs

C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.inf

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys

C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvadntx86.cat

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.inf

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvadntamd64.cat

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe

C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.inf

Windows Analysis Report
fxsound_setup.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre