Analysis
- user interaction
yes - max time kernel
189s - max time network
261s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 01:37
General
- Target loader.exe
- Size 14.2MB
- Sample260723-b18ffaygqe
- SHA256 3ad44d0b739b43078efc8a7f794e58a4a27a54cb59b2bdd825fb831e9b40940b
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 8 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 12 IoCs
- Suspicious use of SetWindowsHookEx 56 IoCs
- Suspicious use of WriteProcessMemory 55 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27098 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {90077540-0d1f-46c2-ab81-db88c281db2f} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27134 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2408 -initialChannelId {0fac669e-9124-43ee-a367-0616971e3054} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 27274 -prefMapHandle 3736 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3748 -initialChannelId {d3e7ad54-e0a9-47e1-ab15-663f0626d084} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27274 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3920 -initialChannelId {1f27d84d-c22f-4194-8135-7071373f09c8} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4500 -prefsLen 34773 -prefMapHandle 4504 -prefMapSize 270279 -jsInitHandle 4508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4516 -initialChannelId {44308f17-a7c7-496a-a079-1de1dea7fe48} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2732 -prefsLen 35010 -prefMapHandle 2736 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {203d5db6-dc6d-4da1-82d3-f2f98a1fe111} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 33031 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {6bb56254-549b-4e11-94f2-72318087de28} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 33031 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {ebca585d-998d-465b-b47a-b6009432b644} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5944 -prefsLen 33031 -prefMapHandle 5948 -prefMapSize 270279 -jsInitHandle 5952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5960 -initialChannelId {e675557a-52f3-4f63-8e5c-2b0f8f9fe98c} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1660 -prefsLen 33031 -prefMapHandle 2592 -prefMapSize 270279 -jsInitHandle 3016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2948 -initialChannelId {59c17704-e59e-458f-b6bb-c46dcfb59230} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7308 -prefsLen 36835 -prefMapHandle 7320 -prefMapSize 270279 -jsInitHandle 7324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7332 -initialChannelId {2e89b149-d6fa-4b11-a66c-c58480400cc1} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\dxwebsetup.exe"C:\Users\Admin\Downloads\dxwebsetup.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_24_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_25_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_26_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_27_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_28_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_29_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_30_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_31_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_32_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_00_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_33_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_33_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_34_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_34_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_8_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_35_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_35_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_9_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx9_36_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_36_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe X3DAudio1_2_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT2_10_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_37_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_37_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe X3DAudio1_3_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_0_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_0_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_38_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_38_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe X3DAudio1_4_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_39_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_39_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe X3DAudio1_5_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_40_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_40_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe X3DAudio1_6_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_41_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_41_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx11_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dcsx_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DCompiler_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe X3DAudio1_7_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DX9_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx10_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dx11_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe d3dcsx_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe D3DCompiler_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XACT3_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX6F7C.tmp\infinst.exe XAudio2_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll3⤵
-
-
-
C:\Users\Admin\Downloads\VC_redist.x64.exe"C:\Users\Admin\Downloads\VC_redist.x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1C8F77D6-C180-40B0-ACEB-3EDBAE2114CC}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{1C8F77D6-C180-40B0-ACEB-3EDBAE2114CC}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=7562⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{E3C0469E-6AC0-4479-8A07-6B57F7C3F9B1}\.be\VC_redist.x64.exe"C:\Windows\Temp\{E3C0469E-6AC0-4479-8A07-6B57F7C3F9B1}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7C058D59-226F-48A4-9DFD-F39147D8D943} {8C201B3C-C901-458E-B3E9-CA04B86D1F0A} 35003⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1424 -burn.embedded BurnPipe.{03408C38-92CF-43AB-8123-EE97260FE3DF} {08C02F98-1F01-4A68-8FD7-2E1E154BD501} 67324⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=596 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1424 -burn.embedded BurnPipe.{03408C38-92CF-43AB-8123-EE97260FE3DF} {08C02F98-1F01-4A68-8FD7-2E1E154BD501} 67325⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9B772BC4-7252-451E-BDFA-5E4875D08000} {493690D5-1373-4EE9-B5BE-8DA24EBF8BFD} 154926⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260723024019.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260723024019.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{537E43C5-F43B-4A8A-A0CA-DF154693B400} {00BD8BC7-4DF0-4336-B839-27B95C40D93B} 133004⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\VC_redist.x86.exe"C:\Users\Admin\Downloads\VC_redist.x86.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{C1AEC38E-EC04-4B7D-9D35-FF9151DFA8AA}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{C1AEC38E-EC04-4B7D-9D35-FF9151DFA8AA}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=7562⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{074F2CB0-C772-4E5A-B121-E2FA6F7B7B16}\.be\VC_redist.x86.exe"C:\Windows\Temp\{074F2CB0-C772-4E5A-B121-E2FA6F7B7B16}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{67AAF80A-D090-4B11-9755-4FA2301DA9D2} {757B77B1-887C-4766-AA0A-9A72ACBAF4F9} 109603⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{ED6FC570-C665-4CE3-98B5-3CE5E9703803} {92EEEC9B-0CC9-4833-A51B-D4FB92A8D072} 83084⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{ED6FC570-C665-4CE3-98B5-3CE5E9703803} {92EEEC9B-0CC9-4833-A51B-D4FB92A8D072} 83085⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B61357F1-9AFA-4CF5-A311-BEEF84A1AE5A} {CF3FEE86-C097-44C3-A29D-C18ED003225F} 160086⤵
-
-
-
-
-
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260723024118.log"2⤵
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=576 -burn.filehandle.self=592 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260723024118.log"3⤵
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{44597949-3552-4CE6-BA6F-A6F362286D41} {E7CC9685-5AE0-483A-B6F8-4C957E62E3F8} 148084⤵
-
-
-
-
C:\Users\Admin\Downloads\loader.exe"C:\Users\Admin\Downloads\loader.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b855e.rbs
e5b856a.rbs
e5b8571.rbs
e5b8580.rbs
e5b8584.rbs
e5b858a.rbs
e5b858f.rbs
e5b859c.rbs
e5b85ab.rbs
state.rsm
state.rsm
state.rsm
state.rsm
4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
04a5525b7136a13b7d6cc4e30faeae76.png
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
microsoft.directx.directplay.dll
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
DXI15A7.tmp
dsetup.dll
dsetup32.dll
dxupdate.cif
dxupdate.dll
dxwsetup.cif
dxwsetup.exe
dxwsetup.inf
MSIbed99.LOG
dd_vcredist_amd64_20260723024019_000_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260723024019_001_vcRuntimeAdditional_x64.log
dd_vcredist_x86_20260723024118_000_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20260723024118_001_vcRuntimeAdditional_x86.log
tmpaddon
tmpaddon
data.safe.tmp
data.safe.tmp
events
events
034d81ab-9c99-42fc-8d17-2e9b1b929cde
22922bbe-8f7f-4cfb-96b3-0806f0fffc8c
494b2285-bb23-40ee-a68a-9bb966b60efa
4f700d0e-8951-4698-b717-45b248e72947
8f53ac2b-8ece-4265-9c19-545a705ed940
e2feebc9-0825-4fdd-9dd0-afdd358d441c
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
places.sqlite
prefs-1.js
prefs-1.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
VC_redist.gAw6Yt9C.x64.exe.part
VC_redist.x86.exe
dxwebsetup.exe
loader.exe
DirectX.log
DirectX.log
DirectX.log
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
cab54A5CABBE7274D8A22EB58060AAB7623
cabB3E1576D1FEFBB979E13B1A5379E0B16
vcRuntimeAdditional_x86
vcRuntimeMinimum_x86
VC_redist.x64.exe
license.rtf
thm.wxl
thm.xml
wixstdba.dll
VC_redist.x86.exe
logo.png
wixstdba.dll
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
vcRuntimeMinimum_x64
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
Microsoft.DirectX.dll
__AssemblyInfo__.ini
dxupdate.cab
Apr2006_xinput_x86.cab
Apr2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2006_xinput_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx10_00_x64.cab
Apr2007_xinput_x86.cab
Apr2007_xinput_x64.cab
Feb2005_d3dx9_24_x86.cab
Apr2005_d3dx9_25_x86.cab
Jun2005_d3dx9_26_x86.cab
Aug2005_d3dx9_27_x86.cab
Dec2005_d3dx9_28_x86.cab
Feb2006_d3dx9_29_x86.cab
Apr2006_d3dx9_30_x86.cab
Oct2006_d3dx9_31_x86.cab
Dec2006_d3dx9_32_x86.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_d3dx10_33_x86.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_d3dx10_34_x86.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_d3dx10_35_x86.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_d3dx10_36_x86.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_d3dx10_37_x86.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_d3dx10_38_x86.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_d3dx10_39_x86.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_d3dx10_40_x86.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_d3dx10_41_x86.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_D3DCompiler_42_x86.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_D3DCompiler_43_x86.cab
Feb2005_d3dx9_24_x64.cab
Apr2005_d3dx9_25_x64.cab
Jun2005_d3dx9_26_x64.cab
Aug2005_d3dx9_27_x64.cab
Dec2005_d3dx9_28_x64.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_xact_x86.cab
Feb2006_xact_x64.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_xact_x86.cab
Apr2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xact_x64.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_xact_x86.cab
Oct2006_xact_x64.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_xact_x86.cab
Dec2006_xact_x64.cab
Feb2007_xact_x86.cab
Feb2007_xact_x64.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_xact_x86.cab
Apr2007_xact_x64.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_xact_x86.cab
Jun2007_xact_x64.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_xact_x86.cab
Aug2007_xact_x64.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_xact_x86.cab
Nov2007_xact_x64.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_xact_x86.cab
Mar2008_xact_x64.cab
Mar2008_xaudio_x86.cab
Mar2008_xaudio_x64.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_xact_x86.cab
Jun2008_xact_x64.cab
Jun2008_xaudio_x86.cab
Jun2008_xaudio_x64.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_xact_x86.cab
Aug2008_xact_x64.cab
Aug2008_xaudio_x86.cab
Aug2008_xaudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_xact_x86.cab
Nov2008_xact_x64.cab
Nov2008_xaudio_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx10_40_x64.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_xact_x86.cab
Mar2009_xact_x64.cab
Mar2009_xaudio_x86.cab
Mar2009_xaudio_x64.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_xact_x86.cab
Aug2009_xact_x64.cab
Aug2009_xaudio_x86.cab
Aug2009_xaudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_xact_x86.cab
Feb2010_xact_x64.cab
Feb2010_xaudio_x86.cab
Feb2010_xaudio_x64.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_xact_x86.cab
Jun2010_xact_x64.cab
Jun2010_xaudio_x86.cab
Jun2010_xaudio_x64.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Apr2006_MDX1_x86.cab
memory/6428-17074-0x0000000001F40000-0x0000000001FA4000-memory.dmp
memory/9108-16768-0x0000000000720000-0x000000000077E000-memory.dmp
memory/9828-11545-0x0000000000630000-0x00000000006A7000-memory.dmp
memory/10016-21854-0x00007FFC68CC0000-0x00007FFC68CC2000-memory.dmp
memory/10016-21853-0x00007FFC68CB0000-0x00007FFC68CB2000-memory.dmp
memory/10016-21858-0x00007FF6F5B40000-0x00007FF6F72F0000-memory.dmp
memory/10388-16984-0x0000000002070000-0x00000000020D4000-memory.dmp
memory/14720-8468-0x0000000000770000-0x00000000007E7000-memory.dmp
memory/15452-8471-0x0000000000770000-0x00000000007E7000-memory.dmp
memory/15492-8470-0x0000000000770000-0x00000000007E7000-memory.dmp
memory/15988-11548-0x0000000000630000-0x00000000006A7000-memory.dmp
memory/16008-11547-0x0000000000630000-0x00000000006A7000-memory.dmp