Analysis
- user interaction
yes - max time kernel
220s - max time network
342s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/08/2026, 23:16
General
- Target Minecraft.Note.Block.Studio.exe
- Size 43.3MB
- Sample260817-289ataeb98
- SHA256 35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 19 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 38 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SetWindowsHookEx 28 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft.Note.Block.Studio.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft.Note.Block.Studio.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe" /Q2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_24_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_25_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_26_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_27_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_28_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_29_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_30_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_1_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_2_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_3_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_31_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_4_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_32_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_00_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_5_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_6_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_33_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_33_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_7_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_34_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_34_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_8_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_35_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_35_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_9_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx9_36_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_36_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe X3DAudio1_2_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT2_10_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_37_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_37_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe X3DAudio1_3_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_0_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_0_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_38_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_38_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe X3DAudio1_4_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_1_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_1_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_39_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_39_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_2_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_2_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe X3DAudio1_5_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_3_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_3_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_40_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_40_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe X3DAudio1_6_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_4_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_4_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_41_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_41_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_42_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_42_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx11_42_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dcsx_42_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DCompiler_42_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_5_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_5_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe X3DAudio1_7_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_6_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_6_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DX9_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx10_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dx11_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe d3dcsx_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe D3DCompiler_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XACT3_7_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX8C01.tmp\infinst.exe XAudio2_7_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll4⤵
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Minecraft Note Block Studio\Minecraft Note Block Studio.exe"C:\Users\Admin\Minecraft Note Block Studio\Minecraft Note Block Studio.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Minecraft Note Block Studio\Data\wallpaper.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Classes\nbs" /v "URL Protocol" /f2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Classes\nbs\shell\open\command" /ve /t REG_SZ /d "\"C:\Users\Admin\Minecraft Note Block Studio\Minecraft Note Block Studio.exe\" \"--protocol-launcher\" \"%1\"" /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" "http://www.youtube.com/watch?v=JMPkf7bS8lQ"2⤵
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {0528c9c7-7424-40d4-8d33-21c01371f7e6} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {6575a09f-36f0-48b7-af97-2aee47f93443} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3600 -prefsLen 27325 -prefMapHandle 3604 -prefMapSize 270279 -jsInitHandle 3608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3616 -initialChannelId {0cee2d7a-4db4-470b-bc04-d0aad1354512} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3776 -prefsLen 27325 -prefMapHandle 3780 -prefMapSize 270279 -ipcHandle 3796 -initialChannelId {43f55a28-217a-4c4f-8d17-4ee57201c9fd} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4352 -prefsLen 34878 -prefMapHandle 4356 -prefMapSize 270279 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {30a11daf-18d5-4f05-a73b-fc1c652b0030} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4736 -prefsLen 34931 -prefMapHandle 4740 -prefMapSize 270279 -ipcHandle 4656 -initialChannelId {7a146014-59a9-4769-9bef-07da237b3767} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32952 -prefMapHandle 3140 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {42588124-52e1-4678-86b7-13d09aad43a9} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {4b594ca8-047d-4b60-9fea-f438218f67cc} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {49cf20e9-cc13-459d-89e9-e32013a0515a} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6128 -prefsLen 33071 -prefMapHandle 6132 -prefMapSize 270279 -jsInitHandle 6136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {c7c26bdf-2ecd-4f4d-b60b-aae45952ec36} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6396 -prefsLen 33071 -prefMapHandle 6436 -prefMapSize 270279 -jsInitHandle 6440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6448 -initialChannelId {0da56660-a533-4e9e-96d7-8f6156c618f8} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6664 -prefsLen 33071 -prefMapHandle 6668 -prefMapSize 270279 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6612 -initialChannelId {bf46ecd2-4d2c-4f1b-8ab3-fb3ce56cbf28} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6792 -prefsLen 35200 -prefMapHandle 6788 -prefMapSize 270279 -ipcHandle 6780 -initialChannelId {e5333b00-7bbb-44c8-b503-03fcb4ffc163} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 33071 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {5bae96aa-46d9-4198-8c4f-4e518a9a1657} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 5348 -prefsLen 35200 -prefMapHandle 5332 -prefMapSize 270279 -ipcHandle 5412 -initialChannelId {7ef7a106-fb1c-4e71-9bf5-30f8526d8663} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7196 -prefsLen 33071 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 7112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7176 -initialChannelId {f5525ab6-398b-4f54-b56d-29cc30042e77} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7520 -prefsLen 33983 -prefMapHandle 7604 -prefMapSize 270279 -jsInitHandle 7608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {46893613-3e7d-41a2-b51d-b3fc3f93d59d} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4640 -prefsLen 34468 -prefMapHandle 7452 -prefMapSize 270279 -jsInitHandle 8136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8144 -initialChannelId {885ce7d0-9db6-4817-a2d2-28228c46fc03} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2920 -prefsLen 36758 -prefMapHandle 8420 -prefMapSize 270279 -jsInitHandle 8428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7892 -initialChannelId {9caf24e5-2b33-410c-88b8-f3119068d06e} -parentPid 6808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=JMPkf7bS8lQ2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.youtube.com/watch?v=JMPkf7bS8lQ3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a8,0x7ffb5f51c188,0x7ffb5f51c194,0x7ffb5f51c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,16044207058758628115,9853795146321384370,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,7796880348069418171,10297597312974832711,262144 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,14135652633251725830,8063987159663632062,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,757235361767344805,14767115829987717684,2097152 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,15935517050609826406,12984549751067684556,2097152 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4080,i,17450909018870204427,14924479674515557230,2097152 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,9392831543477594420,7455806184899271442,2097152 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,15416321435803633945,8510135441978316294,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,96455285032601905,4864444519143861380,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5312,i,14848798115004673592,7569260327867966841,2097152 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,1256993856456569521,9962274250853669269,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,14761879478162955764,12999738539621839096,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6108,i,8462924918485623402,8060294031214496793,2097152 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3585558026622006777,7576096546835529565,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,8387341634128303967,4583300322944954806,524288 --field-trial-handle=2896,i,16210969759877085840,10847086927033982588,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:84⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
f_000085
the-real-index
the-real-index~RFe5cb250.TMP
Edge Profile.ico
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5cb2fc.TMP
index.txt
index.txt
index.txt
index.txt~RFe5c6ad7.TMP
the-real-index
the-real-index~RFe5cb1c3.TMP
sync_diagnostic.log
Local State
Local State
Local State
Local State
data_1
0d7e9f3b-24cc-4bed-9d15-8c29ba5747ea.tmp
20771
86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
D8D399566608B03F88A5D6EED1105753F9855D00
webext.sc.lz4
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
microsoft.directx.directsound.dll
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
dsetup.dll
dxupdate.cif
dxupdate.dll
dxwsetup.cif
dxwsetup.cif
dxwsetup.exe
dxwsetup.inf
dxwebsetup.exe
tmpaddon
tmpaddon
log.txt
log.txt
tmp.file
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
events
events
234d7807-c606-4921-826d-76e7918c75c4
34d18e47-fc93-4b12-9a0d-35a9b6b26b0b
76afda3a-f263-4cfb-b120-89b5547abd23
ba5fabef-0850-4d09-99c9-41e4adcfd5d6
fe8e22c5-f73b-40ae-a3ac-ffde5db888e7
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
{3585f67a-e217-4348-a842-d736c5f2dccd}.final
2232182701SeesravbiacteaWDosrgk.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
Y2Mate.Ih6XpKzl.is - KATLHAV 5 - KNGL X ERAY067 MANSUR OFFICIAL MUSIC VIDEO.mp3.part
ClassLibrary1.dll
ding.ogg
goback.ogg
hide.ogg
invoke.ogg
metronome.ogg
metronome_click.ogg
show.ogg
banjo.ogg
bdrum.ogg
bell.ogg
bit.ogg
click.ogg
cow_bell.ogg
dbass.ogg
didgeridoo.ogg
flute.ogg
guitar.ogg
harp.ogg
icechime.ogg
iron_xylophone.ogg
pling.ogg
sdrum.ogg
xylobone.ogg
audio.dll
file.dll
icon.ico
midiinput.dll
window.dll
DialogModule.dll
ExecuteShell.dll
FileDropper.dll
Minecraft Note Block Studio.exe
NekoPresence.dll
data.win
options.ini
pygml.dll
python38._pth
python38.dll
python38.zip
window_set_icon.dll
DirectX.log
DirectX.log
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xact_x64.cab
Apr2006_xact_x86.cab
Apr2006_xinput_x64.cab
Apr2006_xinput_x86.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_d3dx10_33_x86.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_xact_x64.cab
Apr2007_xact_x86.cab
Apr2007_xinput_x64.cab
Apr2007_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
Aug2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_d3dx10_35_x86.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_xact_x64.cab
Aug2007_xact_x86.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_d3dx10_39_x86.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_xact_x64.cab
Aug2008_xact_x86.cab
Aug2008_xaudio_x64.cab
Aug2008_xaudio_x86.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_D3DCompiler_42_x86.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_xact_x64.cab
Aug2009_xact_x86.cab
Aug2009_xaudio_x64.cab
Aug2009_xaudio_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx10_00_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_d3dx9_32_x86.cab
Dec2006_xact_x64.cab
Dec2006_xact_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Feb2006_xact_x64.cab
Feb2006_xact_x86.cab
Feb2007_xact_x64.cab
Feb2007_xact_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_xact_x64.cab
Feb2010_xact_x86.cab
Feb2010_xaudio_x64.cab
Feb2010_xaudio_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_d3dx10_34_x86.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_xact_x64.cab
Jun2007_xact_x86.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_d3dx10_38_x86.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_xact_x64.cab
Jun2008_xact_x86.cab
Jun2008_xaudio_x64.cab
Jun2008_xaudio_x86.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_D3DCompiler_43_x86.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_xact_x64.cab
Jun2010_xact_x86.cab
Jun2010_xaudio_x64.cab
Jun2010_xaudio_x86.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_d3dx10_37_x86.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_xact_x64.cab
Mar2008_xact_x86.cab
Mar2008_xaudio_x64.cab
Mar2008_xaudio_x86.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_d3dx10_41_x86.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_xact_x64.cab
Mar2009_xact_x86.cab
Mar2009_xaudio_x64.cab
Mar2009_xaudio_x86.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_d3dx10_36_x86.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_xact_x64.cab
Nov2007_xact_x86.cab
Nov2008_d3dx10_40_x64.cab
Nov2008_d3dx10_40_x86.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_xact_x64.cab
Nov2008_xact_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_xaudio_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
Oct2006_xact_x64.cab
Oct2006_xact_x86.cab
dsetup32.dll
dxupdate.cab
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
SETDDAA.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD43D.tmp
OLDDB1A.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
Aug2007_d3dx9_35_x86.cab
Mar2008_x3daudio_x86.cab
Jun2010_d3dx9_43_x64.cab
memory/3212-20823-0x0000000002130000-0x0000000002196000-memory.dmp
memory/5356-21209-0x0000000001F50000-0x0000000001FB9000-memory.dmp
memory/5476-20504-0x00000000020D0000-0x0000000002134000-memory.dmp
memory/6028-8006-0x000000000AE20000-0x000000000AE2A000-memory.dmp
memory/6028-8007-0x0000000071320000-0x000000007132A000-memory.dmp
memory/6728-21911-0x0000000002160000-0x00000000021C9000-memory.dmp