Overview
overview
8Static
static
5DLSS5-Swap...le.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3DLSS 5 Swapper.exe
windows11-21h2-x64
1LICENSES.c...m.html
windows11-21h2-x64
8d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/app.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...on.exe
windows11-21h2-x64
1resources/...er.ps1
windows11-21h2-x64
3resources/...64.exe
windows11-21h2-x64
1resources/...ed.dll
windows11-21h2-x64
3resources/...ed.dll
windows11-21h2-x64
1resources/...s5.dll
windows11-21h2-x64
1resources/...32.dll
windows11-21h2-x64
3resources/...64.dll
windows11-21h2-x64
1resources/...ss.dll
windows11-21h2-x64
1resources/...sg.dll
windows11-21h2-x64
1resources/...nr.dll
windows11-21h2-x64
1resources/...on.dll
windows11-21h2-x64
1resources/...ss.dll
windows11-21h2-x64
1resources/..._g.dll
windows11-21h2-x64
1resources/...nr.dll
windows11-21h2-x64
1resources/...er.dll
windows11-21h2-x64
1resources/...is.dll
windows11-21h2-x64
1resources/...cl.dll
windows11-21h2-x64
1resources/...ex.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
899s - max time network
393s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/09/2026, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
DLSS5-Swapper-2.2.0-portable.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
DLSS 5 Swapper.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
d3dcompiler_47.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
ffmpeg.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
resources/app.js
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
resources/payload/ReShade_Setup_6.8.0_Addon.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
resources/payload/feeder/Verify-DLSS5Feeder.ps1
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
resources/payload/feeder/dlss5-feed-host64.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
resources/payload/feeder/dlss5-feed.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
resources/payload/feeder/dlss5-feed.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
resources/payload/renodx-dlss5.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
resources/payload/reshade-vulkan/ReShade32.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
resources/payload/reshade-vulkan/ReShade64.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
resources/payload/streamline/nvngx_dlss.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
resources/payload/streamline/nvngx_dlssg.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
resources/payload/streamline/nvngx_dlssnr.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
resources/payload/streamline/sl.common.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
resources/payload/streamline/sl.dlss.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
resources/payload/streamline/sl.dlss_g.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
resources/payload/streamline/sl.dlss_nr.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
resources/payload/streamline/sl.interposer.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
resources/payload/streamline/sl.nis.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
resources/payload/streamline/sl.pcl.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
resources/payload/streamline/sl.reflex.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target DLSS 5 Swapper.exe
- Size 180.1MB
- Sample260910-ea47waeq3z
- SHA256 9e5fd2106c75118c50222f37cde56da0b7bafa6760e5b29283961f1b0bbd3969
- MD5 9415fb4c3b768d4d491ac3127fa2710e
- SHA1 8d5b9391d8ce9b7808b80cd353bedab3b177d7e8
- SHA512 57befd161be4208d5a0c6dcff28ce5117de8f692de55e1cd9f2fd58f786ef23a295df43bcbf57378497da39ed4083e407de299bb6c7bb63a99c0ac531091d1aa
- SSDEEP 1572864:UH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Jsok+hK7
- TLSH T17D988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry key 1 TTPs 2 IoCs
pid Process 396 reg.exe 4104 reg.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4116 DLSS 5 Swapper.exe 4116 DLSS 5 Swapper.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 4288 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 4288 DLSS 5 Swapper.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4288 wrote to memory of 2480 4288 DLSS 5 Swapper.exe 79 PID 4288 wrote to memory of 2480 4288 DLSS 5 Swapper.exe 79 PID 4288 wrote to memory of 3276 4288 DLSS 5 Swapper.exe 80 PID 4288 wrote to memory of 3428 4288 DLSS 5 Swapper.exe 81 PID 4288 wrote to memory of 3428 4288 DLSS 5 Swapper.exe 81 PID 4288 wrote to memory of 396 4288 DLSS 5 Swapper.exe 82 PID 4288 wrote to memory of 4104 4288 DLSS 5 Swapper.exe 84 PID 4288 wrote to memory of 4116 4288 DLSS 5 Swapper.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1756,i,16217727209923927689,8519176765972345378,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:22⤵PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --field-trial-handle=2156,i,16217727209923927689,8519176765972345378,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:112⤵PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --app-user-model-id=com.rakan.dlss5swapper --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2388,i,16217727209923927689,8519176765972345378,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:12⤵PID:3428
-
-
C:\Windows\system32\reg.exereg query HKCU\Software\Valve\Steam /v SteamPath2⤵
- Modifies registry key
PID:396
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games2⤵
- Modifies registry key
PID:4104
-
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3032,i,16217727209923927689,8519176765972345378,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512