Analysis
- user interaction
yes - max time kernel
537s - max time network
561s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 05:40
Errors
General
- Target https://fs16.megadb.xyz:8080/d/5pnml4aoy5vxygoid3w65wc4gwvgv54w3bgu4rpwealkijbczdo4cayqi7tt2g6yo6nbpekd/Danganronpa-THH-SteamRIP.com.rar
- Sample260511-gc2wmsft2q
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 32 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of FindShellTrayWindow 50 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 52 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fs16.megadb.xyz:8080/d/5pnml4aoy5vxygoid3w65wc4gwvgv54w3bgu4rpwealkijbczdo4cayqi7tt2g6yo6nbpekd/Danganronpa-THH-SteamRIP.com.rar1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe424ac188,0x7ffe424ac194,0x7ffe424ac1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,3863598303610614706,9723651046270007539,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,18314082973678026056,7210579070235975061,262144 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,6821900614181825437,17805311514651088000,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,6206842948964537206,11696039344156490765,2097152 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16182547701717635370,12478728352482780654,2097152 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,11787367288185363357,2105434972773710916,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,417920270741132889,5722895259727683261,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,4592731672079238198,4868550050141505260,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,4592731672079238198,4868550050141505260,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6184,i,6632026329404700742,3813476269080448611,2097152 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3291913350158051188,7006323866886818454,524288 --field-trial-handle=2316,i,5255309381213541245,5459268600573027759,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe424ac188,0x7ffe424ac194,0x7ffe424ac1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15268511011283277695,14603066348261752333,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,2604815432110470110,8506330311166779793,262144 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,5249329243775888794,6174138763614708958,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,12245832614205016459,14490609487870807610,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,12245832614205016459,14490609487870807610,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,6166704632017848808,8398264327619724901,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,8310374623544925666,14017482941765517907,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,18301736593235463614,17755574745189308876,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,12979442942157235617,16073049326621273585,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,2046401639504688545,7298876508371713701,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4824,i,7314907846452679719,17282098334102849239,262144 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,16479686924388276298,9715329368531506475,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,92700075993730408,11291192396229096152,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,9844594733518953035,6521949065734714476,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,10789888163188572176,10252901707456807325,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,10164907231263937748,7609626689376418955,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1524,i,1056958731582030323,8629360076552798620,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1016,i,4455931094436410032,4612600068571152933,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,7202765040234819778,12828130462780332840,524288 --field-trial-handle=2888,i,16703398062241858637,13207003019228837218,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {7475a3a6-5e1a-4510-85de-3ee45fdf3086} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {2e60c4dd-ded2-42cd-93f8-6b788ab7b6ed} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27276 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {42c98f78-cdff-48a0-8e11-6e57adba22e2} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27276 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {be26353c-697c-4aa3-b871-d3891687bf39} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4392 -prefsLen 34775 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {390865d7-0c86-4997-9a0a-644bddaf875f} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4620 -prefsLen 35012 -prefMapHandle 3336 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {cc0ae539-e9b5-4280-9a41-eee0c7e62dfb} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32900 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {2c2b3ab3-cc8e-4162-87a3-78397f66eb77} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32900 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {39a9672c-5964-469b-9f1b-360a7931bfe4} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {fbb4a720-f4b6-4671-98d7-f4fbb2a668d7} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 33193 -prefMapHandle 3160 -prefMapSize 270279 -jsInitHandle 3164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3096 -initialChannelId {b158c96b-a540-42c9-99d5-9429dd917eb2} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3100 -prefsLen 34053 -prefMapHandle 3216 -prefMapSize 270279 -jsInitHandle 3220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6784 -initialChannelId {b67cde25-81c0-4865-a6f5-d9f7ad1a4e93} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4776 -prefsLen 37247 -prefMapHandle 7228 -prefMapSize 270279 -jsInitHandle 7236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6664 -initialChannelId {fc01f607-8bcb-4633-9445-e0063a0eeaf9} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7312 -prefsLen 37247 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 7216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6324 -initialChannelId {13f074cd-c0ff-43ca-bbdb-0d63756cd475} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6776 -prefsLen 37247 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 6740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4928 -initialChannelId {140a74d1-00f4-485f-a3f3-4cd43dd80a26} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6072 -prefsLen 37287 -prefMapHandle 5976 -prefMapSize 270279 -jsInitHandle 864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1652 -initialChannelId {6fd46f7d-f229-4dbb-b0e0-1a7432e734e9} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6116 -prefsLen 37287 -prefMapHandle 7164 -prefMapSize 270279 -jsInitHandle 4764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6244 -initialChannelId {4ce70373-95c0-4fd6-8dc8-8ff718cfa922} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7804 -prefsLen 37287 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 6792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7852 -initialChannelId {67be5ef4-ae02-43e4-8ad3-e58ab050f75d} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6268 -prefsLen 37287 -prefMapHandle 7876 -prefMapSize 270279 -jsInitHandle 7304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6732 -initialChannelId {55f06ee9-55fc-4c01-920c-671800a8db28} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8036 -prefsLen 37287 -prefMapHandle 8040 -prefMapSize 270279 -jsInitHandle 8044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8052 -initialChannelId {b7706bad-888a-4a54-b8da-6227ecb1412c} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7884 -prefsLen 40574 -prefMapHandle 6732 -prefMapSize 270279 -ipcHandle 7260 -initialChannelId {a8d0049b-0cb9-4e30-bf74-fe6792bf5ce3} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 8332 -prefsLen 40574 -prefMapHandle 8324 -prefMapSize 270279 -ipcHandle 8344 -initialChannelId {2309b930-f6bd-4454-bb44-f45660454356} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8508 -prefsLen 37287 -prefMapHandle 8512 -prefMapSize 270279 -jsInitHandle 8516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8392 -initialChannelId {aa000b56-fb7a-4e68-90c7-966041bcad13} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 8668 -prefsLen 40630 -prefMapHandle 8776 -prefMapSize 270279 -ipcHandle 6064 -initialChannelId {ef1425db-6413-4d81-9476-99040954c98c} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 utility3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8752 -prefsLen 37391 -prefMapHandle 8652 -prefMapSize 270279 -jsInitHandle 436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8640 -initialChannelId {809fa704-70f0-47fe-9074-3a4f55aac5c4} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8000 -prefsLen 37391 -prefMapHandle 6644 -prefMapSize 270279 -jsInitHandle 7828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7864 -initialChannelId {f54894af-56a8-4906-9609-039cf339b6ad} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9104 -prefsLen 37391 -prefMapHandle 9100 -prefMapSize 270279 -jsInitHandle 1364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9324 -initialChannelId {db5a5bc8-00c0-4978-9b58-da74bdf0794f} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9820 -prefsLen 37391 -prefMapHandle 9824 -prefMapSize 270279 -jsInitHandle 9828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9804 -initialChannelId {9e88e414-13e7-4a7d-be2c-fc345780ddfc} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9868 -prefsLen 37391 -prefMapHandle 9864 -prefMapSize 270279 -jsInitHandle 9860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8364 -initialChannelId {4de7ae9e-cd0d-44e2-b579-7bf57f445f6f} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10232 -prefsLen 37391 -prefMapHandle 10236 -prefMapSize 270279 -jsInitHandle 5968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3348 -initialChannelId {99365a11-39ed-4ebc-8403-afc9fb6e697f} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6692 -prefsLen 37391 -prefMapHandle 9180 -prefMapSize 270279 -jsInitHandle 9364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10224 -initialChannelId {3127c5e2-b2f1-48f7-b08f-c0f0213c2ce8} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10472 -prefsLen 37391 -prefMapHandle 10504 -prefMapSize 270279 -jsInitHandle 10332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10360 -initialChannelId {32c4724f-dc2b-4ca9-acd0-0ef29c881452} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\7z2601-x64.exe"C:\Users\Admin\Downloads\7z2601-x64.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8940 -prefsLen 37391 -prefMapHandle 7768 -prefMapSize 270279 -jsInitHandle 10192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9144 -initialChannelId {94ce7b53-6ded-4641-ab93-61ff0bf356fb} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9016 -prefsLen 37391 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 7876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1476 -initialChannelId {97d88416-72da-47cf-a1ac-576c12fb99fb} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9844 -prefsLen 37391 -prefMapHandle 3504 -prefMapSize 270279 -jsInitHandle 3168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10432 -initialChannelId {c08e296a-f095-422e-a757-a7dc24de99bc} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10756 -prefsLen 37391 -prefMapHandle 10764 -prefMapSize 270279 -jsInitHandle 10768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9996 -initialChannelId {ee77f218-f3cd-409d-823b-88e36760c0dd} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10736 -prefsLen 37391 -prefMapHandle 10164 -prefMapSize 270279 -jsInitHandle 10320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10776 -initialChannelId {8bf84e27-8558-4ba7-8b2a-4a2b6faff692} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8880 -prefsLen 37391 -prefMapHandle 10796 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10524 -initialChannelId {45c52c12-b5ba-45f0-9050-912ce83f9f2c} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10912 -prefsLen 37391 -prefMapHandle 10916 -prefMapSize 270279 -jsInitHandle 10920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10884 -initialChannelId {9cfcf388-b2c3-4640-9960-9d7c9c718a96} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11000 -prefsLen 37391 -prefMapHandle 10996 -prefMapSize 270279 -jsInitHandle 10992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10956 -initialChannelId {714838d2-32b0-461e-b41f-ec3e947ffd1c} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11292 -prefsLen 37391 -prefMapHandle 11296 -prefMapSize 270279 -jsInitHandle 11300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11308 -initialChannelId {04c21f1f-3a75-4d18-b877-3a6ea332a547} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap32484:118:7zEvent285351⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\Danganronpa Trigger Happy Havoc\DR1_us.exe"C:\Users\Admin\Downloads\Danganronpa Trigger Happy Havoc\DR1_us.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\Danganronpa Trigger Happy Havoc\Launcher.exe"C:\Users\Admin\Downloads\Danganronpa Trigger Happy Havoc\Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Danganronpa Trigger Happy Havoc\DR1_us.exe"C:\Users\Admin\Downloads\Danganronpa Trigger Happy Havoc\DR1_us.exe" -ss -d3d2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\_CommonRedist\dxwebsetup.exe"C:\Users\Admin\Downloads\_CommonRedist\dxwebsetup.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_24_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_25_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_26_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_27_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_28_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_29_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_30_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_31_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_32_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_00_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_33_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_33_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_34_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_34_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_8_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_35_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_35_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_9_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx9_36_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_36_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe X3DAudio1_2_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT2_10_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_37_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_37_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe X3DAudio1_3_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_0_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_0_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_38_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_38_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe X3DAudio1_4_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_39_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_39_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe X3DAudio1_5_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_40_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_40_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe X3DAudio1_6_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_41_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_41_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx11_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dcsx_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DCompiler_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe X3DAudio1_7_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DX9_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx10_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dx11_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe d3dcsx_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe D3DCompiler_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XACT3_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX3F12.tmp\infinst.exe XAudio2_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38e6055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
CrashpadMetrics-active.pma
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
data_0
data_1
data_2
data_3
the-real-index
the-real-index~RFe5865d9.TMP
SiteList-Enterprise.json
LOG
EdgeHubAppUsageSQLite.db
000003.log
LOG
ExtensionActivityEdge
HubApps
000003.log
LOG
Cookies
Network Persistent State
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
Sdch Dictionaries
TransportSecurity
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe585222.TMP
index.txt
000003.log
LOG
the-real-index
the-real-index~RFe5865aa.TMP
LOG
LOG
sync_diagnostic.log
sync_diagnostic.log
CURRENT
MANIFEST-000001
Web Data
default_cloud_config.json
favorites_diagnostic.log
000003.log
LOG
000003.log
LOG
domain_actions.dll
data_1
Last Browser
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
data_1
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
first_party_sets.db
first_party_sets.db-journal
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
activity-stream.contile.json
12347
13110
21217
26083
29314
5347
6153
00EBCA87A3CD83950DDA39B6E2B88D0F2719F0F1
14D97D570ED7A05445CEC4DF7C72EB93935B1DB5
158530FEEBF51F6B77E1D8349D09BF5AD582C1FD
25F62F07AD7F6E635E81274D28AA7B6DA6583687
2851F94679B7CC3073FAEE3584065AA7CCAFD95A
325D20CCAE69D22199DE7BEC3B7C50428EEE0F11
430D12E670DDD8FAE8B8C61E3119422785DF92D6
4616698901C3F32FD6E846215C7CD303E3E3D1B7
4C044D9048B6E5657179494E0A82575A2905D259
526A9611FDC665F215FFC0195D336836170625B9
588A68414962D518F6F68C746D613F8B425095DE
8EB5D78CA237327082142EF649F1C031A86717F6
AAA0FA429A54A56F5B82B78D26CE3B77B26BDB86
ABD306E67A677B0160AE5886BECB81DF4A5EBDB0
B8D1EE33BE6C8AB440B26D168CC632B94279427C
CA456F3BD32881AE3EBD4905F3377802FE67D81B
D8FE3BD13A4966A1C83D5E310EC2999B012F2A4A
DC95A2DFB1C7D1F30BF76CCD068D0290DBDF1123
E25C146CB37BF486A3565D52904D1F01739E580F
EE23D245DA292FB0269065B3CA3D5169F6803FB1
F58F0605C722D0D848D03D88AC8E3E50223F57B0
F77031209AF30434CDA01CB0465C927FA0C1F40C
FF65710172FF8C224A4F5FA50C711B8955710ECF
5167ce2c-f989-46e1-9004-8a73d3f6d6f7.tmp
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.audiovideoplayback.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
dxupdate.cif
dxupdate.dll
dxwsetup.cif
cv_debug.log
tmp-j3i.xpi
tmpaddon
tmpaddon
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
pageload
0bbef393-dcf3-48b5-ac4e-26c4b795b125
3304513e-9475-4770-8a0f-06055f5f56f1
331ab6a4-7c20-43c9-ac7e-8c87333ff609
34051ec0-cfa0-46c8-bf09-f0ac4b5d36a4
3764fa30-4eb4-4d32-b99c-a73af01e2f5e
5ac12ab1-9a6a-4089-bfb8-732fe6d77eee
a886932c-e250-4f4b-b81b-dd333e184c57
dc142e9a-e451-4078-bc79-ba81d7c43839
ef93b3b4-80e8-4e21-bd5a-d566590fd921
fa082595-2b02-4aaf-9e4d-35a4550bd3dc
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
3619099707vealluiddoamt-es-cbir.sqlite
{0c155ed2-dab5-4445-bf68-c8047d104fae}.final
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
7z2601-x64.exe
DirectX.log
DirectX.log
DirectX.log
DirectX.log
D3DX9_41.dll
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xact_x64.cab
Apr2006_xact_x86.cab
Apr2006_xinput_x86.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_d3dx10_33_x86.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_xact_x64.cab
Apr2007_xact_x86.cab
Apr2007_xinput_x64.cab
Apr2007_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
Aug2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_d3dx10_35_x86.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_xact_x64.cab
Aug2007_xact_x86.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_d3dx10_39_x86.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_xact_x64.cab
Aug2008_xact_x86.cab
Aug2008_xaudio_x64.cab
Aug2008_xaudio_x86.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_D3DCompiler_42_x86.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_xact_x64.cab
Aug2009_xact_x86.cab
Aug2009_xaudio_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx10_00_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_d3dx9_32_x86.cab
Dec2006_xact_x64.cab
Dec2006_xact_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Feb2006_xact_x64.cab
Feb2007_xact_x64.cab
Feb2007_xact_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_xact_x64.cab
Feb2010_xact_x86.cab
Feb2010_xaudio_x64.cab
Feb2010_xaudio_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_d3dx10_34_x86.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_xact_x64.cab
Jun2007_xact_x86.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_d3dx10_38_x86.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_xact_x64.cab
Jun2008_xact_x86.cab
Jun2008_xaudio_x64.cab
Jun2008_xaudio_x86.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_D3DCompiler_43_x86.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_xact_x64.cab
Jun2010_xact_x86.cab
Jun2010_xaudio_x64.cab
Jun2010_xaudio_x86.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_d3dx10_37_x86.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_x3daudio_x86.cab
Mar2008_xact_x64.cab
Mar2008_xact_x86.cab
Mar2008_xaudio_x64.cab
Mar2008_xaudio_x86.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_d3dx10_41_x86.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_xact_x64.cab
Mar2009_xact_x86.cab
Mar2009_xaudio_x64.cab
Mar2009_xaudio_x86.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_d3dx10_36_x86.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_xact_x86.cab
Nov2008_d3dx10_40_x64.cab
Nov2008_d3dx10_40_x86.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_xact_x64.cab
Nov2008_xact_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_xaudio_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
Oct2006_xact_x64.cab
Oct2006_xact_x86.cab
dsetup.dll
dsetup32.dll
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
SET70CF.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD6CE7.tmp
OLD8764.tmp
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
dxupdate.cab
Apr2006_xinput_x64.cab
Feb2006_xact_x86.cab
Nov2007_xact_x64.cab
Mar2008_x3daudio_x64.cab
Mar2009_x3daudio_x86.cab
Aug2009_xaudio_x64.cab
memory/852-4961-0x0000000070FB0000-0x0000000071094000-memory.dmp
memory/852-4966-0x0000000070FB0000-0x0000000071094000-memory.dmp
memory/852-4965-0x000000006C740000-0x000000006C849000-memory.dmp
memory/2180-4949-0x0000000074DC0000-0x0000000074EA4000-memory.dmp
memory/2180-4950-0x000000006C740000-0x000000006C849000-memory.dmp
memory/2344-4448-0x00000184F0E30000-0x00000184F0E60000-memory.dmp
memory/2652-479-0x000001CD01ED0000-0x000001CD01F00000-memory.dmp
memory/4816-21058-0x0000000000520000-0x0000000000550000-memory.dmp
memory/5184-23002-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/5428-21942-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/5628-1347-0x0000021227ED0000-0x0000021227F00000-memory.dmp
memory/5912-4948-0x00000245C6110000-0x00000245C6140000-memory.dmp
memory/5912-4921-0x00000245C6110000-0x00000245C6140000-memory.dmp
memory/6212-4963-0x000000006C740000-0x000000006C849000-memory.dmp
memory/6240-22516-0x0000000000420000-0x0000000000450000-memory.dmp
memory/6540-23326-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/6980-24334-0x00000000020F0000-0x0000000002159000-memory.dmp
memory/6980-24336-0x00000000006D0000-0x0000000000700000-memory.dmp
memory/7124-4823-0x00000000001B0000-0x00000000001E0000-memory.dmp
memory/7304-23707-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/7500-24030-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/7512-22435-0x0000000000740000-0x0000000000770000-memory.dmp
memory/7512-22433-0x0000000002080000-0x00000000020DE000-memory.dmp
memory/7640-23616-0x00000000007C0000-0x00000000007F0000-memory.dmp
memory/7700-22428-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/8196-21861-0x0000000001500000-0x0000000001530000-memory.dmp
memory/8204-22887-0x0000000000520000-0x0000000000550000-memory.dmp
memory/8304-21856-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/8736-23943-0x0000000001F40000-0x0000000001FA9000-memory.dmp
memory/8736-23945-0x00000000005E0000-0x0000000000610000-memory.dmp
memory/8824-22238-0x00000000007A0000-0x00000000007D0000-memory.dmp
memory/8952-21433-0x0000000000EA0000-0x0000000000ED0000-memory.dmp
memory/9064-21428-0x0000000000420000-0x0000000000450000-memory.dmp
memory/9220-21516-0x0000000000420000-0x0000000000450000-memory.dmp
memory/9456-23103-0x0000000000420000-0x0000000000450000-memory.dmp
memory/9516-21144-0x0000000000420000-0x0000000000450000-memory.dmp
memory/10044-24522-0x0000000000F50000-0x0000000000F80000-memory.dmp
memory/10264-21237-0x00000000007A0000-0x00000000007D0000-memory.dmp
memory/10520-23241-0x0000000000690000-0x00000000006C0000-memory.dmp
memory/10520-23239-0x0000000002140000-0x00000000021A6000-memory.dmp
memory/10640-23233-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/10712-21322-0x00000000007B0000-0x00000000007E0000-memory.dmp
memory/10792-22622-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/11172-23808-0x00000000007A0000-0x00000000007D0000-memory.dmp
memory/11404-23938-0x00000000007C0000-0x00000000007F0000-memory.dmp
memory/11600-22046-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/11880-22326-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/11920-22051-0x0000000000C10000-0x0000000000C40000-memory.dmp
memory/11936-24241-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/12116-24131-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/12344-23409-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/12416-24421-0x0000000001250000-0x0000000001280000-memory.dmp
memory/12608-23510-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/13028-22243-0x0000000000910000-0x0000000000940000-memory.dmp
memory/13256-20968-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/13308-22132-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/13676-24329-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/13728-24693-0x0000000000600000-0x0000000000630000-memory.dmp
memory/13916-24605-0x0000000000D10000-0x0000000000D40000-memory.dmp
memory/13960-22757-0x0000000002110000-0x0000000002174000-memory.dmp
memory/13960-22759-0x0000000000690000-0x00000000006C0000-memory.dmp
memory/14328-22751-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/14564-24698-0x00000000005D0000-0x0000000000600000-memory.dmp
memory/14620-20883-0x0000000000820000-0x0000000000850000-memory.dmp
memory/14632-23621-0x0000000000CB0000-0x0000000000CE0000-memory.dmp
memory/15084-22892-0x00000000012C0000-0x00000000012F0000-memory.dmp
memory/15336-24788-0x0000000000F20000-0x0000000000F50000-memory.dmp