Overview
overview
7Static
static
5DLSS5-Swap...le.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3DLSS 5 Swapper.exe
windows10-2004-x64
7LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows10-2004-x64
3resources/elevate.exe
windows10-2004-x64
3resources/...on.exe
windows10-2004-x64
1resources/...er.ps1
windows10-2004-x64
3resources/...64.exe
windows10-2004-x64
1resources/...ed.dll
windows10-2004-x64
3resources/...ed.dll
windows10-2004-x64
1resources/...s5.dll
windows10-2004-x64
1resources/...32.dll
windows10-2004-x64
3resources/...64.dll
windows10-2004-x64
1resources/...ss.dll
windows10-2004-x64
1resources/...sg.dll
windows10-2004-x64
1resources/...nr.dll
windows10-2004-x64
1resources/...on.dll
windows10-2004-x64
1resources/...ss.dll
windows10-2004-x64
1resources/..._g.dll
windows10-2004-x64
1resources/...nr.dll
windows10-2004-x64
1resources/...er.dll
windows10-2004-x64
1resources/...is.dll
windows10-2004-x64
1resources/...cl.dll
windows10-2004-x64
1resources/...ex.dll
windows10-2004-x64
1vk_swiftshader.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
- max time kernel
300s - max time network
316s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
DLSS5-Swapper-2.2.0-portable.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
DLSS 5 Swapper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
resources/app.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
resources/payload/ReShade_Setup_6.8.0_Addon.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
resources/payload/feeder/Verify-DLSS5Feeder.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
resources/payload/feeder/dlss5-feed-host64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
resources/payload/feeder/dlss5-feed.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
resources/payload/feeder/dlss5-feed.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
resources/payload/renodx-dlss5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/payload/reshade-vulkan/ReShade32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
resources/payload/reshade-vulkan/ReShade64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/payload/streamline/nvngx_dlss.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/payload/streamline/nvngx_dlssg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/payload/streamline/nvngx_dlssnr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/payload/streamline/sl.common.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/payload/streamline/sl.dlss.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/payload/streamline/sl.dlss_g.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/payload/streamline/sl.dlss_nr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/payload/streamline/sl.interposer.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/payload/streamline/sl.nis.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/payload/streamline/sl.pcl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/payload/streamline/sl.reflex.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target DLSS 5 Swapper.exe
- Size 180.1MB
- Sample260910-ebwbcswfjh
- SHA256 9e5fd2106c75118c50222f37cde56da0b7bafa6760e5b29283961f1b0bbd3969
- MD5 9415fb4c3b768d4d491ac3127fa2710e
- SHA1 8d5b9391d8ce9b7808b80cd353bedab3b177d7e8
- SHA512 57befd161be4208d5a0c6dcff28ce5117de8f692de55e1cd9f2fd58f786ef23a295df43bcbf57378497da39ed4083e407de299bb6c7bb63a99c0ac531091d1aa
- SSDEEP 1572864:UH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Jsok+hK7
- TLSH T17D988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation DLSS 5 Swapper.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation DLSS 5 Swapper.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 4796 reg.exe 224 reg.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3600 DLSS 5 Swapper.exe 3600 DLSS 5 Swapper.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe Token: SeShutdownPrivilege 2284 DLSS 5 Swapper.exe Token: SeCreatePagefilePrivilege 2284 DLSS 5 Swapper.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2284 wrote to memory of 1900 2284 DLSS 5 Swapper.exe 81 PID 2284 wrote to memory of 1900 2284 DLSS 5 Swapper.exe 81 PID 2284 wrote to memory of 4908 2284 DLSS 5 Swapper.exe 82 PID 2284 wrote to memory of 1744 2284 DLSS 5 Swapper.exe 83 PID 2284 wrote to memory of 1744 2284 DLSS 5 Swapper.exe 83 PID 2284 wrote to memory of 4796 2284 DLSS 5 Swapper.exe 85 PID 2284 wrote to memory of 224 2284 DLSS 5 Swapper.exe 87 PID 2284 wrote to memory of 3600 2284 DLSS 5 Swapper.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,11740993618824414841,6625867828635060414,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:22⤵PID:1900
-
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --field-trial-handle=2248,i,11740993618824414841,6625867828635060414,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:32⤵PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --app-user-model-id=com.rakan.dlss5swapper --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2464,i,11740993618824414841,6625867828635060414,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:12⤵
- Checks computer location settings
PID:1744
-
-
C:\Windows\system32\reg.exereg query HKCU\Software\Valve\Steam /v SteamPath2⤵
- Modifies registry key
PID:4796
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games2⤵
- Modifies registry key
PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe"C:\Users\Admin\AppData\Local\Temp\DLSS 5 Swapper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\dlss5-swapper" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1596,i,11740993618824414841,6625867828635060414,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\dlss5-swapper\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\dlss5-swapper\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\dlss5-swapper\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\dlss5-swapper\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP