Analysis
- user interaction
yes - max time kernel
900s - max time network
754s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
31/07/2026, 17:49
General
- Target https://en.exloader.net/
- Sample260731-weelfsdk6x
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks for any installed AV software in registry 1 TTPs 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 25 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://en.exloader.net/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff8102ec188,0x7ff8102ec194,0x7ff8102ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9142141183384437100,2041945480918543173,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1808,i,3091599017157447046,5065850012195621689,262144 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,4941871992718080192,4658405631786970294,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,13287168343273360115,2890061643473307414,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5501108572540312145,16616949083067486034,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5060,i,6422066669640800590,17298146420893042886,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5216,i,4294719416412970582,12589184683639156854,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5256,i,14955302852365093848,8240583190861502588,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5404,i,13933397188207030907,1354713537199447102,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5384,i,16377350390138095834,14352801693449386515,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,4781592361402263305,16846585399288992640,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2006357939625739139,2274766865778140691,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11289639111313714421,7178302398674693182,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11289639111313714421,7178302398674693182,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6612,i,12721402029393234367,5227606614824954717,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7016,i,3162641770849052271,17414804266681150773,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,2749937469568012737,16035740156000087096,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,14536369051339583107,17166523109145213741,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6756,i,4120428239832661066,15944977760351394930,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,10097633491116519538,13826269634210576139,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5696,i,4054004447700370545,8664052681733681932,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,8658045091247120237,6021997622162511456,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,13071418977494292092,11834484734994796871,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13072650834948560008,8260332042752619098,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,12668503687098787125,11635147577073049199,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\OperaGXSetup.exe"C:\Users\Admin\Downloads\OperaGXSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC79F97C8\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC79F97C8\installer.exe --server-tracking-blob=MWNiYTVkZTdkZjFmNzNlNmQ4MTdjMjQ5MzQ5YzU4MWE0N2U4ZjcyYzNiMzFmOTZmN2YwZDBiNTNlODY4ZWJlYzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfODg3NV9PT01fMzk4NSZlZGl0aW9uPXN0ZC0yJnV0bV9pZD04YzRlYzdmNDY0OGY0MTRiYTc0NmVjYmI3MGI2MjhmOCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX1NWUl84ODc1X09PTV8zOTg1JTI2dXRtX2lkJTNEOGM0ZWM3ZjQ2NDhmNDE0YmE3NDZlY2JiNzBiNjI4ZjglMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9OGM0ZWM3ZjQ2NDhmNDE0YmE3NDZlY2JiNzBiNjI4ZjgmZGxfdG9rZW49NzQ5MDk1MTciLCJ0aW1lc3RhbXAiOiIxNzg1NTIwMjE2LjAxNjIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9TVlJfODg3NV9PT01fMzk4NSIsImlkIjoiOGM0ZWM3ZjQ2NDhmNDE0YmE3NDZlY2JiNzBiNjI4ZjgiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJhMjg3MzM2Mi02MTMzLTQxMTAtYWQyMC1kNjZjNmFjOTg2MjMifQ==3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC79F97C8\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC79F97C8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff66cc2cd88,0x7ff66cc2cd94,0x7ff66cc2cda04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\installer.exe" --version4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\opera_package_202607311850341\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\opera_package_202607311850341\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\opera_package_202607311850341\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\opera_package_202607311850341\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\opera_package_202607311850341\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\89709064-27a4-4c07-882d-17908653d058 Opera GX Installer Temp\opera_package_202607311850341\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x654b80,0x654b8c,0x654b985⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,2664358769549007671,8814430708110154562,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6748,i,11926256182148270871,749213199482870439,2097152 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3082329512186273990,10917503625308555160,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\ExLoader_Installer.exe"C:\Users\Admin\Downloads\ExLoader_Installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Downloads\ExLoader_Installer.exe"C:\Users\Admin\Downloads\ExLoader_Installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\ExLoader_Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"c:\users\admin\desktop\ExLoader.lnk\") $Shortcut.TargetPath = \"C:\Program Files\ExLoader\ExLoader.exe\" $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2748,i,7495605746098385407,5585771379455089274,262144 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,16360883545222207574,17645329615855848480,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,3613399281190020549,18109451777332936071,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9241885377978008396,14585719530580565256,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2880,i,6040351198195579182,11494529057464170224,524288 --field-trial-handle=2384,i,15896557439905894241,3072625231935867807,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\ExLoader\ExLoader.exe"C:\Program Files\ExLoader\ExLoader.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\ExLoader\verythanksattitudetexture.exe"C:\Program Files\ExLoader\verythanksattitudetexture.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command (gwmi Win32_BaseBoard)3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exe /Q3⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exe /Q4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_24_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_25_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_26_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_27_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_28_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_29_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_30_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_1_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_2_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_3_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_31_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_4_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_32_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_00_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_5_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_6_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_33_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_33_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_7_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_34_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_34_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_8_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_35_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_35_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_9_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx9_36_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_36_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe X3DAudio1_2_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT2_10_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_37_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_37_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe X3DAudio1_3_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_0_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_0_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_38_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_38_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe X3DAudio1_4_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_1_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_1_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_39_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_39_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_2_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_2_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe X3DAudio1_5_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_3_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_3_x64.inf6⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_40_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_40_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe X3DAudio1_6_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_4_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_4_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_41_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_41_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_42_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_42_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx11_42_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dcsx_42_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DCompiler_42_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_5_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_5_x64.inf6⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe X3DAudio1_7_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_6_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_6_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DX9_43_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx10_43_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dx11_43_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe d3dcsx_43_x64.inf6⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe D3DCompiler_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XACT3_7_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX5E12.tmp\infinst.exe XAudio2_7_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll6⤵
- Modifies registry class
-
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Windows\System32\taskkill.exe /f /im cs2.exe3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\taskkill.exeC:\Windows\System32\taskkill.exe /f /im cs2.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x86.exe /q3⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x86.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x86.exe /q4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi5⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x64.exe /q3⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x64.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\redistributables\vcredist_2005_x64.exe /q4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi5⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B993C273FEB22BE24644145849F077A2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B1824D2F5E73E75E651C76B63081DC62⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Software Discovery
1Security Software Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5df245.rbs
e5df24a.rbs
ExLoader.zip
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe58d702.TMP
SiteList-Enterprise.json
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
sync_diagnostic.log
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe589054.TMP
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
additional_file0.tmp
assistant_installer.exe
dbgcore.dll
dbghelp.dll
installer.exe
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
DXIFDAB.tmp
dxupdate.cif
dxupdate.dll
icudtl.dat
ExLoader_Installer.exe
audioplayers_windows_plugin.dll
app.so
AssetManifest.bin
AssetManifest.json
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
AbominationPissed_DE.wav
AbominationPissed_EN.wav
AbominationPissed_RU.wav
Csgo_hover.wav
Csgo_press.wav
Fortnite_hover.wav
Fortnite_press.wav
Standard_hover.wav
Standard_press.wav
Steam_hover.wav
Steam_press.wav
Windows_notification.wav
Anime.jpg
CatsDay.jpg
Cyberpunk.jpg
Easter.jpg
Fallguys_v1.jpg
Fallguys_v2.jpg
FishingDay.jpg
Genshin.jpg
God%20of%20War.jpg
Halloween.jpg
Halo.jpg
IceCreamDay.jpg
JokeDay.jpg
LoveDay.jpg
NewYear.jpg
Ori%20and%20the%20Blind%20Forest.jpg
SchoolDay.jpg
SpaceDay.jpg
SummerStart.jpg
TastyFoodDay.jpg
Warcraft.jpg
logo.png
ar.png
cs.png
de.png
en.png
es.png
fil.png
fr.png
hi.png
id.png
it.png
kk.png
ko.png
mn.png
pl.png
pt.png
ro.png
ru.png
tr.png
uk.png
uz.png
vi.png
zh.png
NoirPro-Bold.otf
NoirPro-Light.otf
NoirPro-Medium.otf
NoirPro-Regular.otf
NoirPro-SemiBold.otf
acrylic.png
bin.png
bios.png
box.png
brightness.png
celebrate.png
click.png
cloud.png
colors.png
complain.png
crash.png
cursor.png
debug.png
defender.png
dice.png
eac.png
engine.png
eye-off.png
flashdrive.png
flip.png
font.png
fps.png
framerate.png
fullscreen.png
fun.png
grain.png
harddrive.png
hint.png
hitbox.png
injection.png
insert.png
issue.png
log.png
logout.png
magnifier.png
mascot.png
memory.png
mods.png
monitor.png
mouse.png
offline.png
opacity.png
ping.png
platform.png
privacy.png
profanity.png
rain.webp
reply.png
rocket.png
rounding.png
shortcut.png
snow.webp
snowflake.webp
socials.png
translate.png
trash.png
updates.png
version.png
wall.png
weather.png
window_size.png
background_image.frag
modification_card_image.frag
raindrops.frag
shimmer_effect.frag
winter.frag
ink_sparkle.frag
flutter_windows.dll
msvcp140.dll
permission_handler_windows_plugin.dll
url_launcher_windows_plugin.dll
vcruntime140.dll
vcruntime140_1.dll
__PSScriptPolicyTest_flocjiev.f4o.ps1
01ea7e9f526e177156614da305eb369b.webp
0a1d4df1c52a9bf8b0be65efc564c90c.webp
0b76b0766b6cadfd241c0e9e697d865e.webp
0eb49e5656ace9453048eed0256286c9.webp
13c0aa4c8798b433117c0503052b36f5.webp
178adac81c1363d482ee3422e343e5ad.webp
1cc191434b7c5a0ddfb7e8933c6ffd39.webp
1f97590d229e484c25eda2b3a7e5e2b5.webp
20d5acdd6b6aa1f32386e853341a3246.webp
35aec07e89e7693c5bcaf8d48c6c4802.webp
3623c6ff5bba27dec8ffa0959b5b6325.webp
3d9096f8a5a3d6aca5e03d8ff66195d2.jpg
3edf9190a8dd6420decc3c5e010ac72a.webp
464cc35ffcd7344ea3004956602bab35.webp
4a4176b080a0182d4c335be7df581294.webp
626af0d33d4a22b0652f5a521b661e2d.webp
6cf5b975a991d6fb169daa7e8b2ceaaa.webp
731a8729c158a7b043c4cb6537d7f4de.webp
74dbac57994b1962c1b5a6b623f3731d.webp
7ebd96cc6b657ecca6199d21bfc460e2.webp
816468bee988a6b92e8d0e284672d2cb.webp
8288ed517e2ed373c4b6085fe8102e2c.webp
9875c9610b069277fef546eb9ce8f871.webp
99d19fcea9f1b612f3731b648cc9fabd.webp
9a7d857fd557514347dbdcab5acdd884.webp
9f6951012773fab7d97dfe18f4ee3f0a.webp
a6985f41a4e7006c45563a2e179892d7.webp
ae5e5005cc18ce5ab8ebb277d99564bc.webp
b2237f44ab6268cecceab6261aeffcf4.jpg
bc09e7fee0a60b50d7706913ce439d68.jpg
d842b0a6ffc8f0c686497037623fb2bf.webp
d957df5ffd7094ce8f53ed4fab03901a.webp
dd191ce20c0b448ff4f96e3faa35707d.webp
dd5165ad5b61ca4c3c7ab4119698e9ec.webp
dd919fec3fdb56bf251854d5c29fc9e0.webp
de7912048910995cd25c720efe2a3696.webp
df629312657fa988ffe1eb8631d737a6.webp
dfc86cc55e88d2e58422721cc12e186a.webp
e7683e4327a10df87e941d1c10362e97.webp
eeaf324c921ac5b1ee4972584f7438b7.webp
f4917fd3fdb015ebec2de40891905b47.webp
fe15ed7e3f3422b3d576276906f6aaad.webp
settings.dat
game_icons.zip
ServerPacketId_ModificationsLocalData.hive
weather_now.json
shared_preferences.json
shared_preferences.json
dxwebsetup.exe
vcredist_2005_x64.exe
vcredist_2005_x86.exe
locations_v2.csv
shared_preferences.json
shared_preferences.json
ExLoader_Installer.exe
OperaGXSetup.exe.crdownload
DirectX.log
e5df242.msi
e5df247.msi
DirectX.log
DirectX.log
DirectX.log
DirectX.log
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
Cleanup.xml
Generalize.xml
Respecialize.xml
Specialize.xml
3bd343431621dd0187000000d423d41e_mfcm80.dll
726f44431621dd018a000000d423d41e_mfcm80u.dll
b44844431621dd0189000000d423d41e_mfc80.dll
dcf943431621dd0188000000d423d41e_mfc80u.dll
11f7ec161621dd013b000000d423d41e_vcomp.dll
5f4504161621dd010e000000d423d41e_manifest
73d50a161621dd0113000000d423d41e_catalog
06e498161621dd0130000000d423d41e_catalog
6aab97161621dd0125000000d423d41e_manifest
5406a2171621dd015d000000d423d41e_manifest
821aa2171621dd015e000000d423d41e_catalog
19e104161621dd0111000000d423d41e_msvcp80.dll
80ad0a161621dd0112000000d423d41e_msvcm80.dll
b69404161621dd0110000000d423d41e_msvcr80.dll
0f975b171621dd014f000000d423d41e_manifest
0f975b171621dd0150000000d423d41e_catalog
269897431621dd019e000000d423d41e_mfc80kor.dll
2b2397431621dd019a000000d423d41e_mfc80deu.dll
2efc96431621dd0198000000d423d41e_mfc80esp.dll
2efc96431621dd0199000000d423d41e_mfc80enu.dll
3aae96431621dd0196000000d423d41e_mfc80chs.dll
637197431621dd019c000000d423d41e_mfc80ita.dll
637197431621dd019d000000d423d41e_mfc80jpn.dll
6bd596431621dd0197000000d423d41e_mfc80cht.dll
c74a97431621dd019b000000d423d41e_mfc80fra.dll
081eed161621dd013c000000d423d41e_catalog
1ad0ec161621dd0139000000d423d41e_manifest
495bd5171621dd0168000000d423d41e_catalog
95e5d4171621dd0167000000d423d41e_manifest
3face2431621dd01ab000000d423d41e_catalog
af5ce2431621dd01a8000000d423d41e_manifest
06e498161621dd012f000000d423d41e_mfc80kor.dll
0f2098161621dd0129000000d423d41e_mfc80esp.dll
309598161621dd012c000000d423d41e_mfc80fra.dll
309598161621dd012d000000d423d41e_mfc80ita.dll
6f4798161621dd012a000000d423d41e_mfc80enu.dll
75d297161621dd0127000000d423d41e_mfc80chs.dll
b46e98161621dd012b000000d423d41e_mfc80deu.dll
babc98161621dd012e000000d423d41e_mfc80jpn.dll
f8f897161621dd0128000000d423d41e_mfc80cht.dll
87b155111621dd0104000000d423d41e_atl80.dll
906255111621dd0102000000d423d41e_manifest
adfe55111621dd0105000000d423d41e_catalog
ae4753441621dd01bf000000d423d41e_catalog
bfd252441621dd01be000000d423d41e_manifest
a4e5a6441621dd01cc000000d423d41e_manifest
da0ca7441621dd01cd000000d423d41e_catalog
9364f5421621dd0180000000d423d41e_msvcp80.dll
9d16f5421621dd017f000000d423d41e_msvcr80.dll
acb2f5421621dd0181000000d423d41e_msvcm80.dll
a56d78171621dd0153000000d423d41e_manifest
c59478171621dd0154000000d423d41e_catalog
a578d1441621dd01d6000000d423d41e_manifest
ed9ed1441621dd01d7000000d423d41e_catalog
3c9744431621dd018b000000d423d41e_catalog
ae0f43431621dd0185000000d423d41e_manifest
e0da1f441621dd01b5000000d423d41e_catalog
e2b31f441621dd01b4000000d423d41e_manifest
6bcb46161621dd011c000000d423d41e_catalog
da6c45161621dd0116000000d423d41e_manifest
cdc4b5421621dd0173000000d423d41e_atl80.dll
b612b6421621dd0174000000d423d41e_catalog
bf9db5421621dd0171000000d423d41e_manifest
0fbc45161621dd0118000000d423d41e_mfcm80.dll
485646161621dd011a000000d423d41e_mfc80.dll
5fa546161621dd011b000000d423d41e_mfcm80u.dll
cee245161621dd0119000000d423d41e_mfc80u.dll
dc7023171621dd0145000000d423d41e_manifest
eb9623171621dd0146000000d423d41e_catalog
269897431621dd019f000000d423d41e_catalog
898696431621dd0194000000d423d41e_manifest
91ee73441621dd01c3000000d423d41e_catalog
f4c773441621dd01c2000000d423d41e_manifest
63daf5421621dd0182000000d423d41e_catalog
b8eff4421621dd017d000000d423d41e_manifest
3face2431621dd01aa000000d423d41e_vcomp.dll
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
dxupdate.cab
Apr2006_xinput_x86.cab
Apr2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2006_xinput_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx10_00_x64.cab
Apr2007_xinput_x86.cab
Apr2007_xinput_x64.cab
Feb2005_d3dx9_24_x86.cab
Apr2005_d3dx9_25_x86.cab
Jun2005_d3dx9_26_x86.cab
Aug2005_d3dx9_27_x86.cab
Dec2005_d3dx9_28_x86.cab
Feb2006_d3dx9_29_x86.cab
Apr2006_d3dx9_30_x86.cab
Oct2006_d3dx9_31_x86.cab
Dec2006_d3dx9_32_x86.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_d3dx10_33_x86.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_d3dx10_34_x86.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_d3dx10_35_x86.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_d3dx10_36_x86.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_d3dx10_37_x86.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_d3dx10_38_x86.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_d3dx10_39_x86.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_d3dx10_40_x86.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_d3dx10_41_x86.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_D3DCompiler_42_x86.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_D3DCompiler_43_x86.cab
Feb2005_d3dx9_24_x64.cab
Apr2005_d3dx9_25_x64.cab
Jun2005_d3dx9_26_x64.cab
Aug2005_d3dx9_27_x64.cab
Dec2005_d3dx9_28_x64.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_xact_x86.cab
Feb2006_xact_x64.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_xact_x86.cab
Apr2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xact_x64.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_xact_x86.cab
Oct2006_xact_x64.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_xact_x86.cab
Dec2006_xact_x64.cab
Feb2007_xact_x86.cab
Feb2007_xact_x64.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_xact_x86.cab
Apr2007_xact_x64.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_xact_x86.cab
Jun2007_xact_x64.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_xact_x86.cab
Aug2007_xact_x64.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_xact_x86.cab
Nov2007_xact_x64.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_xact_x86.cab
Mar2008_xact_x64.cab
Mar2008_xaudio_x86.cab
Mar2008_xaudio_x64.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_xact_x86.cab
Jun2008_xact_x64.cab
Jun2008_xaudio_x86.cab
Jun2008_xaudio_x64.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_xact_x86.cab
Aug2008_xact_x64.cab
Aug2008_xaudio_x86.cab
Aug2008_xaudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_xact_x86.cab
Nov2008_xact_x64.cab
Nov2008_xaudio_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx10_40_x64.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_xact_x86.cab
Mar2009_xact_x64.cab
Mar2009_xaudio_x86.cab
Mar2009_xaudio_x64.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_xact_x86.cab
Aug2009_xact_x64.cab
Aug2009_xaudio_x86.cab
Aug2009_xaudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_xact_x86.cab
Feb2010_xact_x64.cab
Feb2010_xaudio_x86.cab
Feb2010_xaudio_x64.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_xact_x86.cab
Jun2010_xact_x64.cab
Jun2010_xaudio_x86.cab
Jun2010_xaudio_x64.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Apr2006_MDX1_x86.cab
memory/2640-1884-0x0000011EF77C0000-0x0000011EF77E2000-memory.dmp
memory/3440-2026-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2020-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2015-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2016-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2014-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2025-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2024-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2023-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2022-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/3440-2021-0x000001F289EE0000-0x000001F289EE1000-memory.dmp
memory/4040-2172-0x00000172D3980000-0x00000172D3A00000-memory.dmp
memory/4040-2178-0x00000172D3BF0000-0x00000172D3BF6000-memory.dmp
memory/4040-2169-0x00000172D2250000-0x00000172D2251000-memory.dmp
memory/4040-2165-0x00000172CDF40000-0x00000172CDF41000-memory.dmp
memory/4040-2168-0x00000172D2390000-0x00000172D393D000-memory.dmp
memory/4040-2166-0x00000172D2390000-0x00000172D393D000-memory.dmp
memory/4040-2171-0x00000172D3980000-0x00000172D3A00000-memory.dmp
memory/4040-2167-0x00000172D2390000-0x00000172D393D000-memory.dmp
memory/4880-2220-0x000001C438800000-0x000001C438880000-memory.dmp
memory/4880-2221-0x000001C438800000-0x000001C438880000-memory.dmp
memory/4912-1417-0x000001B0E4440000-0x000001B0E575D000-memory.dmp
memory/4912-1701-0x000001B0E1840000-0x000001B0E1861000-memory.dmp
memory/4912-1702-0x000001B0E6000000-0x000001B0E601D000-memory.dmp
memory/4912-1491-0x000001B0E17D0000-0x000001B0E17D1000-memory.dmp
memory/4912-1448-0x000001B0E4440000-0x000001B0E575D000-memory.dmp
memory/4912-1332-0x000001B0E4440000-0x000001B0E575D000-memory.dmp
memory/4912-1325-0x000001B0E17C0000-0x000001B0E17C1000-memory.dmp
memory/6032-17944-0x0000000002010000-0x000000000206E000-memory.dmp
memory/8120-17654-0x00000000021A0000-0x00000000021FA000-memory.dmp
memory/8808-17799-0x0000000001EC0000-0x0000000001F1A000-memory.dmp
memory/10848-18391-0x00000000023A0000-0x0000000002404000-memory.dmp
memory/11892-18628-0x0000000002290000-0x00000000022F6000-memory.dmp
memory/14776-18927-0x0000000002100000-0x0000000002169000-memory.dmp