Analysis
- user interaction
yes - max time kernel
818s - max time network
790s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 22:47
General
- Target loader.exe
- Size 1.2MB
- Sample260910-2qvppsxbkb
- SHA256 377ab1abcc8b4d796360348f2256e4dea569a4302982319988d72134965a4521
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 6 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
remove IFEO.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 56 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 56 IoCs
- Suspicious use of SetWindowsHookEx 56 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9dd99c728,0x7ff9dd99c734,0x7ff9dd99c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13822499460381788845,373062211485385457,524288 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,14038989870527545056,95991597495425318,262144 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,4593079246305123284,4697135344468795879,524288 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,1036830331025290920,5872535117862396789,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,3299213701984304497,1718707373387693819,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,1849271442635552709,8533597933867630543,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4288 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,17502016580361232377,7836421873567862484,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,7364729788592020096,7953196549002692547,524288 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5816,i,17105076176710927927,6265090477511526972,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,9814562697704910073,3023165633271760255,524288 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,6230842266786103927,7426770695341881366,524288 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3428,i,12643812456215241932,17700338527458445829,524288 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4560,i,16255809556994850441,15024671670196899430,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3256,i,12674674928350923392,1258197317488481104,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3236,i,16159233520328929471,17741005611547982073,2097152 --field-trial-handle=2196,i,13795502837916371094,12428165079160959222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Drops desktop.ini file(s)
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {f557202d-ac76-4391-b86d-cf8893f3c463} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {82ef68dc-b98d-4cb4-aa92-74268a4c30c4} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3628 -prefsLen 27276 -prefMapHandle 3632 -prefMapSize 270279 -jsInitHandle 3636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3644 -initialChannelId {95403b01-2abe-4c87-946c-33a687e89fd3} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3796 -prefsLen 27276 -prefMapHandle 3800 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {1782a580-9ced-4ac4-b003-1eb0b2d34612} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2800 -prefsLen 25213 -prefMapHandle 2848 -prefMapSize 270279 -jsInitHandle 3084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {459d5f14-d816-41a5-bec1-ee9877a83b0e} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4448 -prefsLen 25213 -prefMapHandle 4452 -prefMapSize 270279 -jsInitHandle 4456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {5e801520-4fcf-44dc-be49-5d9bb23b10be} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4632 -prefsLen 25213 -prefMapHandle 4636 -prefMapSize 270279 -jsInitHandle 4640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2848 -initialChannelId {6f25d7de-7f7e-48ff-8500-aab85adf7c1b} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 892 -prefsLen 34824 -prefMapHandle 1272 -prefMapSize 270279 -jsInitHandle 4960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2532 -initialChannelId {0014bbe8-b5f7-4000-92bc-90f7f5bd67cc} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5436 -prefsLen 35012 -prefMapHandle 5432 -prefMapSize 270279 -ipcHandle 5468 -initialChannelId {396c1965-34e1-4980-bc33-8e68b704c0d2} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6260 -prefsLen 33071 -prefMapHandle 6052 -prefMapSize 270279 -jsInitHandle 6212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {c56f57a3-dc9e-43dd-9807-db6e88c81383} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6416 -prefsLen 35200 -prefMapHandle 6428 -prefMapSize 270279 -ipcHandle 6292 -initialChannelId {912f4c03-b181-4efe-986a-e7559639dcba} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4232 -prefsLen 33071 -prefMapHandle 4216 -prefMapSize 270279 -jsInitHandle 4220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6308 -initialChannelId {da11915a-453f-4c54-85aa-f7d913852eff} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7612 -prefsLen 36808 -prefMapHandle 7620 -prefMapSize 270279 -jsInitHandle 7624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7632 -initialChannelId {13336819-0033-4b0f-84c6-7cf1c1a3f29a} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3084 -prefsLen 36808 -prefMapHandle 7220 -prefMapSize 270279 -jsInitHandle 4804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4596 -initialChannelId {a3c7d882-60e2-4869-94ca-3679cdb07b8a} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2996 -prefsLen 36808 -prefMapHandle 6012 -prefMapSize 270279 -jsInitHandle 6272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {c03a39e5-58f1-46d1-9075-683979b2d0c6} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4356 -prefsLen 37291 -prefMapHandle 4632 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4640 -initialChannelId {c9d411b3-4be9-46d1-b366-a5de3e9c1331} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 37331 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 3016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4640 -initialChannelId {cfa703e3-230f-464b-9aba-9c3de07fc5ad} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7748 -prefsLen 37331 -prefMapHandle 6716 -prefMapSize 270279 -jsInitHandle 6108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7324 -initialChannelId {72dbf8a6-45b1-4a6d-bef9-baaad671b02b} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23072 -prefsLen 37387 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23148 -initialChannelId {b4ffe5b0-2240-4afd-9975-9e7f860678e9} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6172 -prefsLen 37387 -prefMapHandle 23236 -prefMapSize 270279 -jsInitHandle 23136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19292 -initialChannelId {8b02a5f0-db05-41fa-a850-1ac3a2318168} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14116 -prefsLen 37387 -prefMapHandle 14112 -prefMapSize 270279 -jsInitHandle 14040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23152 -initialChannelId {a0af2453-6d9b-47e4-bd27-703246120e7d} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\GTA SAN ANDREAS(MUKA)\" -spe -an -ai#7zMap5217:104:7zEvent289181⤵
-
C:\Users\Admin\Downloads\mtasa-1.6.exe"C:\Users\Admin\Downloads\mtasa-1.6.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe" /Q2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_24_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_25_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_26_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_27_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_28_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_29_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_30_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_1_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_2_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_3_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_31_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_4_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_32_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_00_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_5_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_6_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_33_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_33_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_7_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_34_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_34_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_8_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_35_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_35_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_9_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx9_36_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_36_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe X3DAudio1_2_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT2_10_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_37_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_37_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe X3DAudio1_3_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_0_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_0_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_38_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_38_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe X3DAudio1_4_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_1_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_1_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_39_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_39_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_2_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_2_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe X3DAudio1_5_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_3_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_3_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_40_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_40_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe X3DAudio1_6_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_4_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_4_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_41_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_41_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_42_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_42_x64.inf4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx11_42_x64.inf4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dcsx_42_x64.inf4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DCompiler_42_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_5_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_5_x64.inf4⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe X3DAudio1_7_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_6_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_6_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DX9_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx10_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dx11_43_x64.inf4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe d3dcsx_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe D3DCompiler_43_x64.inf4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XACT3_7_x64.inf4⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXD8A2.tmp\infinst.exe XAudio2_7_x64.inf4⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll4⤵
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe"C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe" /nolaunch /kdinstall2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe"C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe"2⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\MTA San Andreas All\1.6\GTA San Andreas\gta_sa.exe"C:\ProgramData\MTA San Andreas All\1.6\GTA San Andreas\gta_sa.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe"C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\MTA San Andreas All\1.6\GTA San Andreas\gta_sa.exe"C:\ProgramData\MTA San Andreas All\1.6\GTA San Andreas\gta_sa.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Users\Admin\Downloads\loader.exe"C:\Users\Admin\Downloads\loader.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\MTA San Andreas 1.6\Uninstall.exe"C:\Program Files (x86)\MTA San Andreas 1.6\Uninstall.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe"C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Program Files (x86)\MTA San Andreas 1.6\3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe"C:\Program Files (x86)\MTA San Andreas 1.6\Multi Theft Auto.exe" /nolaunch /kduninstall4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Indicator Removal
1Clear Persistence
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
FairplayKD.sys
latest_news.png
logfile.txt
logfile.txt
logfile.txt
logfile.txt
logfile.txt
logfile.txt
logfile.txt
writetest.txt
CGUI.lnf.xml
CGUI.xml
eax.dll
gta_sa.exe
ogg.dll
vorbis.dll
vorbisFile.dll
report.log
report.log
report.log
report.log
FairplayKD.sys
nsis.log
nsis.log
35DCA62E
35DCA62E
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000007
temp-index
the-real-index
data_1
History
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe587e53.TMP
Web Data
Local State
Local State
Local State
Local State
Local State
Local State
activity-stream.contile.json
386D22EAB36C3C5C3713F931E60D7F8CA78D773F
4A582FB8E156749B5278FF9BA4910C6DF676842C
5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
6DCAA1287D8E36566C7E31C78FFA6ED248D253EE
6E70ABF9E72706F76D3B5CD11A33881EA27D7805
BA2EED463964EC42412EEB304A6656CC93414A10
GL66ZIpjOk_pnw80D_eVvlyZXjWWn9NLj37yAqPiaag=.ico
506a3453-b6ab-401a-8b06-4841961a4ed8.zip
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
dsetup32.dll
dxupdate.cif
dxupdate.dll
dxwsetup.cif
dxwsetup.cif
dxwsetup.exe
dxwsetup.inf
dxwebsetup.exe
SimpleFC.dll
modern-header.bmp
AccessControl.dll
FastPerms.dll
InstallOptions.dll
LangDLL.dll
NSISdl.dll
System.dll
UAC.dll
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
md5dll.dll
nsArray.dll
nsDialogs.dll
tmpaddon
tmpaddon
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
417ac3da-ad66-49cc-a5b5-c19f924ab4bf
4f79a750-02b5-456f-b2cf-202bf8b318f1
56c20b21-afa3-4a7e-bd82-490b4efb795c
70242d32-6224-4905-9120-4d5877031144
70aca394-3218-47aa-a7f9-bfbe5d9e2b4b
c2b4715f-a754-407b-8b23-c55dd7fd05b3
efcfe746-c1cb-4650-8987-6404e7e6e739
downloads.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
3870112724rsegmnoittet-es.sqlite
AMBIENCE
m_weak.ped
saicon3.ICN
grass1_3.dff
german.gxt
loader.exe
desktop.ini
DirectX.log
DirectX.log
DirectX.log
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_MDX1_x86.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xact_x64.cab
Apr2006_xact_x86.cab
Apr2006_xinput_x64.cab
Apr2006_xinput_x86.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_d3dx10_33_x86.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_xact_x64.cab
Apr2007_xact_x86.cab
Apr2007_xinput_x64.cab
Apr2007_xinput_x86.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
Aug2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_d3dx10_35_x86.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_xact_x64.cab
Aug2007_xact_x86.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_d3dx10_39_x86.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_xact_x64.cab
Aug2008_xact_x86.cab
Aug2008_xaudio_x64.cab
Aug2008_xaudio_x86.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_D3DCompiler_42_x86.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_xact_x64.cab
Aug2009_xact_x86.cab
Aug2009_xaudio_x64.cab
Aug2009_xaudio_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx10_00_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_d3dx9_32_x86.cab
Dec2006_xact_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_xact_x64.cab
Feb2006_xact_x86.cab
Feb2007_xact_x64.cab
Feb2007_xact_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_xact_x64.cab
Feb2010_xact_x86.cab
Feb2010_xaudio_x64.cab
Feb2010_xaudio_x86.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_d3dx10_34_x86.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_xact_x64.cab
Jun2007_xact_x86.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_d3dx10_38_x86.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_xact_x64.cab
Jun2008_xact_x86.cab
Jun2008_xaudio_x64.cab
Jun2008_xaudio_x86.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_D3DCompiler_43_x86.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_xact_x64.cab
Jun2010_xact_x86.cab
Jun2010_xaudio_x64.cab
Jun2010_xaudio_x86.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_d3dx10_37_x86.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_xact_x64.cab
Mar2008_xact_x86.cab
Mar2008_xaudio_x64.cab
Mar2008_xaudio_x86.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_d3dx10_41_x86.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_xact_x64.cab
Mar2009_xact_x86.cab
Mar2009_xaudio_x86.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_d3dx10_36_x86.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_xact_x64.cab
Nov2007_xact_x86.cab
Nov2008_d3dx10_40_x64.cab
Nov2008_d3dx10_40_x86.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_xact_x64.cab
Nov2008_xact_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_xaudio_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
Oct2006_xact_x64.cab
Oct2006_xact_x86.cab
dsetup.dll
dxupdate.cab
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
SETFED6.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD1164.tmp
OLDFCA4.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
Microsoft.DirectX.dll
__AssemblyInfo__.ini
Feb2006_d3dx9_29_x86.cab
Apr2006_d3dx9_30_x64.cab
Dec2006_xact_x64.cab
Mar2009_xaudio_x64.cab
MDX_1.0.2907.0_x86.cab
memory/1664-33895-0x000000006F670000-0x000000006F680000-memory.dmp
memory/1664-33903-0x000000006E320000-0x000000006E330000-memory.dmp
memory/1664-33899-0x0000000003180000-0x0000000003196000-memory.dmp
memory/1664-33900-0x0000000003190000-0x00000000031A6000-memory.dmp
memory/1664-33886-0x000000006E330000-0x000000006E340000-memory.dmp
memory/1664-33948-0x000000006F670000-0x000000006F680000-memory.dmp
memory/3820-35054-0x0000000006CF0000-0x0000000006E10000-memory.dmp
memory/4572-35034-0x000000006F670000-0x000000006F680000-memory.dmp
memory/4572-35010-0x000000006E330000-0x000000006E340000-memory.dmp
memory/4572-35019-0x000000006F670000-0x000000006F680000-memory.dmp
memory/4572-35025-0x000000006E320000-0x000000006E330000-memory.dmp
memory/5436-34243-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5436-34193-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5436-34244-0x0000000000400000-0x0000000001577000-memory.dmp
memory/5436-34192-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5436-34221-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5436-34222-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5436-34223-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5436-34189-0x0000000005AA0000-0x0000000005AB6000-memory.dmp
memory/5436-34152-0x0000000000400000-0x0000000001577000-memory.dmp
memory/5436-34142-0x0000000001790000-0x0000000001898000-memory.dmp
memory/5436-34141-0x0000000001780000-0x0000000001789000-memory.dmp
memory/5644-32371-0x0000000000550000-0x00000000005A6000-memory.dmp
memory/6876-33872-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/6876-33855-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/6876-33825-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/6876-33767-0x00000000000F0000-0x0000000000120000-memory.dmp
memory/6876-33822-0x00000000036D0000-0x00000000036E6000-memory.dmp
memory/6876-33873-0x0000000000400000-0x0000000001577000-memory.dmp
memory/6876-33826-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/6876-33771-0x0000000000400000-0x0000000001577000-memory.dmp
memory/6876-33770-0x0000000001B30000-0x0000000001C38000-memory.dmp
memory/6876-33856-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/6876-33854-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/6876-33768-0x0000000000120000-0x0000000000129000-memory.dmp
memory/8552-33494-0x000000006E330000-0x000000006E340000-memory.dmp
memory/8552-33575-0x000000006F670000-0x000000006F680000-memory.dmp
memory/8552-33517-0x000000006F670000-0x000000006F680000-memory.dmp
memory/8552-33522-0x000000006E320000-0x000000006E330000-memory.dmp
memory/10916-33080-0x000000006F670000-0x000000006F680000-memory.dmp
memory/10916-33068-0x0000000003040000-0x0000000003056000-memory.dmp
memory/10916-33020-0x000000006E330000-0x000000006E340000-memory.dmp
memory/10916-33071-0x000000006E320000-0x000000006E330000-memory.dmp
memory/10916-33038-0x000000006F670000-0x000000006F680000-memory.dmp
memory/10916-33067-0x0000000003030000-0x0000000003046000-memory.dmp