Analysis
- user interaction
yes - max time kernel
1743s - max time network
577s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 10:52
General
- Target New Text Document.txt
- Size 204B
- Sample260718-mymlqscs8x
- SHA256 d2de3b9ce25f80e25ddcbd2ad43385903137c06f974b80fc8430b37c01a85fbb
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 6 IoCs
- Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 28 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 34 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {bc2ee121-8e02-4672-8c42-986955a3986e} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2340 -initialChannelId {1d374f2d-fbed-4fe4-af69-ccc7c4205e8e} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3712 -prefsLen 27276 -prefMapHandle 3716 -prefMapSize 270279 -jsInitHandle 3720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3728 -initialChannelId {16dfcdb5-3cd2-4c52-81aa-f9387fff22d0} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3900 -prefsLen 27276 -prefMapHandle 3904 -prefMapSize 270279 -ipcHandle 3856 -initialChannelId {0bc5546e-bb8b-48ef-99e9-30e174e576c8} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2924 -prefsLen 34775 -prefMapHandle 2928 -prefMapSize 270279 -jsInitHandle 4316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4324 -initialChannelId {6eeb8914-e102-4246-8bb0-7502ccbc9873} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4564 -prefsLen 35012 -prefMapHandle 4636 -prefMapSize 270279 -ipcHandle 4856 -initialChannelId {474d6c92-9e28-4c4e-992f-27a4b0e0d345} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 32900 -prefMapHandle 5000 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {b724e5d8-eeab-47f9-a7de-3690a23a3207} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32952 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {25e7c35c-a63a-40ee-aa7a-ab73541c8a7b} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {df2d901d-0da9-47c3-ba73-8497462373a9} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3312 -prefsLen 33031 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6204 -initialChannelId {a52c4e18-f86f-48c3-bc04-a5fff7439869} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6608 -prefsLen 33031 -prefMapHandle 6244 -prefMapSize 270279 -jsInitHandle 6224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6620 -initialChannelId {7d25bed0-baa3-4ebc-a906-9b6027806c72} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6644 -prefsLen 35160 -prefMapHandle 6348 -prefMapSize 270279 -ipcHandle 6624 -initialChannelId {532560d6-efd1-41d0-b8c7-3caefb42f2b4} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6944 -prefsLen 35160 -prefMapHandle 6960 -prefMapSize 270279 -ipcHandle 6984 -initialChannelId {82596bd0-aec2-478a-8a9e-9b7d1a6d09d1} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4672 -prefsLen 35681 -prefMapHandle 7528 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7364 -initialChannelId {caf2c08b-b77d-4c95-a1e7-1b2e415fb072} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7616 -prefsLen 36718 -prefMapHandle 7620 -prefMapSize 270279 -jsInitHandle 7560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7532 -initialChannelId {f14d95c7-78d3-4167-b225-42d2450aafbd} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\game-mirrors.edge-(41238).rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\setup_mirrors_edge_1.01_jpfix_(41238).exe"C:\Users\Admin\Desktop\setup_mirrors_edge_1.01_jpfix_(41238).exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JHDMA.tmp\setup_mirrors_edge_1.01_jpfix_(41238).tmp"C:\Users\Admin\AppData\Local\Temp\is-JHDMA.tmp\setup_mirrors_edge_1.01_jpfix_(41238).tmp" /SL5="$602D8,192512,0,C:\Users\Admin\Desktop\setup_mirrors_edge_1.01_jpfix_(41238).exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
F:\Mirror's Edge\__redist\MSVC2005\vcredist_x86.exe"F:\Mirror's Edge\__redist\MSVC2005\vcredist_x86.exe" /q:a /c:\"VCREDI~3.EXE /q:a /c:\"\"msiexec /i vcredist.msi /qb\"\" \"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
F:\Mirror's Edge\__redist\DirectX\DXSETUP.exe"F:\Mirror's Edge\__redist\DirectX\DXSETUP.exe" /silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_24_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_25_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_26_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_27_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_28_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_29_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_30_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_1_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_2_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_3_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_31_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_4_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_32_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_00_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_5_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_6_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_33_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_33_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_7_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_34_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_34_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_8_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_35_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_35_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_9_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx9_36_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_36_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe X3DAudio1_2_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT2_10_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_37_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_37_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe X3DAudio1_3_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_0_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_0_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_38_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_38_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe X3DAudio1_4_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_1_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_1_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_39_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_39_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_2_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_2_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe X3DAudio1_5_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_3_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_3_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_40_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_40_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe X3DAudio1_6_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_4_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_4_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_41_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_41_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_42_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_42_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx11_42_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dcsx_42_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DCompiler_42_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_5_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_5_x64.inf4⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe X3DAudio1_7_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_6_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_6_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DX9_43_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx10_43_x64.inf4⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dx11_43_x64.inf4⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe d3dcsx_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe D3DCompiler_43_x64.inf4⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XACT3_7_x64.inf4⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX2F5D.tmp\infinst.exe XAudio2_7_x64.inf4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll4⤵
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "F:\Mirror's Edge\__redist\PHYSXLEGACY\PhysX-9.13.0604-SystemSoftware-Legacy.msi" /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
F:\Mirror's Edge\__redist\PHYSX\PhysX-9.17.0524-SystemSoftware.exe"F:\Mirror's Edge\__redist\PHYSX\PhysX-9.17.0524-SystemSoftware.exe" -s3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\NVIDIA\PhysX\Temp\setup.exe"C:\NVIDIA\PhysX\Temp\setup.exe" -s4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\RunDll32.EXEC:\Windows\SysWOW64\RunDll32.EXE C:\Users\Admin\AppData\Local\Temp\NVI2_29.DLL,DeferredDelete {AF1E4361-9E52-430D-96E4-95EBDD61EFD5} 5624 C:\NVIDIA\PhysX\Temp\setup.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
F:\Mirror's Edge\__redist\ISI\scriptInterpreter.exe"F:\Mirror's Edge\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="F:\Mirror's Edge\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="F:\Mirror's Edge" /productId="1893001152" /buildId="53689294112468858" /versionName="1.01 JPfix" /Language="English" /LANG="english"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-QAO8P.tmp\scriptInterpreter.tmp"C:\Users\Admin\AppData\Local\Temp\is-QAO8P.tmp\scriptInterpreter.tmp" /SL5="$A0224,662929,192512,F:\Mirror's Edge\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="F:\Mirror's Edge\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="F:\Mirror's Edge" /productId="1893001152" /buildId="53689294112468858" /versionName="1.01 JPfix" /Language="English" /LANG="english"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Users\Admin\Documents\EA Games\Mirror's Edge" /grant Everyone:(OI)(CI)F5⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -noexit -command Set-Location -literalPath 'F:\Mirror's Edge'1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2064 -prefsLen 31495 -prefMapHandle 2068 -prefMapSize 271070 -ipcHandle 2140 -initialChannelId {98c292c0-d8ed-45a2-94fd-31c9b105607d} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2340 -prefsLen 31495 -prefMapHandle 2384 -prefMapSize 271070 -ipcHandle 2428 -initialChannelId {e8fbf184-6f13-49d1-92a2-04cbbb431a08} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3440 -prefsLen 32103 -prefMapHandle 3444 -prefMapSize 271070 -jsInitHandle 3448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3456 -initialChannelId {e828e957-e237-4d94-83b0-fe0fe06d0193} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3640 -prefsLen 32103 -prefMapHandle 3644 -prefMapSize 271070 -ipcHandle 3652 -initialChannelId {d5f3f4e6-cba2-458f-ac11-ca9d0f96b2e1} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4412 -prefsLen 39659 -prefMapHandle 4416 -prefMapSize 271070 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {8af27cbb-de3c-457f-9928-ecdd8d8adb31} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 39766 -prefMapHandle 4992 -prefMapSize 271070 -ipcHandle 4272 -initialChannelId {ea2271a3-b468-4904-8557-6b91e49e1e22} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 36602 -prefMapHandle 5436 -prefMapSize 271070 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {ebef31fa-aaab-46de-b3c8-d70c108c250c} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 36602 -prefMapHandle 5628 -prefMapSize 271070 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {68550eac-f01c-4a67-9c0a-b183747f8f2f} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 36602 -prefMapHandle 5820 -prefMapSize 271070 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {eb78b36c-6d38-4756-97a8-87a47b641f3e} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6292 -prefsLen 36642 -prefMapHandle 6296 -prefMapSize 271070 -jsInitHandle 6284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {2e25357b-2655-4034-9888-646e2f49dc41} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6564 -prefsLen 36642 -prefMapHandle 6572 -prefMapSize 271070 -jsInitHandle 6544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6580 -initialChannelId {5b045795-4278-4d60-8ae8-7899cb961fea} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6808 -prefsLen 36642 -prefMapHandle 6812 -prefMapSize 271070 -jsInitHandle 6816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6760 -initialChannelId {7b5ff7d7-266e-445d-95fa-876eff22807b} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 36642 -prefMapHandle 6028 -prefMapSize 271070 -jsInitHandle 6024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {ea7c6d34-3b16-4936-aa0e-929001d8fb62} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4156 -prefsLen 36642 -prefMapHandle 4160 -prefMapSize 271070 -jsInitHandle 4164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4796 -initialChannelId {2b8dedfb-753e-44ae-96ee-22d96262f84f} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6920 -prefsLen 36642 -prefMapHandle 6924 -prefMapSize 271070 -jsInitHandle 6908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6756 -initialChannelId {b469dadf-a114-4124-9fdd-e30fc3c2db6f} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 36642 -prefMapHandle 2864 -prefMapSize 271070 -jsInitHandle 4808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4796 -initialChannelId {489bde7b-59dd-46d3-9a1b-0063fa7ee0a3} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7564 -prefsLen 36642 -prefMapHandle 7488 -prefMapSize 271070 -jsInitHandle 6136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7588 -initialChannelId {7657a00d-574b-4f9c-910c-724a64e0aeef} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7804 -prefsLen 36642 -prefMapHandle 7808 -prefMapSize 271070 -jsInitHandle 7812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7820 -initialChannelId {c243d61d-18cd-4623-8914-f662dd78a4c1} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6428 -prefsLen 36642 -prefMapHandle 7464 -prefMapSize 271070 -jsInitHandle 7536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {3a8897b3-0250-48e1-8eba-d110536c734f} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8200 -prefsLen 36642 -prefMapHandle 8204 -prefMapSize 271070 -jsInitHandle 8208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8216 -initialChannelId {3664eae1-e8ec-4771-b3fa-528ce6ef5e44} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5644 -prefsLen 39858 -prefMapHandle 8064 -prefMapSize 271070 -ipcHandle 5508 -initialChannelId {f5f766d0-529f-4474-a54c-e8ea1750620c} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 utility3⤵
- Checks processor information in registry
-
-
-
F:\Mirror's Edge\Binaries\MirrorsEdge.exe"F:\Mirror's Edge\Binaries\MirrorsEdge.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c0 0x5201⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e6eafac.rbs
setup.exe
PhysXDevice.dll
PhysXDevice64.dll
PhysXLoader.dll
PhysXLoader64.dll
PhysXUpdateLoader.dll
PhysXUpdateLoader64.dll
cudart32_65.dll
cudart64_65.dll
GRB_1_x86.dll
APEX_ParticlesCHECKED_x86.dll
APEX_TurbulenceFSCHECKED_x86.dll
PhysX3GpuCHECKED_x86.dll
PhysXCore.dll
PhysXCore.dll
PhysXCore.dll
PhysXCore.dll
APEX_BasicFSCHECKED_x86.dll
APEX_BasicIOSCHECKED_x86.dll
APEX_FieldSamplerCHECKED_x86.dll
APEX_IOFXCHECKED_x86.dll
APEX_TurbulenceFSCHECKED_x86.dll
PhysX3GpuCHECKED_x86.dll
cudart32_65.dll
PhysXCore.dll
PhysXCore.dll
APEX_Particles_x64.dll
APEX_TurbulenceFS_x64.dll
PhysX3Gpu_x64.dll
APEX_Particles_x86.dll
APEX_TurbulenceFS_x86.dll
PhysX3Gpu_x86.dll
A_Ball_Trans.ico
PhysXCore.dll
PhysXCore.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCore.dll
PhysXCooking.dll
PhysXCooking64.dll
PhysXCore.dll
PhysXCore64.dll
NVI2.dll
NVI2UI.DLL
NVPrxy32.DLL
NVPrxy64.DLL
0000.ui.strings
0409.ui.forms
Setup.cfg
uninstall.dll
Support.url
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.weather_feed.json
4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
74B44454326FC64D7635D63329D071507BE4676B
9512A4488B00CC053350DAC32D417B4A35C11513
D9dmTW_rqPdotQGQEDmP5IwFMDlgBjlzBi_DjMrYztE=.ico
nb_model_build_attachment_arts_and_entertainment.json
nb_model_build_attachment_autos_and_vehicles.json
nb_model_build_attachment_beauty_and_fitness.json
nb_model_build_attachment_blogging_resources_and_services.json
nb_model_build_attachment_books_and_literature.json
nb_model_build_attachment_business_and_industrial.json
nb_model_build_attachment_computers_and_electronics.json
nb_model_build_attachment_finance.json
nb_model_build_attachment_food_and_drink.json
nb_model_build_attachment_games.json
nb_model_build_attachment_health.json
nb_model_build_attachment_hobbies_and_leisure.json
nb_model_build_attachment_home_and_garden.json
nb_model_build_attachment_internet_and_telecom.json
nb_model_build_attachment_jobs_and_education.json
nb_model_build_attachment_law_and_government.json
nb_model_build_attachment_online_communities.json
nb_model_build_attachment_people_and_society.json
nb_model_build_attachment_pets_and_animals.json
nb_model_build_attachment_real_estate.json
nb_model_build_attachment_reference.json
nb_model_build_attachment_science.json
nb_model_build_attachment_shopping.json
nb_model_build_attachment_sports.json
nb_model_build_attachment_travel.json
recipe_attachment.json
webext.sc.lz4
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_mdx1_x86_archive.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxdllreg_x86.inf
dxupdate.dll
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2904.0_x86.inf
microsoft.directx.direct3d.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
microsoft.directx.directdraw.dll
microsoft.directx.directinput.dll
microsoft.directx.directplay.dll
microsoft.directx.dll
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2005_xinput_x64.inf
oct2005_xinput_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
__PSScriptPolicyTest_uww2fwe2.aau.ps1
002adbe92036a4d7f71d44712eb01852
011457607ea6c65d2bcc301515008a36
is-C4FV9.tmp
025b92cd3c22955dff03e3136ade09f7
0299dbcfd94e1b03fafb120c71de4417
02b699d9bcac8483448310bb9648cbfd
02d491b06b66c540161173b054fafa98
0348537d032e405c8fab84e9d473cac4
03503fd7826f06a3b28608311384127b
036716dbf2717db2aabe40742bb1cbf6
039d134d376f15a0acd97d9c6cd34a1c
0403cc0e86f51f2fc3c607fe87258b44
051ba5fceb9c477564b7528ed0fb0e93
0539ee29ac256b1341e937ddfd82919b
077bdacd22685679dd262125631497dc
081c286b14a5085ea7a9360b0a4baea6
088c0da0fb065b8651c0a2f8dc56ca31
08b0e55a0714f9ec7069e8579924e380
0954de0f40a358c61ad0960727d1edaa
09def3f676724965ee7b07911ea32e7f
0a6736ba2965b1a3724322760b445c60
0c2ffa7fc4f4e4b149158e5722feb35c
0d23cfccb8d1b305cba369ff160c37c9
0d92124997fa33252c4bc239434c6293
0dc04b5489bc2e185bcf437daa836486
0e9e81f52635c8b1a28d6663b2bb455b
0fba5bd107e80397a97fc04905e85423
0fc752d98b8dc34355ae132156eed748
112c5f9435bd2d5fd76c5e226ec796ce
11b1009155fcb59bc01fa02b4cbba329
1207658754_english.jpg
1207658926_english.jpg
1207658997_english.jpg
1207659240_english.jpg
1207664703_english.jpg
123d52cab702a6f22afb982c194023a2
127276e232b4f45ca745b24f60a4fd56
128109c3ae4f95d348804d6a9bc2acfe
1298023f64c9bf236e98bcf6c8e3413a
12cb2d29fac9dd3c54b85b531f7f8fe7
1421404887_english.jpg
1422357892_english.jpg
1425302464_english.jpg
1430234218_english.jpg
1436866438_english.jpg
1436951929_english.jpg
1437060567_english.jpg
1441717336_english.jpg
1443519435_english.jpg
1444400383_english.jpg
1444812654_english.jpg
1446823701_english.jpg
1449139823_english.jpg
1457531523_english.jpg
1458053826_english.jpg
1459441475_english.jpg
141edfee4254dd2a362e4451da2b4c04
1444c228cc7327bfe4d11230c6c68e10
1535e46c93ec5691b85afb7b0ea618b9
15a962c5a82cd4a4e5d1727e2b192931
165277b5944872a006320d92309c31c4
17f7292960552c3c93b476c95988efd2
1976935743_english.jpg
191deb3945fd11208625eed5fa4f4c11
1a1aa8ad5e0d71c3a7e588f5d361e778
1a65ade5b9bbbbe983d327339e220140
1a6e86bbf1bb0b7e61e8da016108b3a1
1a98a9751e87f8903bcd9b2770e73e38
1ac0b8aad2af261f4e118de193c75b74
1ad31e6469306c854c60cbb114945007
1c210819854e9f5d18576b859260d907
1c3fd6011c23adf6f9991bd67383681d
1c793774bf0a2835def9132d7c038bc0
1c79b46db84326aa2a949a8dae8b8aa4
1c8bb47e75ce8f2a012bb71697a03ea8
is-KACMS.tmp
1cf02b0a52c28309d2f907ffe147a82e
1e2f3ce956fec9330560eedd43f84f91
1ef2357b5789542a7cc5143a1ef10352
1f0c7bdcf4480307a4477c17ace876e0
1f29cc501ec8a10a5841100b17667096
1fd59b60a111f59ee26df629fec94847
2140144872_english.jpg
2171b4caaec3d89be4dc5f4a39f7e4de
2175ae833fc0044bcc0aeb16e0997a57
217fd2b8b7aea61e08e79067bba5e1e6
21f44700abedd1b7df34cadabbf10859
2247b166541ab005b40827646d0a2559
24353f186f7fff7da26a996498d6fac5
2459325ffdfafc17b76dc8f375fc6d8c
2484a5f2c18c44c4f83ccabedaebbd5f
24fa2db7e42a522654d5993b7a3324b0
25746dd60164b85b01dacec2b5647681
2578d2d7714d09b89a38e4bece590156
2670470e5221598e284630b8b7957cd7
26a8dbc90ea60769d9558dc28417e602
26bc87b04532faa58df1548069196312
292d3fa70b6a11bc6635b39fd8c802d9
293a2a51979f6c95ba64372c2f6285af
2a023fb215e744271a32b2a536230c0f
2a4a109b7316b92870d297b327197543
2be5ad9a977078ccdfcce36f59749aec
2c02cda32b3f282446fee6dfc5794e19
2c6ec3ffe9a52ba9ed40cd79a96fbaa7
2c7eacbb719506271efbf202a85c49d6
2c8f3142852d8736ba89757fd49c992b
2cfd16300f58a46815307e2bb9005543
2e675bc0c72ac5752923c289fe9ac766
2eb5617a4af1afa7e23a7f96aea255c3
2fa5c5d0014a7cbe90337c8da2f567b3
3163c5d4dbc417c49c8ca9256a33f5a0
31ad853bbb6b7d10f7103f4ac21a1162
335504fdf84471bae03860adb41ba926
34c2f0fc991c8e3e63ab90e58f0eebd3
3527e237868a3c88e0404bf1ef9103a3
35424ca375bcadf3ff9535467d4880ab
36d9825317d6a15ce9bb53fa3acb1260
378dab4ccdb68dee0e50012262885517
379550d05c73dbb23304beaa52166d7d
3820b49891f1833ae650a36697b87ebc
3825b8943f39f7f99bd2d724f34d2ee9
39097f1fc2bf9c2a3951aca4ff344a53
3932ec16e9546e997d2a43028a6ac49c
39fc882811cf18e6534ad943666cdfad
3b3aad213c0f3f1cf4c845cc57ae1412
3b501313f24dab051d3415bea9db820a
3bb1cba79b827488b5eba45cc128c449
3c3a9df2a5b5dd30d81b7d4bbabfc1d3
3c42ef727c2471550e45d8cb73a2b7be
3c8c542c0cf2cbd4a965d656af803dc6
3cd2aece17e9b026777a52337742eb97
3d28557fa7fc94cb1326294a15377cec
3d6d70e7c16d37f585794bce074ed0c6
3db558ba562fd330c018c7a4e3424d62
3e7b52b77bf22bc4377203cc64e96a61
3f3f01663b2f0bfdf073b56356c0f053
3f4c539f810242df94d52127c9edbefd
4125f57605e3e0b6e9d6045a0f63c43f
412eac65bfefa2dca5009650efd56c72
41c435de95c62fe30cead13cbea65ccf
426e28cf18e77d96c4e462c5bae65e23
435468f1188e5b37f4cc0eb9ac72d232
is-GHEP9.tmp
44365f321b59aa4a2121c00d1682e1e9
452499124dfe5634cc840e1dd941d454
452a3bfc8694ade455205d7a3dc8a8a7
45569f0f7ce28e3cfa6ff273e26a3bae
4572c196593be6d451bf557f5dfcc0ae
463d1bb58e422690cfe25082d2d81ebe
47829885214cf92672d4e22240941cba
47d869613f92be74df804990122b69d0
48f95fe63aaab353e687abda803b819c
4996ce57c8583c2aa9e7121f7d5f4e07
4a8831aca2eb78475fdcf2f26ea0692a
4b758d284f6fc9ac0073bb3a0ca9a721
4b77e17d77ef0b9a4755f09ad90be06a
4bb8e1e1d41c1eabdf8da7319d3b8e38
4bdd427b1d687e58cbc838a95e382bdf
4bfc12043583c799f28da66bf8e2a5d5
4c07f61f55e34b97aac18413cfdfaa75
4d1c7d933e8a7fa48de5cba45adc01db
5068207e2d1b29e0417c4184e5947167
50c207feca83cacc235900c89424647e
50d454d22ff5b0993dfc4ddf2c4e34bf
5167b9166836b91e32f750ba47ffff9e
516ac3f30f614b216b6d92b68641ca9b
517a63b26450180744871425f54d42f1
5188c6b13a7580b2eef1924febe0c251
51ec443c0140ddf27ca1ddf69af5f703
5263595d077755f4966ef231bfba22db
52d0787f714d150878970b24db48e924
531a67b75c3d2557d1251ff6a72a57d4
5329d2b5c235c3fd793ff5e1fb199300
5376f06fea3edb8b08abec36ebc53f8b
539a6241e625ce306b4c8a5aa1477aa6
53aa4ce0fe6b321af91bb6fc659fe470
541072df4e66bdd480332651c8a69bbf
5428624ac4fb00bf59c10c2b415e9496
54cd9fbdb2dafcbcd32a6c519a1405ee
5522f136962a4a8b3d3af56643db0929
55729e728bb53a299f705bbee211c517
56725d01fe9c990d2f62bb2b8c3fab3c
56a7fb614d33b05ebfa17bcc87231d6e
57692a0b600469abfc014ad9bb1bdd4e
57701e56fb63571a7d56669ed70725cc
5770d1013f0143c545a36348f864952e
57a279a0c7a58fc9a76e6eb5a748baa2
58eb292b5661aeec5ed5f34a77a1da3c
594cf3d80093368e78a261ac60322cf4
5990f4e96d213118b8a78915d4ca0365
59f21dd7580a68aa783ac9e294823cab
5b09355f67305bfcd2d59d1100633899
5b550a9a2d61d289eb5a90697b25b946
5b6396c3baeb5995c65956038eda8a98
5bf9f24f55b86f66ea53edb8c64d1b0b
5c509a67c621e3149412fcfffb1b0312
5ce4d01c9a16d0551b01669d8273621e
5cf9a9ce923eea804858139af451087b
5d45dc729fae8b9ad83b89635fa3a0b9
5e3ba609c37a30c238974d624b0f05e3
5e6c9fc201242172d31db3d6a31f152d
5e8a7e8d4eadb7c0081ddfff8d2bde4c
5eb2552a3ec486cfd5c9e77979ba78f7
5ed20269f220392464da433733fadaf0
5f0a74d172a9db0b018456963b36f0a2
5fa64232b3d200ab28b4265bde12bcc1
602f8e8050b3ad598ed64a9cfb4f5d77
60f2218aaa130c3ca6507d2684d2127f
611b0e5b141a4b49dab13402a2b864b3
633502eaa62bddb64fc0b9f59d209218
63bf476bbfce23ef690de47c1796729c
63c685b34249831b90e0a3015ac484f2
63df97b945f344e51b19526cfa50927b
6420a1cf24c67d573d22d898225db60b
643992c97397fbd32b2222ed689b7b8b
651f8a630464e48ce54d558f275735ac
65306053c27fb4ad66a56455533892ef
65c211017052fb089b0e3cfec61cb3fe
65d96ec97afb20253e5926765e23110d
67545bf1208e7dbc34641199eb27aff2
68326dd4bb3f48234699e3092ebb103e
6949be2986f1991e5e5830119578db99
6a6ae2ffb0b27bbaf24ebd4df57921af
6ac1d023998bec5f8de7546c83e5f880
6aeebf7dbd5e593b4ca03a090880a013
6be5944e71130f695d57a599552973da
6c17c95db3d65849a0ac87198f9d3b7b
6c74b87053d38e325d0d70bc9ad23b62
6cefa3f1d39a65a792e62dc0dd349524
6d34a80c4de465b88b11e0dcb87593a2
6da77d6b2c041ea1170cde93f5dfcc60
6dc107270f74e76b2ff086d9f2e938c4
6dfddabca43a0f1421657f2a0770edbd
6f2fe727dbc6932bdf1f65cbf82a198f
6f5c5142bdba6f2a58bec1b9fb7cf75c
6ff379b4d5712ccfb20a1a1398093e92
7071e63dc59ec2cf28a3ca51fd94d695
7076554d7b9c130a5702a0bc885065d6
71070242875e63de879d076583bc241f
71893e5463dd3dff088708d9e3e2f745
722f5a62568806e3293e3f50108c9b6d
72d98b4ccff2d52f7aac4cb4e4e0257a
73066cbfd9d5816c0d975b9fe7da9a76
734d3d318e2be6335420ede60d61441e
7362c4fbf74a8fe58439582c1f53f792
7389459eac27a92eb2caaca4570d4c02
73c61d8307094bc20a406ff590ae62dd
7455f4f591e04f513a390d2eddf5097e
7513f152ae9fed07d16b8b61efcb614d
763b79417aa45bddab2d57ed2e1044c8
766541d086d2a7588fb31ab0797a7ad0
76a3d1cc587f5f38db571e2218ddfa61
76b494304e7bc2b7b19e66591bf256e3
76f1cca280e93bc6a4bab131f27ef047
76f9732580d82517991012b0ff744ec8
79ecf266205d41dd72b3c468321b531b
7a6f40487790d153d5722e263efa7844
7af4a41ab7856207b0d119ae0fefb20d
7d0321dd47be94dbf861f1435fe4a2f1
7e8ef7e32c6397839773f3ee9dc98513
7f2ec4db35afc46f93af09669601f922
7f6113da230b35de80258edc68f7c093
7fdf394f783f78550b7e0c0a1acf50f7
8058fe00c5c885e55d685fe70d7505a3
807498de84f036f2c8b9de4b657c8b85
80f79adc9a260fae7527643545fca391
81a1e38dcfb94edd777504f317a9c5e4
81b863423586038f1615fc831d00f87a
81f9eb95e58b2c573ab61c6a08edfb2b
82166afa718da52c03098c2b09f8cb3c
827063ee04314a32d48fa6dc38b0bc76
82eaf9a71c30be347e9f45f79036e994
83aa551ce6da6500e98178442ed270e7
83c2c7fd7c0f886deb9216ebdf528d7a
852f6f24daf0b5043e27791d60074a9e
855cde4e819bdf8f1a106733a11c8cfe
857db3c3fe37abccdf08cd219738fb4c
86110bbb7b45707c709f2efe94da54dc
87a36fd345f966c5762e128d4615a121
889e778e9aafbe2d6774b068ee1434d3
8942ba00948ba562332bc5f4f8f8e1a1
is-0JI0C.tmp
8aba8949c6e2aad6266fc00fa06bb0fd
8b7ee1a8bab1d7c31133eae1400a965a
8bc36fe5468fef26f16d4631e2d0846c
8c0030b5b34961632cdea9320aa0ee45
8cf3424adb6e9ba063ec90a0c8c86f64
8d0f63a47fa73cc46173b63efe4a1ee9
8d23540a4beda00469207b97ef4ae1d6
8e571c8d96b3590536f90d387358075e
8e8d43381a7773ebc1807ad20dc89142
8ed0e083ca5381c91b9b722c5ce8c7c6
8f53e07776f81b1a3082e8571cf123fd
905725bc7a2d819c1a3af6291a832373
90a16c2fde672bf1af8df3f7d5515a16
917ba67e42faa96395676f493b8d2b58
91dddc3dc07face7f913d119e7d3cb8e
92db65d2e76716265a1a2e77dd4256aa
9449c9f6aa7e6a93468ceb9092eac01e
944fdfa20c135defd83854711a5d69b3
94a9f1b230f3af85d1b4128011c3a822
94c00242dcd4a7178c7c24141e99ffba
9536c7cdd4b406d20b8c3cdf174fa558
959c9554720ef9a167f2d76c0c039077
95f2c11b1ae3ce5baf484fadad42517e
9650db8a5f19c89df530e61538b39579
96c06bc94ca0e1cbbd5c3daaf19b19df
97a06e288e46d61da6aca2720d738ee6
97dfa1d2fbdea2d59a85655921ca250b
9831c0b7917db7dbd262bf4e5d2c0a8a
99724f4ce0a03be2ce3ba426e87d316d
99cbfe231f04f8209af365ceed847d79
9a25ece3d64862aeef1b1f5532c1d13e
9a2aa7625d05569a14597e28ed21dc1c
9a44b39c476e75d32031c93840d82e98
9afe525d6722a438b7ddc8ec7e17343d
9c371e909c04c5e358bce57ca7d6ef75
9c79cea29fa2e26a19a6bc068c8c7ea4
9c9abcd78d7dd5e7511051ef776bfe57
9e11ddfd2725c299abd4c2da0708d5d5
9e665bbb93a971f6012ba1daf031f0e1
9e6c0f466a082c23a2e282645ab216bb
9e7b5e4c83cedde9ca4e08f9b02a78ee
9ef67a38351fb2ebd5db7f2bfd05afba
9f8892e3d9980755647a522872ad74fc
9f9a033b0995d6467e28fdba4a3c94cf
BigOK.png
EULAAccepted.png
EULAShow.png
GOG_new.png
OpenSans-Regular.ttf
a174a7aa6ec95c160e235bbb4aab75c4
a1b12373509536e6da5d3f7318c0631d
a1c1d3b1ec0ec41334c7f9c487949a8f
a25d9f33bfc74f697933ce6b035e9d6c
a2a1e5492001109fc66ed4c4e944928a
a34cd000bab763741023024201fcdf07
a3bc04e7724e9ef618c6a77706264c24
a56bb2703c055ba45feecf98e719c56c
a574fa95a725f356f8bee84d4e7b34a5
a592bcefd24f8ab20f07034db6c7f774
a5c4cf65db272e8ccba71819015e4a51
a76441a53b2f5d36e92fa1200e4643a7
a7e1d6de40f5183372433759a35f9035
a8c454381af5a6c38f3e9f5d20067e31
a8f0a9ed66354a65ebc4b2cf27785708
a91a9333eaa3b7c5f9070fd923987c5b
a91c5d873be2a426cc97a3fda194b35e
aa6566212a9008576129286f27530f6d
aae8762dfa84cd3e1ffb0af1c5d38153
ab29f5d52cc49fc753ea540006fc4838
ab9d2be6320069de9fcbb95dc18253a6
abe556fc9119f34e0b62dccfaaa39ddf
ac1f904cfe2330bb20e7b8c5fb88445c
ac4a4585bf8c4b9dc66051016960f2a1
ac568aa18004d150b885c72476bcfcb5
ac6f5fed5b83824c33497c62fa573b2c
ac72710424b29b74f9e319768119ad84
ac77bdcb94761407a4ccf84e1407ed7c
adf5605d87605bb3c8b4029c46cdc9ba
b05ee837c554a695cb33ab161b57ca12
b0ef68e41b1409db6340afe2cbbfc8b9
b101070b1dd60fd721dd3f55dee92da3
b1612cdf8760e74b988eccad0c92b123
b17b119faa936dfa9072db5816e15235
b1a404581576d2981ae3d7c47a164dde
b23164b56506b1d96374b3c87ead0724
b2abc7fd7aada93fcc5da6dc1add642b
b394fb9d5018154a71fd382a4b17b83a
b42e63406408cbb0f81958a492c58891
b52d01512ea8ff2670d40c938b9d9d19
b69c1a11c23f3dfced2679ffaaed3803
b6b5b8100206d3a1f9ea587fbda773b9
b72c837deaf5463dcffd6adfb9659aca
b74b626c371153c0b42a90400a57f365
b8ac6697615fa7b39c4001a57c323685
b9c867cbdb86d40e70054982fe8fde0b
baa12b8453df43870edde7b43cc7b99e
baa5b9a3421e04d0817b1663e941c35b
baca236c7ca585bfd524f28cb2f04add
bad3a8cd7dec88b070855f75b0ebc338
background.jpg
bb0cb5cae39e7e5e619b0eff45812a6c
bbe5f213275067ad5466027ce37a2fdd
bc486d278f9166fe9e484116b6bd1650
bcf98b72c75305463c67ad37d2f92f7c
bd0f21fa9de86fce5af5062a9525b3b0
bdbc05f3d14b77924a8ed490c8202ae0
bdbef660fc9f36c69126be85431bba66
bdd34da536e89c2531a4a1f4664c6b10
be4310b7fbe005795e100e5d5198eb03
botva2.dll
btn_md5.png
c18b10944da1842372e3712950d53777
c1e9dc682dfaa80e3922def67ba21e79
c319f6809a15a06ec7a0664a91b4a52a
c3604a2b5c1464474a5d59d321457ac3
c444c1f41f649eb1e06336d97ebf3ecf
c4978188f504f8c6c945d05f68a6d4ea
c4dbf5eaf657894fa51cf31795256d16
c4f52a5d82fad094ebd7c2bbdb5a7d96
c505c0c9a6fd47f3a549ff6cb8e28cc0
c5c39713473d24a1ae0e77fed3e7c94c
c64524209ea88bda315f5c517845c773
c6993cc6a483299558bf92a16d4ba5a6
c72a5059e758cde40de995d0b8fe6755
c79f40627f8b10264acaba4ab594901c
c7fe9cbcab012581c5f6bce5005cd9a4
c89475f90f80c7721b8844b48caa6f05
ca22df23d20f8d63f5559fdb103e83bc
cab0f16faf7237c9bed3caf453591cdb
cbcc8a1d886b52592daff35fc26ce585
cbce1ac252403873fe32a441cfc03f17
ccc7473d18583c36d0df4dec7c8cf931
cd82c2d9089ea73f6ca7c8e00c66d843
cdc0f5e5cf03342864778011ae6651fa
cea7b990de74fc97c217f81978ef8812
cf3150eaea114b49df3e50be3c718458
cf6ec130e8405a0f367fbd0d539ca539
cf8fab7778ec2f5e8e72148d5a101c9e
cf9201d05903834ffabf4d2520532923
crcdll.dll
d0109602737476b6bd25c7be70498e79
d16a64d640d5ad292b42dc138eed9717
d16bbbdf4d8f440099a9a4862a59198b
d181717f939543eb3b08d43558e39ffa
d1c0efc69f8a8b733af45adc90fa91a0
d2e573369a8a1a77ba12adbbedf98518
d36e16d50caa4cfc6dce9400942d660e
d3f9e45838bc81ebb27267c2659d8cde
d4d78c15985ea602e996a01e7764f2ee
d5a6d34adea12f55c70296998e603688
d67a2fa451d498f92d3be1df09251e38
d67b2e236215f1a890d6e02e06a71ed5
d6a46650c75b728dfa028abecc6ecd8c
d71d957b025af14d404e48a57e601cd5
d78394a4883c65b6e27aa1807518d797
d801639240e904ff6556f7f58e3b6367
d8bda90e08e2bdf9a53064c7732d7c30
da51df3e964417b97408cd583a1dbef0
dab19600bd0e92af5c7631e7e33e3980
db56f14e681fcb148b08ac19ccb846cb
db96a153299e30178c3565324a3807a1
dbca1029afe616936a2dcd1af5206f57
dc18a90db3fa81c4e65d55785e35269c
dccbda965e54770f02f7f00cd7f797d5
de59bb6db344e9bf82a668c50e57488b
dea4d3b3e1a2f0f637c0488ba97892a9
df36d5f33880d1ce87d60c6f97ec0134
df4c55495f5022f11a9b593a90fee5ce
dfb2dcc546c44b21dd0f7cfc1cc9d0de
e190c44476ce4f93f08800f241d7936e
e1b043cfb83353584ecc3d7b700eda6a
e2c8dbf93f7264e71d96dd9722464332
e392e2216ebf7452646d4928141b876a
e3be40e73d05da173b1defb7266436c8
e46b4c1f14a210674b178dbc53d4db40
e4e79a5d3e9ae6537349c78ddaa3228a
e51a397cedba32c2ee8e17846232f59c
e59698b7cbf1b2cda763fd3fe4045c47
e5d992e5ba6f24bf5fcfb281a6f6288c
e61bb632e9284311d951c26bff14a019
e63f550766e7e22b9936ec3df50dbb8c
e6aa9511bf8de31d7c34f9effd1b13a6
e6d2154acc9d97ada303f2afd1a0eb95
e706459398f069d4c38238c641314202
e7d889b90ec4e4b61cc47aff6d3d8224
e83a0d6dede8a74f02da38424f1ba138
ea15e77fcd4f8a0cc1c89be057752bb4
eb249d84db646d63b62012c27818eea8
eb2e2836473d79aec6053282765f8205
eb576275a1d6f88704cecc1b27a2853b
ecfe53a0a9e6f20d663e629be85fdb1e
ed641395bc7a225c70f2d78be6062514
is-QERBS.tmp
error.png
error_icon.png
f1b54ab159def1c1109ebef88bb56f7b
f20a21961877226fb988f4f2c3c25c24
f23e2e1630a14b3a204f3995bbd02849
f47620ea4fb1c9259ba85ebc3f9360bf
f49e079cbbb30a6036310fca0a6f88da
f4ad23e1167b1607ed837e2c320b9762
f4ee941e586ca46054b5d7f8aa96c139
f606362bd44876a67329bb359cd8e6b0
f61fff680e61c048778968ba46b85ea9
f6815c17ceb3cffdfa3195facb14596c
f7821865ca65ecac2ebb9c0522b701d7
f7ab4f8344bfb3cb9a7f2c0d29501980
f96cc8c0c3fbdb29ebddb3e0007658fd
f9899615db285e488cf741892a51b659
f9931eff3833216c88cba8dfecdebdc3
f9ca21fc0a36a80edfefdb767309b28c
fa3cde110c385203f1c85ef95aad9e36
fb934be1524c4cb111a1520dbd6c69ae
fcdf248f54d39052a8611ed124eee205
fd1f4af3e385aa7bb24ddfdd97e7249a
fd8906e90e733ac6412761ca41ab4d88
fdbb28726a23e0efb7a5f4963bcbf840
fe1511736f9d1440bbd6baf19e5e4fff
fe341a447568691d7bb43e6b795d759b
fe840cf392504da35c5780b34d88aba9
fe9f40568715c50d2cabcc0b9ce11941
innocallback.dll
ok.png
progress_center.png
progress_left.png
progress_right.png
slideshow.ini
track_center.png
track_left.png
track_right.png
uninstall.dll
setup_mirrors_edge_1.01_jpfix_(41238).tmp
remote-settings-startup-bundle-
tmpaddon
tmpaddon
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
UIGX7KDDZRWYUAGELNKL.temp
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
addonStartup.json.lz4
bookmarks-2026-07-18_10_1r3QjuuEAyuq8rfdNuSQxGdBu--ovWlb8cdqVdaEI4Q=.jsonlz4
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
08768f83-cbb1-4285-9c7b-efc5a3a23181
2dbf8c9e-941f-4d58-b0da-9926b649c327
3099efa8-08b8-4231-ac67-3f75e53659e5
33b9af1b-9cbe-46f0-8e97-6346ebfac01d
6b478b06-1476-417d-ba51-aa8584162673
74d1361c-61f0-4a53-96c8-adba38e2ec39
855e407b-9659-49fc-b97a-5af4c1a7071f
90b42188-7146-4134-86b3-87a5ff62b07f
9bc9f526-412c-4e64-8e8d-a07e1d3fda8a
ab5ad048-3aa7-4679-afa3-616a5995f155
baf5bf86-53d1-4ef7-92e9-f07f88b66ca3
c158007a-77d3-4ed4-aeb5-4e4dca3d6034
extension-preferences.json
extensions.json
favicons.sqlite-wal
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
places.sqlite
places.sqlite-wal
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
serviceworker-1.txt
serviceworker.txt
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
{8d70d5c1-8e45-4ff7-940c-59429a95a914}.final
{164e9664-70f4-45da-97be-253d6f92e8e4}.final
{acdc4fc2-f818-44c0-a731-ab9f5063635a}.final
3244498674t1w-etbn-uaocc.sqlite
setup_mirrors_edge_1.01_jpfix_(41238).exe
TdEngine.ini
TdInput.ini
TdInput.ini
desktop.ini
DirectX.log
DirectX.log
DirectX.log
DirectX.log
d3dx10_42.dll
SET7FCF.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD7CE1.tmp
OLDA22C.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
Microsoft.DirectX.Diagnostics.dll
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
TdSpContent.cht
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_MDX1_x86_Archive.cab
Apr2006_XACT_x64.cab
Apr2006_XACT_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xinput_x64.cab
Apr2006_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
DSETUP.dll
DXSETUP.exe
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_XACT_x64.cab
Feb2006_XACT_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Oct2005_xinput_x64.cab
Oct2005_xinput_x86.cab
dsetup32.dll
dxdllreg_x86.cab
dxupdate.cab
scriptinterpreter.exe
vcredist_x86.exe
PhysX-9.13.0604-SystemSoftware-Legacy.msi
PhysX-9.17.0524-SystemSoftware.exe
goglog.ini
memory/3068-1945-0x0000000000C50000-0x0000000000C89000-memory.dmp
memory/3068-1579-0x0000000000C50000-0x0000000000C89000-memory.dmp
memory/4288-5219-0x000001B927C50000-0x000001B927C94000-memory.dmp
memory/4288-5195-0x000001B90F190000-0x000001B90F1B2000-memory.dmp
memory/4288-5242-0x000001B927D20000-0x000001B927D96000-memory.dmp
memory/6068-5986-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-6539-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-4686-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-4685-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-1645-0x0000000006860000-0x000000000686E000-memory.dmp
memory/6068-3017-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-3018-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-3019-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-5155-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-5152-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-3542-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-3020-0x0000000006860000-0x000000000686E000-memory.dmp
memory/6068-1598-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-4184-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-4183-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-5436-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-5435-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-4182-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-5984-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-3541-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-3540-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-5985-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-1591-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-1949-0x0000000006860000-0x000000000686E000-memory.dmp
memory/6068-1948-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-1946-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-1947-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-11593-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-11595-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-9547-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-1951-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-4687-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-6540-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-11591-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-11175-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-7180-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-7182-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-7181-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-11176-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-11174-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-10752-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-10750-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-7706-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-7705-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-7704-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-10751-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-10421-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-8110-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-8112-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-8111-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-10422-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-10423-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-8629-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-8630-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-8628-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-9959-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-9960-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-9961-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-9176-0x0000000005590000-0x00000000055A5000-memory.dmp
memory/6068-9177-0x00000000056B0000-0x0000000005767000-memory.dmp
memory/6068-9175-0x00000000008C0000-0x0000000000A12000-memory.dmp
memory/6068-9548-0x0000000005590000-0x00000000055A5000-memory.dmp