Dxcap.exe

DirectX diagnostics/debugger included with Visual Studio.

Execute

Local execution of a process as a subprocess of dxcap.exe

Dxcap.exe -c {PATH_ABSOLUTE:.exe}

Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument. — MITRE: T1127 — Privileges: User

Execute an arbitrary executable via trusted system executable.

dxcap.exe -usage

Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it. — MITRE: T1127 — Privileges: User