Overview

overview

8

Static

static

3

The Boys A...er.exe

windows10-2004-x64

7

The Boys A...er.exe

windows11-21h2-x64

8

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows11-21h2-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-21h2-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-21h2-x64

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows11-21h2-x64

3

$PLUGINSDI...le.dll

windows10-2004-x64

3

$PLUGINSDI...le.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    899s
  • max time network
    898s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 19:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    The Boys Ascent Installer.exe
  • Size 345KB
  • Sample260602-x53lmsds4x
  • SHA256 4d520ba4df04666acedac089e40729a5b52daa0f00361a8b17ff8fd7c58ba40a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 2 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 21 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\The Boys Ascent Launcher_temp_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\The Boys Ascent Launcher_temp_installer.exe" /S --isFromWeb --uuid "1F7FE43B-AEAE-48F1-8C39-85B5D1873546" /D=C:\Users\Admin\AppData\Local\The Boys Ascent Launcher
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C icacls "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher" /grant:r "%userdomain%\%username%":F /T /c
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher" /grant:r "MJNYKXSZ\Admin":F /T /c
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:960
      • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3164
        • C:\Windows\Temp\{74292144-9566-4322-B4A9-3C2A21EBED2A}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{74292144-9566-4322-B4A9-3C2A21EBED2A}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe" -burn.filehandle.attached=620 -burn.filehandle.self=628 /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2160
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="5c78cd5c-d90a-4161-85f3-bc6454e7e6f9" dir=in action=allow description="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" program="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:244
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="5c78cd5c-d90a-4161-85f3-bc6454e7e6f9" dir=in action=allow description="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\LauncherElectron.exe" program="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\LauncherElectron.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4568
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2332
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C pwsh -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
    1⤵
      PID:4144
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3736
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C pwsh -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
      1⤵
        PID:3240
      • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
        "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
          "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Crashpad" --url=https://sentry.xsolla.com/api/63/minidump/?sentry_key=caab4afe5abf4707808a52afbe2d46c4 "--annotation=_productName=The Boys Ascent Launcher" --annotation=_version=3.32.16-latest.32 --annotation=plat=Win64 --annotation=prod=Electron --annotation=sentry___initialScope={} --annotation=ver=27.1.3 --initial-client-data=0x504,0x508,0x50c,0x488,0x510,0x7ff79c06a9e0,0x7ff79c06a9f0,0x7ff79c06aa00
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3236
        • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
          "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1992 --field-trial-handle=1996,i,9874656167955953737,14959350542737422498,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3792
        • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
          "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --mojo-platform-channel-handle=2796 --field-trial-handle=1996,i,9874656167955953737,14959350542737422498,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:496
        • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
          "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --app-path="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3384 --field-trial-handle=1996,i,9874656167955953737,14959350542737422498,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1132
        • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\LauncherElectron.exe
          "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\LauncherElectron.exe" --launcherId 6694 --launcherName "The Boys Ascent Launcher"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:6068
          • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\crashpad_handler.exe
            "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\LauncherElectron --metrics-dir=C:\Users\Admin\AppData\Local\LauncherElectron --url=https://sentry.xsolla.com:443/api/102/minidump/?sentry_client=sentry.native/0.4.8&sentry_key=33c59d83de2148629be1c7c1c89af8b2 --attachment=C:\Users\Admin\AppData\Local\LauncherElectron\1c9025ea-71fd-4b58-1069-f87d0167fd62.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\LauncherElectron\1c9025ea-71fd-4b58-1069-f87d0167fd62.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\LauncherElectron\1c9025ea-71fd-4b58-1069-f87d0167fd62.run\__sentry-breadcrumb2 --initial-client-data=0x458,0x45c,0x460,0x434,0x464,0x7ffdd8870808,0x7ffdd8870828,0x7ffdd8870840
            3⤵
            • Executes dropped EXE
            PID:8560
        • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\elevate.exe
          "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\elevate.exe" C:\Users\Admin\AppData\Local\xsolla-launcher-updater\pending\installer.exe --updated /S --force-run
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4900
          • C:\Users\Admin\AppData\Local\xsolla-launcher-updater\pending\installer.exe
            "C:\Users\Admin\AppData\Local\xsolla-launcher-updater\pending\installer.exe" --updated /S --force-run
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3808
            • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe
              "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe" /q /norestart
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5444
              • C:\Windows\Temp\{59C3337F-29C4-46DA-A304-1047C93324A2}\.cr\vc_redist.x64.exe
                "C:\Windows\Temp\{59C3337F-29C4-46DA-A304-1047C93324A2}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=696 /q /norestart
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5472
            • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\kernel\setup-kernel.exe
              "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\kernel\setup-kernel.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5692
              • C:\Users\Admin\AppData\Local\Temp\is-NIMB5.tmp\setup-kernel.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-NIMB5.tmp\setup-kernel.tmp" /SL5="$11023C,979118,778240,C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\kernel\setup-kernel.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:5672
                • C:\Users\Admin\AppData\Local\Temp\is-FBGNN.tmp\_isetup\_setup64.tmp
                  helper 105 0x46C
                  6⤵
                  • Executes dropped EXE
                  PID:5796
                • C:\Windows\system32\expand.exe
                  "C:\Windows\system32\expand.exe" "C:\ProgramData\DACS\ROCKIT\kernel\ROCKIT.cab" "C:\ProgramData\DACS\ROCKIT\kernel" -f:dxdd*
                  6⤵
                  • Drops file in Windows directory
                  PID:5856
                • C:\Windows\system32\expand.exe
                  "C:\Windows\system32\expand.exe" "C:\ProgramData\DACS\ROCKIT\kernel\ROCKIT.cab" "C:\ProgramData\DACS\ROCKIT\kernel" -f:dxfm*
                  6⤵
                  • Drops file in Windows directory
                  PID:5932
                • C:\Windows\system32\certutil.exe
                  "C:\Windows\system32\certutil.exe" -f -addstore TrustedPublisher "C:\ProgramData\DACS\ROCKIT\kernel\dacs.cer"
                  6⤵
                  • Manipulates Digital Signatures
                  PID:6028
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\ProgramData\DACS\ROCKIT\kernel\dxfm\dxfm.inf
                  6⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:6860
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    7⤵
                    • Checks processor information in registry
                    • Suspicious use of WriteProcessMemory
                    PID:6504
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      8⤵
                        PID:6304
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" start dxfm
                    6⤵
                    • Launches sc.exe
                    PID:6680
                  • C:\ProgramData\DACS\ROCKIT\kernel\dxdd\devcon.exe
                    "C:\ProgramData\DACS\ROCKIT\kernel\dxdd\devcon.exe" install "C:\ProgramData\DACS\ROCKIT\kernel\dxdd\dxdd.inf" root\dxdd
                    6⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6748
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /C powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4648
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /C pwsh -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"
          1⤵
            PID:1032
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:6836
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{05137d56-99fe-164d-98fe-bc74772711a9}\dxfm.inf" "9" "449085c6f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\ProgramData\DACS\ROCKIT\kernel\dxfm"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:6100
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\dxfm.inf_amd64_7a9e72107a494809\dxfm.inf" "0" "449085c6f" "000000000000017C" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:6540
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e3fa2071-ff16-5c4a-ada5-17871e27802f}\dxdd.inf" "9" "46b357bf3" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "c:\programdata\dacs\rockit\kernel\dxdd"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:6808
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\SCSIADAPTER\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce884221ae399:DxDDDevice:11.46.3.80:root\dxdd," "46b357bf3" "0000000000000158" "521b"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:7084
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:6264
            • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
              "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --updated
              1⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:7416
              • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
                "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Crashpad" --url=https://sentry.xsolla.com/api/63/minidump/?sentry_key=caab4afe5abf4707808a52afbe2d46c4 "--annotation=_productName=The Boys Ascent Launcher" --annotation=_version=3.32.19-latest.41 --annotation=plat=Win64 --annotation=prod=Electron --annotation=sentry___initialScope={} --annotation=ver=27.1.3 --initial-client-data=0x500,0x508,0x50c,0x488,0x510,0x7ff79c06a9e0,0x7ff79c06a9f0,0x7ff79c06aa00
                2⤵
                • Executes dropped EXE
                PID:7572
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "ie4uinit.exe -show"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:7648
                • C:\Windows\system32\ie4uinit.exe
                  ie4uinit.exe -show
                  3⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  PID:7868
              • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
                "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2008 --field-trial-handle=2012,i,9363902973163020707,11635386154524417903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                2⤵
                • Executes dropped EXE
                PID:7724
              • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
                "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --mojo-platform-channel-handle=2392 --field-trial-handle=2012,i,9363902973163020707,11635386154524417903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                2⤵
                • Executes dropped EXE
                PID:7780
              • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
                "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --app-path="C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3384 --field-trial-handle=2012,i,9363902973163020707,11635386154524417903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                2⤵
                • Executes dropped EXE
                PID:8244
              • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\LauncherElectron.exe
                "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\LauncherElectron.exe" --launcherId 6694 --launcherName "The Boys Ascent Launcher"
                2⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:7236
                • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\crashpad_handler.exe
                  "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\LauncherElectron --metrics-dir=C:\Users\Admin\AppData\Local\LauncherElectron --url=https://sentry.xsolla.com:443/api/102/minidump/?sentry_client=sentry.native/0.4.8&sentry_key=33c59d83de2148629be1c7c1c89af8b2 --attachment=C:\Users\Admin\AppData\Local\LauncherElectron\299003a5-8238-417d-9d4d-8d757a2abcb6.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\LauncherElectron\299003a5-8238-417d-9d4d-8d757a2abcb6.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\LauncherElectron\299003a5-8238-417d-9d4d-8d757a2abcb6.run\__sentry-breadcrumb2 --initial-client-data=0x438,0x43c,0x440,0x414,0x444,0x7ffdcd650808,0x7ffdcd650828,0x7ffdcd650840
                  3⤵
                  • Executes dropped EXE
                  PID:7352
              • C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe
                "C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3988 --field-trial-handle=2012,i,9363902973163020707,11635386154524417903,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:5748
            • C:\Windows\system32\wbem\WMIADAP.EXE
              wmiadap.exe /R /T
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              PID:5988

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Defense Evasion

                  File and Directory Permissions Modification

                  1
                  T1222

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Modify Registry

                  3
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  SIP and Trust Provider Hijacking

                  1
                  T1553.003

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  1
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  user_app_data_path.txt
                  • Path C:\ProgramData\user_app_data_path.txt
                  • Size 30B
                  • SHA256 f9c0b7721ee93a273543fb3f51c3699145a5a404670b2da929ec48b2f4c1a221
                  • MD5 SHA1 SHA512
                  Submit Download

                  250291F3FA7935E360EA9925CBAB58AC_0F96EBEEF177370EC00C3FC747F7A031
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\250291F3FA7935E360EA9925CBAB58AC_0F96EBEEF177370EC00C3FC747F7A031
                  • Size 471B
                  • SHA256 6db908de46d6bc2dd82fe2e936bb1a3f7cb3388b0c035b4dbf72e6c81005b4d6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8A7891822FCFF127E4EADADE9757112B
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
                  • Size 2KB
                  • SHA256 7072c52f510b36070efbe8b2a995d1d1d3b4f8ac9d62b931488394904b6f4223
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  250291F3FA7935E360EA9925CBAB58AC_0F96EBEEF177370EC00C3FC747F7A031
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\250291F3FA7935E360EA9925CBAB58AC_0F96EBEEF177370EC00C3FC747F7A031
                  • Size 404B
                  • SHA256 fe38ffd402fa196b27856de180a118a1050bc0bfaeb784ea96e5d5702ac9d859
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8A7891822FCFF127E4EADADE9757112B
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
                  • Size 246B
                  • SHA256 bbfdb52a6152c35d51c518f35bb5769a0ac24391882abe72c45bea36191e7b7d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __sentry-breadcrumb1
                  • Path C:\Users\Admin\AppData\Local\LauncherElectron\1c9025ea-71fd-4b58-1069-f87d0167fd62.run\__sentry-breadcrumb1
                  • Size 1KB
                  • SHA256 b708303fdf05ac866f39bbb9264861760f9ef599584213c770bb52b01bbf9ed3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __sentry-event
                  • Path C:\Users\Admin\AppData\Local\LauncherElectron\1c9025ea-71fd-4b58-1069-f87d0167fd62.run\__sentry-event
                  • Size 342B
                  • SHA256 0b6edb439314098aeed4680a40a3e15b7d9f627b6ee9d46bb66db1b80fe823cb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __sentry-breadcrumb1
                  • Path C:\Users\Admin\AppData\Local\LauncherElectron\299003a5-8238-417d-9d4d-8d757a2abcb6.run\__sentry-breadcrumb1
                  • Size 2KB
                  • SHA256 8c60e4f9640cd6c409c55a7491bedf0aee63216597c066e1bbd767edc084b245
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __sentry-breadcrumb1
                  • Path C:\Users\Admin\AppData\Local\LauncherElectron\299003a5-8238-417d-9d4d-8d757a2abcb6.run\__sentry-breadcrumb1
                  • Size 4KB
                  • SHA256 7020c624243d6b64a9549490c1dfcdc6b0c06af06be13621f29c629f09726639
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 2KB
                  • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 64B
                  • SHA256 31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f
                  • MD5 SHA1 SHA512
                  Submit Download

                  Setup Log 2026-06-02 #001.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-06-02 #001.txt
                  • Size 15KB
                  • SHA256 865451ce78580dfd11292140b6ecef719e7a8c657047766616866661925a6ba7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  The Boys Ascent Launcher_install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Launcher_install.log
                  • Size 2KB
                  • SHA256 1d70d793beb905cb4e6818b6f729ebfd37f73ae55c73bafd1632db140c9f915d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  The Boys Ascent Launcher_install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Launcher_install.log
                  • Size 3KB
                  • SHA256 674f9ae32a9fcaa7a3d9cd94f9986df943a2f740aabf894117a7665cf56b6571
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  The Boys Ascent Launcher_install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Launcher_install.log
                  • Size 4KB
                  • SHA256 4380831584ca9e0666b45c006ff53eb8f37740be8930923efc239b10982309ee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  The Boys Ascent Launcher_install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Launcher_install.log
                  • Size 2KB
                  • SHA256 d6b6b47da097f221419efa1606c85e41c5d825c8d9c9bd5e0a8ea19640546a13
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  The Boys Ascent Launcher_install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Launcher_install.log
                  • Size 605B
                  • SHA256 5d34ddee7a262002803209f81c222af806ed3f21ceea9d0a425caaddcd472aa0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  The Boys Ascent Launcher_install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\The Boys Ascent Launcher_install.log
                  • Size 2KB
                  • SHA256 8f6da6c1824c9468c5044ad40abd312b249618d5cd0e90c81c16fee54f151761
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_nqery2pr.akc.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqery2pr.akc.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ExecDos.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\ExecDos.dll
                  • Size 6KB
                  • SHA256 91d5481f576382164703e4ac244052265769377838ac30233ad79c983ed9d454
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  INetC.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\INetC.dll
                  • Size 25KB
                  • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LangDLL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\LangDLL.dll
                  • Size 5KB
                  • SHA256 86cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StdUtils.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\StdUtils.dll
                  • Size 100KB
                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\System.dll
                  • Size 11KB
                  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsDialogs.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\nsDialogs.dll
                  • Size 9KB
                  • SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsJSON.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\nsJSON.dll
                  • Size 23KB
                  • SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsisFile.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nseF2F.tmp\nsisFile.dll
                  • Size 5KB
                  • SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsExec.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsoFC25.tmp\nsExec.dll
                  • Size 6KB
                  • SHA256 8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SETE7AD.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{05137d56-99fe-164d-98fe-bc74772711a9}\SETE7AD.tmp
                  • Size 10KB
                  • SHA256 a2563f149e9d7b2b00c8e9ec59bbd1c7ca1fb8fc1263d31ee5d6750e5d97c9c2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SETE7AE.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{05137d56-99fe-164d-98fe-bc74772711a9}\SETE7AE.tmp
                  • Size 2KB
                  • SHA256 731ea07d640c31c8d20610ea10ce41260eb3eb94c754de6f71691b28d9ad2f60
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SETE7AF.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{05137d56-99fe-164d-98fe-bc74772711a9}\SETE7AF.tmp
                  • Size 68KB
                  • SHA256 d7621cee4bbbc5c7e474c2fcbc097dd791bf5923d5b32078e8927fafa93dc356
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SETEDB8.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{e3fa2071-ff16-5c4a-ada5-17871e27802f}\SETEDB8.tmp
                  • Size 10KB
                  • SHA256 05f8f9be3f5fc10b34d92d71286d2259aa04f79210cc6ad526ac918e54d5c0d8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SETEDB9.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{e3fa2071-ff16-5c4a-ada5-17871e27802f}\SETEDB9.tmp
                  • Size 2KB
                  • SHA256 b2c2fc0b268a62bb5f1641d08fdd092619c92fe69eda91c1dab1d8672ba638eb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SETEDBA.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{e3fa2071-ff16-5c4a-ada5-17871e27802f}\SETEDBA.tmp
                  • Size 245KB
                  • SHA256 6cccdb79417004cb01a91f67cc9ad13e98f77c8419cdba641e8c08543d2d5724
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  D3DCompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\D3DCompiler_47.dll
                  • Size 4.7MB
                  • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\chrome_100_percent.pak
                  • Size 132KB
                  • SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\chrome_200_percent.pak
                  • Size 190KB
                  • SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\ffmpeg.dll
                  • Size 2.8MB
                  • SHA256 4c686f39988abc4e35bbe5de40d801054bc3aa87157aac55d88d34e2e0f2559a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\icudtl.dat
                  • Size 10.2MB
                  • SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\locales\en-US.pak
                  • Size 411KB
                  • SHA256 0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources.pak
                  • Size 5.2MB
                  • SHA256 17c8d2ab64a5f6ee13697ca818d699a1e9f4988eaeb115dbe07f52fed9eb93b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.asar
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar
                  • Size 8.1MB
                  • SHA256 b646906fd5ada9feced2afb7e97cde637c9802f2e68a00ab61555d2688e5513e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vc_redist.x64.exe
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\bin\vc_redist.x64.exe
                  • Size 14.2MB
                  • SHA256 c2d74d9b85d0030eaa134679a2392268baa773185c5a21657390e43f8b518f69
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.js
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\index.js
                  • Size 98B
                  • SHA256 e77280f413fbcc7afbd90d873947d33b5b50b93825ebc50e6c2204751d42e6da
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\app.asar.unpacked\node_modules\@xsolla-launcher\launcher-core-win\package.json
                  • Size 196B
                  • SHA256 7312aa0e375a4e1fc1551b63e48cf52adcec1af511575a65a73cde55551f87ca
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  elevate.exe
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\assets\win\elevate.exe
                  • Size 105KB
                  • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  launcher.json
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\resources\config\launcher.json
                  • Size 10KB
                  • SHA256 dcf5f378c20ace49bb2aa36d4c0ce3bd395aaa7741bc2311eb06314e02c6d9b6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\The Boys Ascent Launcher\v8_context_snapshot.bin
                  • Size 611KB
                  • SHA256 4fbe07f71b706c2a2948eba9a6b1979e23c83342b190723a6ec5251b2d6dad7c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  default.dic
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  2df36b27-2ab2-457a-93a4-9ff4a28f1e2b.tmp
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\2df36b27-2ab2-457a-93a4-9ff4a28f1e2b.tmp
                  • Size 57B
                  • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\DawnCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\DawnCache\data_1
                  • Size 264KB
                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Local Storage\leveldb\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Network\Network Persistent State
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Network\Network Persistent State
                  • Size 1KB
                  • SHA256 b213e3fcbff1f9ab24722c21bc480be06bc38240e1cc2bcc1efc85e3616aabfd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Network\Network Persistent State
                  • Size 1KB
                  • SHA256 e8eb1f5384ab07d77ff0cb248a74a8308e0baf5ab92ec276a9a4eb5f799957b2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Network\TransportSecurity
                  • Size 1KB
                  • SHA256 56075a877e9e6631ea920a8930e587d19cf340a884f9d0d8932bf73a4eb6fbf0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Network\TransportSecurity
                  • Size 1KB
                  • SHA256 ed4ee5627a72104e45f3545812c0e0788099d6a2fd99225de9cefb94db0ba6c9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\Session Storage\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\config.json
                  • Size 298B
                  • SHA256 e5a388ada3e4c55da5e3dbbefd12fc9daeea2b7377d67eb3455afe465afda662
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\config.json
                  • Size 297B
                  • SHA256 26a9b4b419aaebd55ceeb3c05818182e365c1964f52f375f4977b4dc43f103d2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\config.json
                  • Size 243B
                  • SHA256 105155c65872b769909c1463534aea072f9f31a33c0edd9f88c8b16052705059
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0428663985a0e34a
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\config.json.tmp-0428663985a0e34a
                  • Size 243B
                  • SHA256 6c0bab96d4c56e5e958ab46b3ceffc240263c46cd839efb0ed62cad9c8859bda
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-042866499550386d
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\config.json.tmp-042866499550386d
                  • Size 264B
                  • SHA256 939833c5342de7d4100ebdca2d0a430b5d7eca0cd1d6d3b91bbed2d4d3d0cc24
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0428699787992b39
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\config.json.tmp-0428699787992b39
                  • Size 298B
                  • SHA256 c7259cdeeeb5f8e703e70f8f74c64aa310b0cd1a64e292724b5b4a15942f26a7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  main.log
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\logs\main.log
                  • Size 4KB
                  • SHA256 e21364d313b2006a1e04685fb334bcc9ae458ac074695402c2ea5e97074c69eb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  preferred_langs
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\preferred_langs
                  • Size 8B
                  • SHA256 73f599469ab3cf0a0581b6d1f9148c294eec6a6449624c302de95f7ea74b2dc7
                  • MD5 SHA1 SHA512
                  Submit Download

                  scope_v2.json
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\sentry\scope_v2.json
                  • Size 5KB
                  • SHA256 31421c18b7a79e61c8f53de665dd934185940c3d0b4df4cd629cda4508b96217
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  scope_v2.json
                  • Path C:\Users\Admin\AppData\Roaming\The Boys Ascent Launcher\sentry\scope_v2.json
                  • Size 5KB
                  • SHA256 e92e88b8bbe96433416ac96f85eeae2de41633fe4915bec512dd62c785605564
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfc007.dat
                  • Path C:\Windows\System32\perfc007.dat
                  • Size 148KB
                  • SHA256 4e4e1300a939cc5d58d0c6914410d5ad8eaf876571011fa1c6f0ce27bf59822d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfc00A.dat
                  • Path C:\Windows\System32\perfc00A.dat
                  • Size 157KB
                  • SHA256 8eca411e03a6ee2334f3bcb4aeb01e03708405eeb8b6cd2ce2634e88ccb017da
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfc00C.dat
                  • Path C:\Windows\System32\perfc00C.dat
                  • Size 152KB
                  • SHA256 dde96ee8f0d1d4be6355e9ebf15ac676ec17a2ed6b2e678cb5cf75a2f163c8d1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfc010.dat
                  • Path C:\Windows\System32\perfc010.dat
                  • Size 146KB
                  • SHA256 7bac647f0403a7284de48201aaf14cf242f3272ae1350654dd53348997d86d88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfc011.dat
                  • Path C:\Windows\System32\perfc011.dat
                  • Size 126KB
                  • SHA256 26ee1d72642d1d79b307581e6027a259696d5e3299d9d6685153a68b8c58b61b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfh007.dat
                  • Path C:\Windows\System32\perfh007.dat
                  • Size 737KB
                  • SHA256 031fb889e2391f5b47edb8ef99e39c3b34ab2866d9fff4f02c42eeb91b68f874
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfh009.dat
                  • Path C:\Windows\System32\perfh009.dat
                  • Size 702KB
                  • SHA256 bf4b837688443d239b244d5aeecefa0e626755a88ec49e0040b789277e87fd33
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfh00A.dat
                  • Path C:\Windows\System32\perfh00A.dat
                  • Size 783KB
                  • SHA256 808c470ee18839bce9021e9459fb5d10babd45192b9e190bb4fca5bb4d761cb0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfh00C.dat
                  • Path C:\Windows\System32\perfh00C.dat
                  • Size 785KB
                  • SHA256 2c9f682253db33b5661d539169384d3fc315fc28f7eac5c09e1a066a1fe3d697
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfh010.dat
                  • Path C:\Windows\System32\perfh010.dat
                  • Size 772KB
                  • SHA256 e8a264e4507e13ce04c67dc6bbcb2e40c6a761f6b0ea6afab312f7a000877fba
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfh011.dat
                  • Path C:\Windows\System32\perfh011.dat
                  • Size 468KB
                  • SHA256 5a6a1ec0c9c4dff9b15b03d97acfdead6e4d389890b3e3b6e9b543683e92f893
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WmiApRpl.h
                  • Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
                  • Size 3KB
                  • SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  WmiApRpl.ini
                  • Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
                  • Size 29KB
                  • SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vc_redist.x64.exe
                  • Path C:\Windows\Temp\{74292144-9566-4322-B4A9-3C2A21EBED2A}\.cr\vc_redist.x64.exe
                  • Size 632KB
                  • SHA256 2e238c5f5454e5ace1828932799768d8cb1edc7ad06b5c2f412b47adff466d39
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  logo.png
                  • Path C:\Windows\Temp\{C1FE97E6-678D-4BCF-A401-0A20494048C0}\.ba\logo.png
                  • Size 1KB
                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  wixstdba.dll
                  • Path C:\Windows\Temp\{C1FE97E6-678D-4BCF-A401-0A20494048C0}\.ba\wixstdba.dll
                  • Size 191KB
                  • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2332-15-0x000001E80705A000-0x000001E80705B000-memory.dmp
                  Download

                  memory/2332-18-0x000001E8217C0000-0x000001E8217E2000-memory.dmp
                  Download

                  memory/2332-29-0x000001E806890000-0x000001E807352000-memory.dmp
                  Download

                  memory/2332-25-0x000001E806890000-0x000001E807352000-memory.dmp
                  Download

                  memory/2332-24-0x000001E806890000-0x000001E807352000-memory.dmp
                  Download

                  memory/2332-23-0x000001E806890000-0x000001E807352000-memory.dmp
                  Download

                  memory/5672-3753-0x0000000000400000-0x0000000000705000-memory.dmp
                  Download

                  memory/5692-3754-0x0000000000400000-0x00000000004CB000-memory.dmp
                  Download

                  memory/5692-3600-0x0000000000400000-0x00000000004CB000-memory.dmp
                  Download

                  memory/5748-5765-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5760-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5769-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5768-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5767-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5766-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5770-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5764-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5759-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/5748-5758-0x0000019370FE0000-0x0000019370FE1000-memory.dmp
                  Download

                  memory/6068-3115-0x00007FFDD24E0000-0x00007FFDD2517000-memory.dmp
                  Download

                  memory/6068-3111-0x00007FFDD1B90000-0x00007FFDD1BE0000-memory.dmp
                  Download

                  memory/6068-3110-0x00007FFDBB8A0000-0x00007FFDBB940000-memory.dmp
                  Download

                  memory/6068-3108-0x00007FFDBC240000-0x00007FFDBC781000-memory.dmp
                  Download

                  memory/6068-3109-0x00007FF791AC0000-0x00007FF7927DB000-memory.dmp
                  Download

                  memory/6068-3114-0x00007FFDD1C80000-0x00007FFDD1CDC000-memory.dmp
                  Download

                  memory/6068-3113-0x00007FFDBB650000-0x00007FFDBB72E000-memory.dmp
                  Download

                  memory/6068-3112-0x00007FFDCD3B0000-0x00007FFDCD3F2000-memory.dmp
                  Download

                  memory/7236-4924-0x00007FFDBB4D0000-0x00007FFDBBA11000-memory.dmp
                  Download

                  memory/7236-4925-0x00007FF7E8B10000-0x00007FF7E9834000-memory.dmp
                  Download

                  memory/7236-4926-0x00007FFDBAA80000-0x00007FFDBAB22000-memory.dmp
                  Download

                  memory/7236-4928-0x00007FFDC3040000-0x00007FFDC3077000-memory.dmp
                  Download

                  memory/7236-4927-0x00007FFDBA010000-0x00007FFDBA06B000-memory.dmp
                  Download