Analysis
- user interaction
yes - max time kernel
689s - max time network
609s - platform
windows10-2004_x64 - resource
win10v2004-20260513-uk - resource tags
- submitted
05/09/2026, 07:08
General
- Target ExLoader_Installer.exe
- Size 173KB
- Sample260905-hyb3sagl21
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 4 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\ExLoader\ExLoader.exe"C:\Program Files\ExLoader\ExLoader.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/o/oauth2/v2/auth?client_id=271686438760-tmrstjenhl84ugpc1gmq1q3rarashrre.apps.googleusercontent.com&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A50165&scope=email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&code_challenge=gBsxF1iWvGMCZOWAKX4FK9ATF9VCtSkdOxBGamk08Es&code_challenge_method=S256&state=k-WmcMDtYtIpSK-qo0Dslv05_HUQrfnH2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://accounts.google.com/o/oauth2/v2/auth?client_id=271686438760-tmrstjenhl84ugpc1gmq1q3rarashrre.apps.googleusercontent.com&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A50165&scope=email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&code_challenge=gBsxF1iWvGMCZOWAKX4FK9ATF9VCtSkdOxBGamk08Es&code_challenge_method=S256&state=k-WmcMDtYtIpSK-qo0Dslv05_HUQrfnH3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffe8d78c188,0x7ffe8d78c194,0x7ffe8d78c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,3159835964033076267,16306472454695588836,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,9532837866330334061,4191998342054491553,262144 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,2156712670402087131,11103353544660849329,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16510714250178132214,11549873215475068886,2097152 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2169999975862821102,10518998478915785567,2097152 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,2918783003838397626,720974858677887724,2097152 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,13161246700681101489,2122700130751538155,2097152 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,10801043908279949282,13255891141150516472,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,915934277907013312,12891375824902885872,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,5106129363294391373,3734231702848583815,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7444530429106548303,1345455170656325118,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6148,i,4656733402386704657,16667774055249378487,2097152 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,8116742332323142456,12402344908837206745,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1274649564796967976,933070938434784826,524288 --field-trial-handle=2356,i,7095812251255589760,4653773036004323182,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:84⤵
- Modifies registry class
-
-
-
-
C:\Program Files\ExLoader\inconspicuousconfigure.exe"C:\Program Files\ExLoader\inconspicuousconfigure.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command (gwmi Win32_BaseBoard)3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exe /Q3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exeC:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\tools\dxwebsetup.exe /Q4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_24_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_25_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_26_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_27_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_28_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_29_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_30_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_1_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll6⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_2_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_3_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_31_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_4_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_32_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_00_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_5_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_6_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_33_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_33_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_7_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_34_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_34_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_8_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_35_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_35_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_9_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx9_36_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_36_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe X3DAudio1_2_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT2_10_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_37_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_37_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe X3DAudio1_3_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_0_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_0_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_38_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_38_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe X3DAudio1_4_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_1_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_1_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_39_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_39_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_2_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_2_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe X3DAudio1_5_x64.inf6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_3_x64.inf6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_3_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_40_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_40_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe X3DAudio1_6_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_4_x64.inf6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_4_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_41_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_41_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_42_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_42_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx11_42_x64.inf6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dcsx_42_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DCompiler_42_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_5_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_5_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe X3DAudio1_7_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_6_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_6_x64.inf6⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll6⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DX9_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx10_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dx11_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe d3dcsx_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe D3DCompiler_43_x64.inf6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XACT3_7_x64.inf6⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DX26B.tmp\infinst.exe XAudio2_7_x64.inf6⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll6⤵
- Modifies registry class
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4Software Discovery
1Security Software Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
ExLoader.exe
ExLoader.zip
audioplayers_windows_plugin.dll
app.so
AssetManifest.bin
FontManifest.json
NativeAssetsManifest.json
Warcraft.jpg
logo.png
uk.png
NoirPro-Bold.otf
NoirPro-Light.otf
NoirPro-Medium.otf
NoirPro-Regular.otf
NoirPro-SemiBold.otf
grain.png
mascot.png
background_image.frag
modification_card_image.frag
raindrops.frag
shimmer_effect.frag
winter.frag
icudtl.dat
flutter_windows.dll
msvcp140.dll
permission_handler_windows_plugin.dll
url_launcher_windows_plugin.dll
vcruntime140.dll
vcruntime140_1.dll
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe59e035.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
data_1
46b88a71-eec5-444a-bfbe-25b3a58c6189.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
microsoft.directx.directsound.dll
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
dxupdate.cif
dxupdate.dll
dxwsetup.cif
__PSScriptPolicyTest_wwlalzqw.brh.ps1
af115dc3-c90d-4df6-98fb-ae73db197e97.tmp
d7d0c829-f4eb-4d52-a091-b9b39da4afc6.tmp
01ea7e9f526e177156614da305eb369b.webp
02d0ad957fa31d5b273fe413615716e8.gif
0a1d4df1c52a9bf8b0be65efc564c90c.webp
0b76b0766b6cadfd241c0e9e697d865e.webp
0eb49e5656ace9453048eed0256286c9.webp
1238bbf727da297c33297ca90db26b33.jpg
13c0aa4c8798b433117c0503052b36f5.webp
178adac81c1363d482ee3422e343e5ad.webp
1cc191434b7c5a0ddfb7e8933c6ffd39.webp
1f97590d229e484c25eda2b3a7e5e2b5.webp
20d5acdd6b6aa1f32386e853341a3246.webp
2ea23fd9febbded89e606a214d031b3a.webp
35aec07e89e7693c5bcaf8d48c6c4802.webp
3623c6ff5bba27dec8ffa0959b5b6325.webp
3b251221ef434c864cc2a3b1c0a52a98.webp
447f87a4dc10a87213d8afa439f3187c.jpg
49680644e6ad999e60cc19f916ef8274.webp
4a4176b080a0182d4c335be7df581294.webp
5239273995f552dedb097aea59f43d07.webp
6cf5b975a991d6fb169daa7e8b2ceaaa.webp
731a8729c158a7b043c4cb6537d7f4de.webp
74b263ff6c6d183488ed486b300e5000.webp
74dbac57994b1962c1b5a6b623f3731d.webp
78c42461d08cbd09d90c22b538a0590a.webp
78cc7588e299db45e94f44d7357f9291.webp
816468bee988a6b92e8d0e284672d2cb.webp
8288ed517e2ed373c4b6085fe8102e2c.webp
9875c9610b069277fef546eb9ce8f871.webp
99d19fcea9f1b612f3731b648cc9fabd.webp
9a7d857fd557514347dbdcab5acdd884.webp
9d3e4043483ce9fce43d1ee6c2b31cb9.jpg
9f6951012773fab7d97dfe18f4ee3f0a.webp
a6985f41a4e7006c45563a2e179892d7.webp
ae5e5005cc18ce5ab8ebb277d99564bc.webp
bf9a65fc558a2145037c98dc4a7c2295.webp
c1ddd7118cb55f675874891138dc3f46.webp
d842b0a6ffc8f0c686497037623fb2bf.webp
d957df5ffd7094ce8f53ed4fab03901a.webp
dd191ce20c0b448ff4f96e3faa35707d.webp
dd80e9823a9b79b1cc646212b6cad025.webp
dd919fec3fdb56bf251854d5c29fc9e0.webp
de7912048910995cd25c720efe2a3696.webp
df629312657fa988ffe1eb8631d737a6.webp
dfc86cc55e88d2e58422721cc12e186a.webp
e4c8a48a7fc0abec253fa04891e633d5.webp
e5a1847b2ca3e9ab31e998683699b70a.jpg
e7683e4327a10df87e941d1c10362e97.webp
eeaf324c921ac5b1ee4972584f7438b7.webp
fe15ed7e3f3422b3d576276906f6aaad.webp
61580b49-73e6-4b1c-b90a-0c0a2bc424c9.tmp
game_icons.zip
ServerPacketId_Modifications.hive
ServerPacketId_ModificationsLocalData.hive
version_box.hive
libCachedImageData_v2.json
shared_preferences.json
shared_preferences.json
dxwebsetup.exe
locations_v2.csv
weather_now.json
shared_preferences.json
ExLoader.lnk
DirectX.log
DirectX.log
DirectX.log
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xact_x64.cab
Apr2006_xact_x86.cab
Apr2006_xinput_x86.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_d3dx10_33_x86.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_xact_x64.cab
Apr2007_xact_x86.cab
Apr2007_xinput_x64.cab
Apr2007_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_xact_x64.cab
Aug2007_xact_x86.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_d3dx10_39_x86.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_xact_x64.cab
Aug2008_xact_x86.cab
Aug2008_xaudio_x64.cab
Aug2008_xaudio_x86.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_D3DCompiler_42_x86.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_xact_x64.cab
Aug2009_xact_x86.cab
Aug2009_xaudio_x64.cab
Aug2009_xaudio_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx10_00_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_xact_x64.cab
Dec2006_xact_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Feb2006_xact_x64.cab
Feb2006_xact_x86.cab
Feb2007_xact_x64.cab
Feb2007_xact_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_xact_x64.cab
Feb2010_xact_x86.cab
Feb2010_xaudio_x64.cab
Feb2010_xaudio_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_d3dx10_34_x86.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_xact_x64.cab
Jun2007_xact_x86.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_d3dx10_38_x86.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_xact_x64.cab
Jun2008_xact_x86.cab
Jun2008_xaudio_x64.cab
Jun2008_xaudio_x86.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_D3DCompiler_43_x86.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_xact_x64.cab
Jun2010_xact_x86.cab
Jun2010_xaudio_x64.cab
Jun2010_xaudio_x86.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_d3dx10_37_x86.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_xact_x64.cab
Mar2008_xact_x86.cab
Mar2008_xaudio_x64.cab
Mar2008_xaudio_x86.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_d3dx10_41_x86.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_xact_x64.cab
Mar2009_xact_x86.cab
Mar2009_xaudio_x64.cab
Mar2009_xaudio_x86.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_d3dx10_36_x86.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_xact_x64.cab
Nov2007_xact_x86.cab
Nov2008_d3dx10_40_x64.cab
Nov2008_d3dx10_40_x86.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_xact_x64.cab
Nov2008_xact_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_xaudio_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
Oct2006_xact_x64.cab
Oct2006_xact_x86.cab
dsetup.dll
dsetup32.dll
dxupdate.cab
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
SET3968.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD3571.tmp
OLD580C.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
Apr2006_xinput_x64.cab
Aug2005_d3dx9_27_x86.cab
Dec2006_d3dx9_32_x86.cab
Aug2007_d3dx10_35_x86.cab
MDX_1.0.2908.0_x86.cab
memory/672-17781-0x0000000001F00000-0x0000000001F5E000-memory.dmp
memory/2636-974-0x0000021B62150000-0x0000021B62172000-memory.dmp
memory/2736-17970-0x0000000002070000-0x00000000020CE000-memory.dmp
memory/3484-16980-0x0000000001F70000-0x0000000001FCC000-memory.dmp
memory/4380-0-0x000001D8B5140000-0x000001D8B5141000-memory.dmp
memory/4380-2-0x000001D8B5220000-0x000001D8B67B5000-memory.dmp
memory/4380-4-0x000001D8B5150000-0x000001D8B5151000-memory.dmp
memory/4380-1-0x000001D8B5220000-0x000001D8B67B5000-memory.dmp
memory/4380-3-0x000001D8B5220000-0x000001D8B67B5000-memory.dmp
memory/4380-7-0x000001D8B5180000-0x000001D8B5200000-memory.dmp
memory/4380-6-0x000001D8B5180000-0x000001D8B5200000-memory.dmp
memory/4380-25-0x000001D8B9D10000-0x000001D8B9D16000-memory.dmp
memory/5040-213-0x000001E76FFA0000-0x000001E77154D000-memory.dmp
memory/5040-212-0x000001E76DD50000-0x000001E76DD51000-memory.dmp
memory/5040-215-0x000001E76FFA0000-0x000001E77154D000-memory.dmp
memory/5040-220-0x000001E771680000-0x000001E771700000-memory.dmp
memory/5040-219-0x000001E771680000-0x000001E771700000-memory.dmp
memory/5040-214-0x000001E76FFA0000-0x000001E77154D000-memory.dmp
memory/5040-216-0x000001E76FF60000-0x000001E76FF61000-memory.dmp
memory/5848-605-0x00000156F2980000-0x00000156F2A00000-memory.dmp
memory/5848-604-0x00000156F2980000-0x00000156F2A00000-memory.dmp