Analysis
- user interaction
yes - max time kernel
308s - max time network
579s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 19:40
General
- Target ExLoader_Installer.exe
- Size 22.2MB
- Sample260423-ydmxjsft6j
- SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks for any installed AV software in registry 1 TTPs 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"c:\users\admin\desktop\ExLoader.lnk\") $Shortcut.TargetPath = \"C:\Program Files\ExLoader\ExLoader.exe\" $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\ExLoader\ExLoader.exe"C:\Program Files\ExLoader\ExLoader.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ExLoader\compatibleprotectiondaily.exe"C:\Program Files\ExLoader\compatibleprotectiondaily.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command (gwmi Win32_BaseBoard)3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exe /Q3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exe /Q4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_24_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_25_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_26_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_27_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_28_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_29_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_30_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_1_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_2_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_3_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_31_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_4_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_32_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_00_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_5_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_6_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_33_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_33_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_7_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_34_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_34_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_8_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_35_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_35_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_9_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx9_36_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_36_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe X3DAudio1_2_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT2_10_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_37_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_37_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe X3DAudio1_3_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_0_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_0_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_38_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_38_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe X3DAudio1_4_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_1_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_1_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_39_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_39_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_2_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_2_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe X3DAudio1_5_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_3_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_3_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_40_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_40_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe X3DAudio1_6_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_4_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_4_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_41_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_41_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_42_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_42_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx11_42_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dcsx_42_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DCompiler_42_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_5_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_5_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe X3DAudio1_7_x64.inf6⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_6_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_6_x64.inf6⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DX9_43_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx10_43_x64.inf6⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dx11_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe d3dcsx_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe D3DCompiler_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XACT3_7_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5707.tmp\infinst.exe XAudio2_7_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll6⤵
- Modifies registry class
-
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Windows\System32\taskkill.exe /f /im tf_win64.exe3⤵
-
C:\Windows\System32\taskkill.exeC:\Windows\System32\taskkill.exe /f /im tf_win64.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x86.exe /q3⤵
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x86.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x86.exe /q4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi5⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x64.exe /q3⤵
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x64.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x64.exe /q4⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi5⤵
- Event Triggered Execution: Installer Packages
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4DCD7C66A718904538BF323725F1BBC82⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6694137720748AE9BD7978F7E757DEFE2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {ebab54a5-a0ac-4518-8ee0-d603481ad967} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 27133 -prefMapHandle 2396 -prefMapSize 270279 -ipcHandle 2404 -initialChannelId {38bd2317-4498-4042-93dd-1729409c5411} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3648 -prefsLen 27274 -prefMapHandle 3652 -prefMapSize 270279 -jsInitHandle 3656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3680 -initialChannelId {81918189-d8a8-4077-98b2-d112cfdc84a1} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27274 -prefMapHandle 3852 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {362ddea4-3bfb-4c30-ae4c-ce57d82f3fe8} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2960 -prefsLen 34773 -prefMapHandle 2964 -prefMapSize 270279 -jsInitHandle 2912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2572 -initialChannelId {679770c3-56e6-47da-a1d5-477569484a74} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 35010 -prefMapHandle 5028 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {4dd02d8f-1e4f-46b5-8bc3-4d9abd3b80af} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5000 -prefsLen 32900 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {f32b7293-6efb-4ea6-8861-b34dde697ee5} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32900 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {65a2ac06-7c9a-43d7-b923-2282403fdfaf} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32900 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {b323b4c6-f829-42c1-8a25-432ec1c2c34e} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6148 -prefsLen 36758 -prefMapHandle 6152 -prefMapSize 270279 -jsInitHandle 6156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6164 -initialChannelId {cf199e1b-c6eb-4027-889c-4e956bdd3a58} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2808 -prefsLen 36758 -prefMapHandle 1372 -prefMapSize 270279 -jsInitHandle 4504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4796 -initialChannelId {45562eb1-bc23-47b5-b5ab-d3e991548fe8} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6528 -prefsLen 39875 -prefMapHandle 6524 -prefMapSize 270279 -ipcHandle 6736 -initialChannelId {6150fe48-2cc7-416d-9070-9805c4f1ba7b} -parentPid 5884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd63f5c728,0x7ffd63f5c734,0x7ffd63f5c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1828,i,8662483413098763125,6437311274913843169,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2088 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,14401607352619033873,871804723647806084,262144 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2052 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,8864572722432199550,12011107960000427607,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,18236199342956499676,3010076879053715024,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,7593919331411525842,13843307506137802715,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,5349630399332538938,5667713264517151065,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4148 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,15781687945677333651,1484795835900549836,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,15864367994618040794,4706230553971537936,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4784 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,18386779519290159063,14687731120804076087,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4928 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,8011521759466585953,18243033388361043966,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3168,i,10920961392647393496,6461782968840946027,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4936,i,14967647567355044907,2837160942430477939,2097152 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,10923559782692739984,17221475239219498333,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4488 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,16134587512872979491,13307535916149087538,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5064 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3676,i,12507085436941764887,6636127081549160423,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4948 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,3124556719397943333,8150920599816968907,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,18166828169075592438,3420274052032221228,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6084 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,7310923472774700545,3123260614249432750,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3628 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,85575803831571414,12132383861483282771,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=872 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6448,i,15983339541605253330,1127234143489858316,262144 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6492 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,480277407381694633,12211405522471881740,524288 --field-trial-handle=2060,i,5524572254180078203,5021514388480925345,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4512 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Program Files\ExLoader\compatibleprotectiondaily.exe"C:\Program Files\ExLoader\compatibleprotectiondaily.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
ExLoader.exe
ExLoader.zip
audioplayers_windows_plugin.dll
app.so
AssetManifest.bin
background_image.frag
modification_card_image.frag
raindrops.frag
shimmer_effect.frag
winter.frag
icudtl.dat
flutter_windows.dll
permission_handler_windows_plugin.dll
url_launcher_windows_plugin.dll
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00001c
f_00001d
the-real-index
the-real-index
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Secure Preferences
fa813c9ad67834ac_0
the-real-index
the-real-index
the-real-index~RFe5d27af.TMP
Local State
Local State
Local State
Local State
Local State
data_1
thumbcache_idx.db
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
webext.sc.lz4
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
dxupdate.cif
dxupdate.dll
dxwsetup.cif
ExLoader_Installer.exe
MSVCP140.dll
VCRUNTIME140.dll
audioplayers_windows_plugin.dll
app.so
AssetManifest.bin
FontManifest.json
NativeAssetsManifest.json
AbominationPissed_DE.wav
AbominationPissed_EN.wav
AbominationPissed_RU.wav
Csgo_hover.wav
Csgo_press.wav
Fortnite_hover.wav
Fortnite_press.wav
Standard_hover.wav
Standard_press.wav
Steam_hover.wav
Steam_press.wav
Windows_notification.wav
CatsDay.jpg
Cyberpunk.jpg
Easter.jpg
Fallguys_v1.jpg
Fallguys_v2.jpg
FishingDay.jpg
Genshin.jpg
God%20of%20War.jpg
Halloween.jpg
Halo.jpg
IceCreamDay.jpg
JokeDay.jpg
LoveDay.jpg
Ori%20and%20the%20Blind%20Forest.jpg
SchoolDay.jpg
SpaceDay.jpg
SummerStart.jpg
TastyFoodDay.jpg
Warcraft.jpg
logo.png
ar.png
cs.png
de.png
en.png
es.png
fil.png
fr.png
hi.png
id.png
it.png
kk.png
ko.png
mn.png
pl.png
pt.png
ro.png
ru.png
tr.png
uk.png
uz.png
vi.png
zh.png
NoirPro-Bold.otf
NoirPro-Light.otf
NoirPro-Medium.otf
NoirPro-Regular.otf
NoirPro-SemiBold.otf
acrylic.png
bin.png
bios.png
box.png
brightness.png
celebrate.png
click.png
cloud.png
colors.png
complain.png
crash.png
cursor.png
debug.png
defender.png
dice.png
eac.png
engine.png
eye-off.png
flashdrive.png
flip.png
font.png
fps.png
framerate.png
fullscreen.png
fun.png
grain.png
harddrive.png
hint.png
hitbox.png
injection.png
insert.png
issue.png
log.png
logout.png
magnifier.png
mascot.png
memory.png
mods.png
monitor.png
mouse.png
offline.png
opacity.png
ping.png
platform.png
privacy.png
profanity.png
rain.webp
reply.png
rocket.png
rounding.png
shortcut.png
snow.webp
snowflake.webp
socials.png
translate.png
trash.png
updates.png
version.png
wall.png
weather.png
window_size.png
background_image.frag
modification_card_image.frag
raindrops.frag
shimmer_effect.frag
winter.frag
icudtl.dat
flutter_windows.dll
permission_handler_windows_plugin.dll
url_launcher_windows_plugin.dll
vcruntime140_1.dll
__PSScriptPolicyTest_tq4snx4w.gu5.ps1
01ea7e9f526e177156614da305eb369b.webp
0a1d4df1c52a9bf8b0be65efc564c90c.webp
0eb49e5656ace9453048eed0256286c9.webp
104ae0a1b2c80ea0d4d18e42c253434b.webp
1350997497b5232bb674f483bba4c5a0.webp
13c0aa4c8798b433117c0503052b36f5.webp
178adac81c1363d482ee3422e343e5ad.webp
1cc191434b7c5a0ddfb7e8933c6ffd39.webp
1f97590d229e484c25eda2b3a7e5e2b5.webp
20d5acdd6b6aa1f32386e853341a3246.webp
2f2538029feb0d10eec0cde392f554df.webp
35aec07e89e7693c5bcaf8d48c6c4802.webp
3623c6ff5bba27dec8ffa0959b5b6325.webp
53c006ac342b8fbed82adb3312c210ed.webp
626af0d33d4a22b0652f5a521b661e2d.webp
62997e08ba88ed78a9cdc7b742752a3e.webp
66af973f87bd6cb44ff2db1e87a6b551.webp
670ec740884c596e759a072bdb383b75.webp
69313c004890c114b88021da38070c38.webp
731a8729c158a7b043c4cb6537d7f4de.webp
816468bee988a6b92e8d0e284672d2cb.webp
8288ed517e2ed373c4b6085fe8102e2c.webp
8f8356bf366928c720bdfd9410e8a6d2.webp
916d0ff3d78914272d7cb33763fbb221.webp
9875c9610b069277fef546eb9ce8f871.webp
9a7d857fd557514347dbdcab5acdd884.webp
9d49e5b61c680c20e60683da2d1ad0ab.webp
a553518bb27f2e4574085f160090a820.webp
a5ecd7adc336888862873836b29e21cd.webp
ae5e5005cc18ce5ab8ebb277d99564bc.webp
b0e7df7c1996e50d117db566d927e603.webp
b7ba5dcbc4de4e2148c1c79f0703f3cb.webp
b8c63bbb4bb49c5f60149fa42a660c61.webp
bc1de80498f5407a842873e511c142e4.webp
bfe23e9a9d0aaaa5333cbf1da8df1bc6.webp
bff6f7a3d2f07b9fc8ec2fcaa897e3d7.webp
c9948fff9ff3f6b91850d1cd9fcc9d15.webp
d14b438c3ac0e615c923b16c1daf220e.webp
d842b0a6ffc8f0c686497037623fb2bf.webp
d957df5ffd7094ce8f53ed4fab03901a.webp
dd191ce20c0b448ff4f96e3faa35707d.webp
dd919fec3fdb56bf251854d5c29fc9e0.webp
de7912048910995cd25c720efe2a3696.webp
dfc86cc55e88d2e58422721cc12e186a.webp
eabb25b4a15a2e3e4a38b5ee5bd57fcd.webp
eaccd93ece9adb25ab08bdcff75296f1.webp
ed9fed59dd1f2f4715d5671b19d75a20.webp
eeaf324c921ac5b1ee4972584f7438b7.webp
tmpaddon
tmpaddon
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
07bbd202-592d-4134-8496-aaab54549e28
2ebffff7-6277-4dd0-83e3-739ac7f82e7c
3684157c-e922-460b-a55e-aaa99bae6514
8789ba59-42ab-400b-a4b5-895adb65bf64
bb23db5c-31b1-4bb7-ada2-1f814da32609
fe70224a-a9e1-4c83-a02a-fbeffe5e4ba0
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
sessionCheckpoints.json.tmp
recovery.baklz4
3870112724rsegmnoittet-es.sqlite
game_icons.zip
ServerPacketId_Modifications.hive
ServerPacketId_ModificationsLocalData.hive
shared_preferences.json
shared_preferences.json
shared_preferences.json
shared_preferences_backup.json
dxwebsetup.exe
vcredist_2005_x64.exe
vcredist_2005_x86.exe
locations_v2.csv
shared_preferences.json
DirectX.log
e5c05d4.msi
e5c05d9.msi
DirectX.log
DirectX.log
DirectX.log
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xact_x64.cab
Apr2006_xact_x86.cab
Apr2006_xinput_x64.cab
Apr2006_xinput_x86.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_d3dx10_33_x86.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_xact_x64.cab
Apr2007_xact_x86.cab
Apr2007_xinput_x64.cab
Apr2007_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
Aug2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_d3dx10_35_x86.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_xact_x64.cab
Aug2007_xact_x86.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_d3dx10_39_x86.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_xact_x64.cab
Aug2008_xact_x86.cab
Aug2008_xaudio_x64.cab
Aug2008_xaudio_x86.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_D3DCompiler_42_x86.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_xact_x64.cab
Aug2009_xact_x86.cab
Aug2009_xaudio_x64.cab
Aug2009_xaudio_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx10_00_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_d3dx9_32_x86.cab
Dec2006_xact_x64.cab
Dec2006_xact_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Feb2006_xact_x64.cab
Feb2006_xact_x86.cab
Feb2007_xact_x64.cab
Feb2007_xact_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_xact_x64.cab
Feb2010_xact_x86.cab
Feb2010_xaudio_x64.cab
Feb2010_xaudio_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_d3dx10_34_x86.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_xact_x64.cab
Jun2007_xact_x86.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_d3dx10_38_x86.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_xact_x64.cab
Jun2008_xact_x86.cab
Jun2008_xaudio_x64.cab
Jun2008_xaudio_x86.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_D3DCompiler_43_x86.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_xact_x64.cab
Jun2010_xact_x86.cab
Jun2010_xaudio_x64.cab
Jun2010_xaudio_x86.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Mar2008_d3dx10_37_x86.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_xact_x64.cab
Mar2008_xact_x86.cab
Mar2008_xaudio_x64.cab
Mar2008_xaudio_x86.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_d3dx10_41_x86.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_xact_x64.cab
Mar2009_xact_x86.cab
Mar2009_xaudio_x64.cab
Mar2009_xaudio_x86.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_d3dx10_36_x86.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_xact_x64.cab
Nov2007_xact_x86.cab
Nov2008_d3dx10_40_x64.cab
Nov2008_d3dx10_40_x86.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_xact_x64.cab
Nov2008_xact_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_xaudio_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
Oct2006_xact_x64.cab
Oct2006_xact_x86.cab
dsetup.dll
dsetup32.dll
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
SET8EB0.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD898F.tmp
OLDAF28.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
dxupdate.cab
Mar2008_d3dx10_37_x64.cab
MDX_1.0.2907.0_x86.cab
ExLoader.lnk
memory/240-19674-0x0000000002000000-0x000000000209E000-memory.dmp
memory/416-17364-0x0000000002010000-0x00000000020AE000-memory.dmp
memory/1288-17794-0x0000000001F10000-0x0000000001FAE000-memory.dmp
memory/1396-20194-0x0000000001F90000-0x000000000202E000-memory.dmp
memory/1564-20283-0x0000000002D90000-0x0000000002E2E000-memory.dmp
memory/1588-677-0x000001F0EEC50000-0x000001F0EEC5C000-memory.dmp
memory/1588-678-0x000001F0EECE0000-0x000001F0EECF2000-memory.dmp
memory/1588-679-0x000001F0EF3A0000-0x000001F0EF40F000-memory.dmp
memory/1588-669-0x000001F0EF200000-0x000001F0EF222000-memory.dmp
memory/1672-8066-0x0000000000590000-0x00000000005AA000-memory.dmp
memory/1688-18525-0x0000000001F60000-0x0000000001FFE000-memory.dmp
memory/1696-19893-0x0000000001F30000-0x0000000001FCE000-memory.dmp
memory/2460-18446-0x0000000001F20000-0x0000000001FBE000-memory.dmp
memory/2544-20106-0x0000000001F20000-0x0000000001FBE000-memory.dmp
memory/2544-19103-0x0000000001F40000-0x0000000001FDE000-memory.dmp
memory/2552-17080-0x0000000001F10000-0x0000000001FAE000-memory.dmp
memory/2956-19804-0x0000000001F40000-0x0000000001FDE000-memory.dmp
memory/3556-20384-0x0000000002AB0000-0x0000000002B4E000-memory.dmp
memory/3568-971-0x000001D3C5020000-0x000001D3C50BE000-memory.dmp
memory/3568-972-0x000001D3CD150000-0x000001D3CD162000-memory.dmp
memory/3688-17173-0x0000000001F70000-0x000000000200E000-memory.dmp
memory/3712-451-0x000001DE40610000-0x000001DE4192D000-memory.dmp
memory/3712-490-0x000001DE3C3B0000-0x000001DE3C44E000-memory.dmp
memory/3712-491-0x000001DE44970000-0x000001DE44982000-memory.dmp
memory/3712-452-0x000001DE40610000-0x000001DE4192D000-memory.dmp
memory/3712-453-0x000001DE40270000-0x000001DE40271000-memory.dmp
memory/3712-450-0x000001DE40610000-0x000001DE4192D000-memory.dmp
memory/3712-449-0x000001DE40260000-0x000001DE40261000-memory.dmp
memory/4120-815-0x000002E4B0B20000-0x000002E4B0B21000-memory.dmp
memory/4120-817-0x000002E4B1060000-0x000002E4B2539000-memory.dmp
memory/4120-816-0x000002E4B1060000-0x000002E4B2539000-memory.dmp
memory/4120-876-0x000002E4ACFB0000-0x000002E4AD04E000-memory.dmp
memory/4120-818-0x000002E4B1060000-0x000002E4B2539000-memory.dmp
memory/4120-819-0x000002E4B0B30000-0x000002E4B0B31000-memory.dmp
memory/4120-877-0x000002E4B6C70000-0x000002E4B6C82000-memory.dmp
memory/4416-17258-0x0000000001EC0000-0x0000000001F5E000-memory.dmp
memory/4608-8067-0x0000000000B50000-0x0000000000B6A000-memory.dmp
memory/4784-17452-0x0000000001F70000-0x000000000200E000-memory.dmp
memory/4788-18068-0x0000000001E90000-0x0000000001F2E000-memory.dmp
memory/5000-20467-0x00000000028B0000-0x000000000294E000-memory.dmp
memory/5204-18259-0x0000000001F20000-0x0000000001FBE000-memory.dmp
memory/5308-19192-0x00000000022E0000-0x000000000237E000-memory.dmp
memory/5428-489-0x0000000000830000-0x00000000008CE000-memory.dmp
memory/5428-804-0x0000000000830000-0x00000000008CE000-memory.dmp
memory/5944-1316-0x000001B5E9C20000-0x000001B5E9C32000-memory.dmp
memory/5944-1315-0x000001B5D19F0000-0x000001B5D19FC000-memory.dmp
memory/5944-1317-0x000001B5E9DE0000-0x000001B5E9E4F000-memory.dmp
memory/6172-19573-0x0000000001F20000-0x0000000001FBE000-memory.dmp
memory/6260-18172-0x0000000001E70000-0x0000000001F0E000-memory.dmp
memory/6332-18651-0x0000000001F80000-0x000000000201E000-memory.dmp
memory/6748-16997-0x0000000001F70000-0x000000000200E000-memory.dmp
memory/6752-18361-0x0000000001F70000-0x000000000200E000-memory.dmp
memory/6820-17879-0x0000000001F70000-0x000000000200E000-memory.dmp
memory/6908-18872-0x0000000001F30000-0x0000000001FCE000-memory.dmp
memory/7368-18973-0x0000000001F90000-0x000000000202E000-memory.dmp
memory/7384-17983-0x0000000001FA0000-0x000000000203E000-memory.dmp
memory/7400-19484-0x0000000001FA0000-0x000000000203E000-memory.dmp
memory/7556-16831-0x0000000001F20000-0x0000000001FBE000-memory.dmp
memory/7596-17369-0x0000000002C30000-0x0000000002CCE000-memory.dmp
memory/7604-18783-0x0000000001E90000-0x0000000001F2E000-memory.dmp
memory/7616-20555-0x0000000002C20000-0x0000000002CBE000-memory.dmp
memory/7644-16914-0x0000000001FF0000-0x000000000208E000-memory.dmp
memory/7820-19996-0x0000000001F10000-0x0000000001FAE000-memory.dmp
memory/8100-19275-0x0000000001F00000-0x0000000001F9E000-memory.dmp
memory/8140-19378-0x0000000001F10000-0x0000000001FAE000-memory.dmp