Overview

overview

8

Static

static

3

Nowy folder.rar

windows10-2004-x64

1

Nowy folder.rar

windows11-21h2-x64

1

Nowy folde...76.exe

windows10-2004-x64

8

Nowy folde...76.exe

windows11-21h2-x64

8

Nowy folder/Grape.dll

windows10-2004-x64

1

Nowy folder/Grape.dll

windows11-21h2-x64

1

Nowy folde...v2.dll

windows10-2004-x64

1

Nowy folde...v2.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    98s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 14:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Nowy folder/CheatEngine76.exe
  • Size 35.0MB
  • Sample260511-rd5n2aft2k
  • SHA256 f96eca4a678f34c5d6c5e8b3ebb0f086f17ffc869c021e5576f8b906dace0336
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitdefense_evasiondiscoveryexecutioninstallerpersistencespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 10 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 18 IoCs
  • Runs net.exe
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nowy folder\CheatEngine76.exe
    "C:\Users\Admin\AppData\Local\Temp\Nowy folder\CheatEngine76.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\is-44MSR.tmp\CheatEngine76.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-44MSR.tmp\CheatEngine76.tmp" /SL5="$70236,35769578,776192,C:\Users\Admin\AppData\Local\Temp\Nowy folder\CheatEngine76.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod0_extract\WZSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod0_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4208
        • C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
          "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install
          4⤵
            PID:3992
          • C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
            "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent
            4⤵
              PID:4536
          • C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod1_extract\OperaGXSetup.exe
            "C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod1_extract\OperaGXSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx,utm.id:BjYV7wRXnJzM5qiQQHYZVXHceWK5K3oIXoAA04CMMb24nXXnjPcGkHsXqgxCYgVk1AKY7SuAsaoNoS5
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:460
            • C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe
              C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx,utm.id:BjYV7wRXnJzM5qiQQHYZVXHceWK5K3oIXoAA04CMMb24nXXnjPcGkHsXqgxCYgVk1AKY7SuAsaoNoS5 --server-tracking-blob=ZTlkNzM2OWE0ZmQ4NmRjMzMxY2ZkYzc3NDNiOGNjOWVlYzY4NTQ1ZWE3ZGI3MGQ3M2VjZjg1N2MzNmRmNjI5ZDp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwidGltZXN0YW1wIjoiMTc1Nzg0NzYzNS4zNjE1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6e30sInV1aWQiOiIyYjBlYWY3NC00NGQ4LTQ2NjktYWNiZC1lYzUzNmZmMzhhYzYifQ==
              4⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:3096
              • C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe
                C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ffe28d28ef0,0x7ffe28d28efc,0x7ffe28d28f08
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:4808
              • C:\Users\Admin\AppData\Local\Temp\.opera\d6af1eeb-6a91-414b-936f-fa2799dacfc2 Opera GX Installer Temp\setup.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\d6af1eeb-6a91-414b-936f-fa2799dacfc2 Opera GX Installer Temp\setup.exe" --version
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2892
              • C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe
                "C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3096 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\d6af1eeb-6a91-414b-936f-fa2799dacfc2 Opera GX Installer Temp\opera_package_20260511150821" --session-guid=e11e2295-33ef-40fb-8841-fb2ae426d457 --server-tracking-blob="MGM1MmM4MmVkZmNjMmY1MTQzMDdiNDk5MWJlNTJjZjBhNDIwMmY5NmIxNDdjMWViNTkxZmUzZTAyOGJmM2UxYTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzU3ODQ3NjM1LjM2MTUiLCJ1c2VyYWdlbnQiOiJweXRob24tcmVxdWVzdHMvMi4zMi4zIiwidXRtIjp7ImNhbXBhaWduIjoib3BlcmFneCIsImlkIjoiQmpZVjd3UlhuSnpNNXFpUVFIWVpWWEhjZVdLNUszb0lYb0FBMDRDTU1iMjRuWFhualBjR2tIc1hxZ3hDWWdWazFBS1k3U3VBc2FvTm9TNSIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6ImFpcyJ9LCJ1dWlkIjoiMmIwZWFmNzQtNDRkOC00NjY5LWFjYmQtZWM1MzZmZjM4YWM2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=D007000000000000
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Suspicious use of WriteProcessMemory
                PID:1740
                • C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x26c,0x270,0x274,0x23c,0x278,0x7ffe27c18ef0,0x7ffe27c18efc,0x7ffe27c18f08
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4452
              • C:\Users\Admin\AppData\Local\Temp\.opera\d6af1eeb-6a91-414b-936f-fa2799dacfc2 Opera GX Installer Temp\opera_package_202605111508211\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\d6af1eeb-6a91-414b-936f-fa2799dacfc2 Opera GX Installer Temp\opera_package_202605111508211\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe"
                5⤵
                  PID:1612
            • C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod2_extract\cookie_mmm_irs_ppi_008_537.exe
              "C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod2_extract\cookie_mmm_irs_ppi_008_537.exe" /silent /ws /psh:2bJ1krltje4Et6eOOK0rk5ERMY6hcPZyDWS5YPkPPsEJgHJYSjyw2S5zgmGsJN8oJXX5nMQagvCV3 /cookie:mmm_irs_ppi_008_537_c
              3⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2036
              • C:\Windows\Temp\asw.9f082f061d71155f\avast_free_antivirus_online_setup.exe
                "C:\Windows\Temp\asw.9f082f061d71155f\avast_free_antivirus_online_setup.exe" /silent /ws /psh:2bJ1krltje4Et6eOOK0rk5ERMY6hcPZyDWS5YPkPPsEJgHJYSjyw2S5zgmGsJN8oJXX5nMQagvCV3 /cookie:mmm_irs_ppi_008_537_c /cookie:mmm_irs_ppi_008_537_c /ga_clientid:bc34f86a-cffd-4ce0-b1b3-a6426fe27836 /edat_dir:C:\Windows\Temp\asw.9f082f061d71155f /geo:GB
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes to the Master Boot Record (MBR)
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4292
                • C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\common\icarus.exe
                  C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\icarus-info.xml /install /silent /ws /psh:2bJ1krltje4Et6eOOK0rk5ERMY6hcPZyDWS5YPkPPsEJgHJYSjyw2S5zgmGsJN8oJXX5nMQagvCV3 /cookie:mmm_irs_ppi_008_537_c /edat_dir:C:\Windows\Temp\asw.9f082f061d71155f /geo:GB /track-guid:bc34f86a-cffd-4ce0-b1b3-a6426fe27836
                  5⤵
                  • Executes dropped EXE
                  • Writes to the Master Boot Record (MBR)
                  • Checks processor information in registry
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4352
                  • C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av-vps\icarus.exe
                    C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av-vps\icarus.exe /silent /ws /psh:2bJ1krltje4Et6eOOK0rk5ERMY6hcPZyDWS5YPkPPsEJgHJYSjyw2S5zgmGsJN8oJXX5nMQagvCV3 /cookie:mmm_irs_ppi_008_537_c /edat_dir:C:\Windows\Temp\asw.9f082f061d71155f /geo:GB /track-guid:bc34f86a-cffd-4ce0-b1b3-a6426fe27836 /er_master:master_ep_455a83e0-feca-448c-9088-664a1af8a831 /er_slave:avast-av-vps_slave_ep_2a8a5ba2-91bd-4686-ba78-7f73b276177b /slave:avast-av-vps
                    6⤵
                    • Executes dropped EXE
                    • Writes to the Master Boot Record (MBR)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3660
                  • C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av\icarus.exe
                    C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av\icarus.exe /silent /ws /psh:2bJ1krltje4Et6eOOK0rk5ERMY6hcPZyDWS5YPkPPsEJgHJYSjyw2S5zgmGsJN8oJXX5nMQagvCV3 /cookie:mmm_irs_ppi_008_537_c /edat_dir:C:\Windows\Temp\asw.9f082f061d71155f /geo:GB /track-guid:bc34f86a-cffd-4ce0-b1b3-a6426fe27836 /er_master:master_ep_455a83e0-feca-448c-9088-664a1af8a831 /er_slave:avast-av_slave_ep_5d4e80ac-2ab7-43e5-99f8-4181079d4a3c /slave:avast-av
                    6⤵
                    • Executes dropped EXE
                    • Writes to the Master Boot Record (MBR)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2244
            • C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\CheatEngine76.exe
              "C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\CheatEngine76.exe" /VERYSILENT /ZBDIST
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4800
              • C:\Users\Admin\AppData\Local\Temp\is-H3UPI.tmp\CheatEngine76.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-H3UPI.tmp\CheatEngine76.tmp" /SL5="$40244,28695682,869888,C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\CheatEngine76.exe" /VERYSILENT /ZBDIST
                4⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:5092
                • C:\Windows\SYSTEM32\net.exe
                  "net" stop BadlionAntic
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2632
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop BadlionAntic
                    6⤵
                      PID:1220
                  • C:\Windows\SYSTEM32\net.exe
                    "net" stop BadlionAnticheat
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:380
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop BadlionAnticheat
                      6⤵
                        PID:4552
                    • C:\Windows\SYSTEM32\sc.exe
                      "sc" delete BadlionAntic
                      5⤵
                      • Launches sc.exe
                      PID:868
                    • C:\Windows\SYSTEM32\sc.exe
                      "sc" delete BadlionAnticheat
                      5⤵
                      • Launches sc.exe
                      PID:4004
                    • C:\Windows\SYSTEM32\net.exe
                      "net" stop vgk
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:636
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop vgk
                        6⤵
                          PID:2168
                      • C:\Windows\SYSTEM32\sc.exe
                        "sc" delete vgk
                        5⤵
                        • Launches sc.exe
                        PID:3312
                      • C:\Users\Admin\AppData\Local\Temp\is-B1SIO.tmp\_isetup\_setup64.tmp
                        helper 105 0x390
                        5⤵
                        • Executes dropped EXE
                        PID:2340
                      • C:\Windows\system32\icacls.exe
                        "icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)
                        5⤵
                        • Modifies file permissions
                        PID:3488
                      • C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe
                        "C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe" /SETUP
                        5⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3104
                      • C:\Program Files\Cheat Engine\windowsrepair.exe
                        "C:\Program Files\Cheat Engine\windowsrepair.exe" /s
                        5⤵
                        • Executes dropped EXE
                        PID:1252
                      • C:\Windows\system32\icacls.exe
                        "icacls" "C:\Program Files\Cheat Engine" /grant *S-1-15-2-1:(OI)(CI)(RX)
                        5⤵
                        • Modifies file permissions
                        PID:1884
              • C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
                "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"
                1⤵
                  PID:4236

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      System Services

                      1
                      T1569

                      Service Execution

                      1
                      T1569.002

                      Persistence

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Pre-OS Boot

                      1
                      T1542

                      Bootkit

                      1
                      T1542.003

                      Privilege Escalation

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Impair Defenses

                      1
                      T1562

                      Pre-OS Boot

                      1
                      T1542

                      Bootkit

                      1
                      T1542.003

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      4
                      T1012

                      Software Discovery

                      1
                      T1518

                      Security Software Discovery

                      1
                      T1518.001

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Service Stop

                      1
                      T1489

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      locale-de.json.ipending.25c6e6d0
                      • Path C:\Program Files\Avast Software\Avast\gui_resources\default_av\locale-de.json.ipending.25c6e6d0
                      • Size 614KB
                      • SHA256 d13128e24da366af239ae8500f27e18d28d03dff1d09fbfba773cedb5b639bcf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      config.def
                      • Path C:\Program Files\Avast Software\Avast\setup\config.def
                      • Size 40KB
                      • SHA256 b7ba99773f6b6ca4211fe4a95a6c19d683c5f7e1daaa3501478ebd4320b51ab2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Cheat Engine.exe
                      • Path C:\Program Files\Cheat Engine\Cheat Engine.exe
                      • Size 397KB
                      • SHA256 5313618d93640bb29b66baadf2339de85e593a51715290dadece6d58e039a75e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Kernelmoduleunloader.exe
                      • Path C:\Program Files\Cheat Engine\Kernelmoduleunloader.exe
                      • Size 236KB
                      • SHA256 65fa2ccb3ac5400dd92dda5f640445a6e195da7c827107260f67624d3eb95e7d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      allochook-i386.dll
                      • Path C:\Program Files\Cheat Engine\allochook-i386.dll
                      • Size 328KB
                      • SHA256 b96469b310ba59d1db320a337b3a8104db232a4344a47a8e5ae72f16cc7b1ff4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      allochook-x86_64.dll
                      • Path C:\Program Files\Cheat Engine\allochook-x86_64.dll
                      • Size 468KB
                      • SHA256 8422be70e0ec59c962b35acf8ad80671bcc8330c9256e6e1ec5c07691388cd66
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      addtonewgroup.lua
                      • Path C:\Program Files\Cheat Engine\autorun\addtonewgroup.lua
                      • Size 1KB
                      • SHA256 96e4429192f9ab26f8bf9f9429f36b388aa69c3624781c61ea6df7e1bca9b49b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      android.lua
                      • Path C:\Program Files\Cheat Engine\autorun\android.lua
                      • Size 2KB
                      • SHA256 2a03bea4f0d207b8707f950ebe1b1cd48a0e85db7a8e7df64e66c1b1bff47776
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      autosave.lua
                      • Path C:\Program Files\Cheat Engine\autorun\autosave.lua
                      • Size 9KB
                      • SHA256 c4cef60489b067c8e7abcdd5594643a27d0720b21523753dd462d53024287116
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      bigendian.lua
                      • Path C:\Program Files\Cheat Engine\autorun\bigendian.lua
                      • Size 7KB
                      • SHA256 4541b3e07a2d5e275a8ad09ee152fee2adc2ff870ab9bcc27aa10704cff1115d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      celib.lua
                      • Path C:\Program Files\Cheat Engine\autorun\celib.lua
                      • Size 2KB
                      • SHA256 5871f4e9f6c06b5811c1f4b208b5d6869c5191e7cb5540f2b463d01e5541fac2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ceshare_account.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_account.lua
                      • Size 6KB
                      • SHA256 8fd38a5e6c0408ca77e0e7a0ee179b4391758ec6da94ea289e3a2cbc1ab1ec59
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ceshare_comments.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_comments.lua
                      • Size 3KB
                      • SHA256 89c8fccc16d2aa0a3004dc1b477a5c1dcbba539769b2a4558f7c7d9b9809b133
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ceshare_fulltablelist.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_fulltablelist.lua
                      • Size 12KB
                      • SHA256 f908b6a7b545625eaf1cc156e5570acc7be469d85267ca9c2216a7365de71063
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ceshare_permissions.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_permissions.lua
                      • Size 3KB
                      • SHA256 15b0c7682e5e8d2e2c2b8cb00c0c03b7dfa9439ac80c37f8e96a4f86652246f9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ceshare_processlistextention.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_processlistextention.lua
                      • Size 9KB
                      • SHA256 f595981297f11cb43bddc75d9ae7db88ccff8608d1b7e67e3335a9abc9e18f07
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ceshare_publish.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_publish.lua
                      • Size 20KB
                      • SHA256 6bfd35aa64ab566ddb68d0675ad3b4a093649010a9c30df3a30a7f9dc2ed7702
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ceshare_querycheats.lua
                      • Path C:\Program Files\Cheat Engine\autorun\ceshare\ceshare_querycheats.lua
                      • Size 24KB
                      • SHA256 0c6e90c2525f1560acea3f4bdae056d11df1c2f675c2335594dc80bb910a1b17
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      scoreboard.png
                      • Path C:\Program Files\Cheat Engine\badassets\scoreboard.png
                      • Size 5KB
                      • SHA256 a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ced3d10hook.dll
                      • Path C:\Program Files\Cheat Engine\ced3d10hook.dll
                      • Size 128KB
                      • SHA256 148f12445f11a50efbd23509139bf06a47d453e8514733b5a15868d10cc6e066
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ced3d10hook64.dll
                      • Path C:\Program Files\Cheat Engine\ced3d10hook64.dll
                      • Size 140KB
                      • SHA256 a2ac2ba27b0ed9acc3f0ea1bef9909a59169bc2eb16c979ef8e736a784bf2fa4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ced3d11hook.dll
                      • Path C:\Program Files\Cheat Engine\ced3d11hook.dll
                      • Size 137KB
                      • SHA256 1e30126badfffb231a605c6764dd98895208779ef440ea20015ab560263dd288
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ced3d11hook64.dll
                      • Path C:\Program Files\Cheat Engine\ced3d11hook64.dll
                      • Size 146KB
                      • SHA256 6f505cc5973687bbda1c2d9ac8a635d333f57c12067c54da7453d9448ab40b8f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ced3d9hook.dll
                      • Path C:\Program Files\Cheat Engine\ced3d9hook.dll
                      • Size 124KB
                      • SHA256 fd2a2b4fe4504c56347c35f24d566cc0510e81706175395d0a2ba26a013c4daf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ced3d9hook64.dll
                      • Path C:\Program Files\Cheat Engine\ced3d9hook64.dll
                      • Size 136KB
                      • SHA256 8783f06f7b123e16042bb0af91ff196b698d3cd2aa930e3ea97cfc553d9fc0f4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      d3dhook.dll
                      • Path C:\Program Files\Cheat Engine\d3dhook.dll
                      • Size 119KB
                      • SHA256 e2a7df4c380667431f4443d5e5fc43964b76c8fcb9cf4c7db921c4140b225b42
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      d3dhook64.dll
                      • Path C:\Program Files\Cheat Engine\d3dhook64.dll
                      • Size 131KB
                      • SHA256 7d82694094c1bbc586e554fa87a4b1ed6ebc9eb14902fd429824dcd501339722
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      is-7Q97M.tmp
                      • Path C:\Program Files\Cheat Engine\is-7Q97M.tmp
                      • Size 12.5MB
                      • SHA256 d36913c591ec7b1552833a11c3a79d24a2694522e4fc2548751f7b148c804b2f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      language.ini
                      • Path C:\Program Files\Cheat Engine\languages\language.ini
                      • Size 283B
                      • SHA256 4aa4f0b75548d45c81d8e876e2db1c74bddfd64091f102706d729b50a7af53a5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      libipt-32.dll
                      • Path C:\Program Files\Cheat Engine\libipt-32.dll
                      • Size 157KB
                      • SHA256 d14911c838620251f7f64c190b04bb8f4e762318cc763d993c9179376228d8ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libipt-64.dll
                      • Path C:\Program Files\Cheat Engine\libipt-64.dll
                      • Size 182KB
                      • SHA256 26ede848dba071eb76c0c0ef8e9d8ad1c53dfab47ca9137abc9d683032f06ebb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      luaclient-i386.dll
                      • Path C:\Program Files\Cheat Engine\luaclient-i386.dll
                      • Size 197KB
                      • SHA256 dd07117ed80546f23d37f8023e992de560a1f55a76d1eb6dfd9d55baa5e3dad6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      luaclient-x86_64.dll
                      • Path C:\Program Files\Cheat Engine\luaclient-x86_64.dll
                      • Size 260KB
                      • SHA256 253d18d0d835f482e6abbaf716855580eb8fe789292c937301e4d60ead29531d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      overlay.fx
                      • Path C:\Program Files\Cheat Engine\overlay.fx
                      • Size 2KB
                      • SHA256 c4d23db8effb359b4aa4d1e1e480486fe3a4586ce8243397a94250627ba4f8cc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      vehdebug-i386.dll
                      • Path C:\Program Files\Cheat Engine\vehdebug-i386.dll
                      • Size 324KB
                      • SHA256 3eb9cd27035d4193e32e271778643f3acb2ba73341d87fd8bb18d99af3dffdea
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vehdebug-x86_64.dll
                      • Path C:\Program Files\Cheat Engine\vehdebug-x86_64.dll
                      • Size 413KB
                      • SHA256 f50baf9dc3cd6b925758077ec85708db2712999b9027cc632f57d1e6c588df21
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      windowsrepair.exe
                      • Path C:\Program Files\Cheat Engine\windowsrepair.exe
                      • Size 262KB
                      • SHA256 2f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      winhook-i386.dll
                      • Path C:\Program Files\Cheat Engine\winhook-i386.dll
                      • Size 201KB
                      • SHA256 3cdb85ee83ef12802efdfc9314e863d4696be70530b31e7958c185fc4d6a9b38
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      winhook-x86_64.dll
                      • Path C:\Program Files\Cheat Engine\winhook-x86_64.dll
                      • Size 264KB
                      • SHA256 e08b035d0a894d8bea64e67b1ed0bce27567d417eaaa133e8b231f8a939e581d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icarus.ini
                      • Path C:\ProgramData\Avast Software\Icarus\avast-av\icarus.ini
                      • Size 248B
                      • SHA256 c4a4a5b13c62da69abbd93f1460b8992b997e00e8e616852d559bdafbc153acd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      additional_file0.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\d6af1eeb-6a91-414b-936f-fa2799dacfc2 Opera GX Installer Temp\opera_package_202605111508211\additional_file0.tmp
                      • Size 896KB
                      • SHA256 96e981b882f2282e6a75a7121639fdabdd14875ce3750cf33fb56f47c6925fec
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\7zSCC1EDF29\setup.exe
                      • Size 8.1MB
                      • SHA256 8be09d18795860b08ce3ee4f21c05b3205fba0541ac174cfae1a66d19b21b8ea
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Opera_installer_2605111408189733096.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2605111408189733096.dll
                      • Size 7.5MB
                      • SHA256 7cac08fa3fc954671ddbeeae0a9c6c44b31b1e47ee8cf0591f6ce4f012fc0b02
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CheatEngine76.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\is-44MSR.tmp\CheatEngine76.tmp
                      • Size 3.0MB
                      • SHA256 445617702735fc5480f06ac72261bf85eda6a2a83f5cb3fb46bb104faab567aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      _setup64.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\is-B1SIO.tmp\_isetup\_setup64.tmp
                      • Size 6KB
                      • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CheatEngine76.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\is-H3UPI.tmp\CheatEngine76.tmp
                      • Size 3.5MB
                      • SHA256 dc533e0ef05d4c140e03f50ddcc43bd882953edf9247d79bac5a30fe2f78ea70
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AVAST.png
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\AVAST.png
                      • Size 59KB
                      • SHA256 072fced130d77b4b09013d8fbc148439cf3c9a251f1e217abeb5e280cfb10f1c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CheatEngine76.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\CheatEngine76.exe
                      • Size 29.5MB
                      • SHA256 4b9130295aa7686619dbe8f163b880b2c418b56c4596b5119b67718161ab2d57
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OperaGX.png
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\OperaGX.png
                      • Size 152KB
                      • SHA256 2f116cdef55e05549d6f06913afe39a91b715b188e110188c7fbf7f5eb69b318
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WeatherZero.png
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\WeatherZero.png
                      • Size 29KB
                      • SHA256 ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      logo.png
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\logo.png
                      • Size 248KB
                      • SHA256 8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prod0.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod0.zip
                      • Size 5.9MB
                      • SHA256 200e9bc4fcf2c6682ddc8c7f172a0d02befecd25ca882f66c6abc868a54b8975
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WZSetup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod0_extract\WZSetup.exe
                      • Size 6.0MB
                      • SHA256 fa352552306b80f3f897f8f21d8579ae642c97d12298e113ae1adc03902c69b8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prod1.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod1.zip
                      • Size 3.6MB
                      • SHA256 52ea32c4123bc367fc61f6624d0ac7a3d677a7eb169687c3daa3d975fbea4a5b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OperaGXSetup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod1_extract\OperaGXSetup.exe
                      • Size 3.6MB
                      • SHA256 47e56b4975eeb5ed4c5f492046c069e735173c3d1b6f10a8f2dbeac5210a20a3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prod2.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod2.zip
                      • Size 133KB
                      • SHA256 ff30d3e0750a31265b3781c16e782da8abe2304b3bf50e2e7aae4a4b9e20fef5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cookie_mmm_irs_ppi_008_537.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\prod2_extract\cookie_mmm_irs_ppi_008_537.exe
                      • Size 245KB
                      • SHA256 6be180ea9a978907b1f39e54a6360404a094d59c21e4ebb1fcb456aef0ff4859
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      zbShieldUtils.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\is-PMHFL.tmp\zbShieldUtils.dll
                      • Size 2.0MB
                      • SHA256 976d070339c1ecd80d0d2ded8f2c3fd1c6ec03f408053470f696066c2bb2b738
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      INetC.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\nsz3530.tmp\INetC.dll
                      • Size 21KB
                      • SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WeatherZeroNSISPlugin.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\nsz3530.tmp\WeatherZeroNSISPlugin.dll
                      • Size 695KB
                      • SHA256 070190292df544da87f84dc8cf8ecc0a0337085a3fe744fa60ce00a6879b6146
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                      • Size 40B
                      • SHA256 3382f2597b78143a1638a453fbb9e1a61f94a34e37997cc6018731f7779596bf
                      • MD5 SHA1 SHA512
                      Submit Download

                      icarus_rvrt.exe
                      • Path C:\Windows\System32\icarus_rvrt.exe
                      • Size 54KB
                      • SHA256 097709779bf6e7a3f93b65510c1df2a6d28c2c8052874b39d560addfccc44493
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      bug_report.exe
                      • Path C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av-vps\bug_report.exe
                      • Size 6.3MB
                      • SHA256 89815dcd9b7ab41334a3f65c6afc8d1c81c8e824bfdbe155334a3e87d751cf85
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dump_process.exe
                      • Path C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av-vps\dump_process.exe
                      • Size 3.9MB
                      • SHA256 7587a665360c2eafd73f37e5c9c258a46b7ddf42572699a0f410f0fcc849d1b4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icarus.exe
                      • Path C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av-vps\icarus.exe
                      • Size 9.2MB
                      • SHA256 4f5bfe58f16ce2571f8338dc2e65c06c988cffdc026a18039b8d5eda0c979faf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icarus_ui.exe
                      • Path C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av\icarus_ui.exe
                      • Size 12.4MB
                      • SHA256 0cdbf296a3fea0082edd8923818de16727165efd3a19f310654d2b2e8230b7b0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      product-def.xml
                      • Path C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av\product-def.xml
                      • Size 1.9MB
                      • SHA256 d89af30c39b80ca702eadedf12d9035b8dd29611cdbdea4793b131bf52485832
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setupui.cont
                      • Path C:\Windows\Temp\asw-bc34f86a-cffd-4ce0-b1b3-a6426fe27836\avast-av\setupui.cont
                      • Size 603KB
                      • SHA256 8f8100437d29ff6c820480c68d5dd06b5e5db765bd896b0a1fccee9500f43959
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/460-228-0x00000000029E0000-0x0000000002A55000-memory.dmp
                      Download

                      memory/1252-979-0x0000000001450000-0x00000000014C5000-memory.dmp
                      Download

                      memory/1740-243-0x000001BC51FF0000-0x000001BC52045000-memory.dmp
                      Download

                      memory/2036-229-0x00000000013A0000-0x0000000001415000-memory.dmp
                      Download

                      memory/2036-230-0x00000000010F0000-0x00000000010F7000-memory.dmp
                      Download

                      memory/2244-2056-0x0000021179EE0000-0x0000021179F35000-memory.dmp
                      Download

                      memory/2288-56-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-15-0x0000000000D10000-0x0000000000D85000-memory.dmp
                      Download

                      memory/2288-57-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-58-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-63-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-64-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-50-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-47-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-165-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-1117-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-46-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-67-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-70-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-104-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-41-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-40-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-21-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-16-0x00000000051B0000-0x00000000051B7000-memory.dmp
                      Download

                      memory/2288-17-0x00000000007B0000-0x00000000007B1000-memory.dmp
                      Download

                      memory/2288-59-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-14-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-223-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-5-0x00000000007B0000-0x00000000007B1000-memory.dmp
                      Download

                      memory/2288-1798-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/2288-999-0x0000000005010000-0x0000000005150000-memory.dmp
                      Download

                      memory/2288-2096-0x0000000000400000-0x0000000000706000-memory.dmp
                      Download

                      memory/3096-232-0x000002EFE4690000-0x000002EFE469C000-memory.dmp
                      Download

                      memory/3096-231-0x000002EFE4540000-0x000002EFE4595000-memory.dmp
                      Download

                      memory/3104-646-0x00000000025E0000-0x0000000002655000-memory.dmp
                      Download

                      memory/3136-0-0x0000000000400000-0x00000000004CB000-memory.dmp
                      Download

                      memory/3136-12-0x0000000000400000-0x00000000004CB000-memory.dmp
                      Download

                      memory/3136-13-0x0000000000930000-0x00000000009AB000-memory.dmp
                      Download

                      memory/3660-2055-0x000001B275800000-0x000001B275855000-memory.dmp
                      Download

                      memory/3992-1228-0x0000000000A20000-0x0000000000A95000-memory.dmp
                      Download

                      memory/4208-218-0x0000000002C30000-0x0000000002C37000-memory.dmp
                      Download

                      memory/4208-2016-0x0000000002C30000-0x0000000002C37000-memory.dmp
                      Download

                      memory/4236-2057-0x00000000012A0000-0x0000000001315000-memory.dmp
                      Download

                      memory/4292-1130-0x0000000000B20000-0x0000000000B27000-memory.dmp
                      Download

                      memory/4292-1129-0x0000000000B50000-0x0000000000BC5000-memory.dmp
                      Download

                      memory/4352-1131-0x000001F91A710000-0x000001F91A765000-memory.dmp
                      Download

                      memory/4452-645-0x000001F8788C0000-0x000001F878915000-memory.dmp
                      Download

                      memory/4536-1854-0x0000000001510000-0x0000000001585000-memory.dmp
                      Download

                      memory/4800-995-0x00000000007C0000-0x000000000083B000-memory.dmp
                      Download

                      memory/4800-994-0x0000000000F50000-0x0000000001034000-memory.dmp
                      Download

                      memory/4800-236-0x0000000000F50000-0x0000000001034000-memory.dmp
                      Download

                      memory/4800-188-0x0000000000F50000-0x0000000001034000-memory.dmp
                      Download

                      memory/4800-237-0x00000000007C0000-0x000000000083B000-memory.dmp
                      Download

                      memory/4808-235-0x000002A776A80000-0x000002A776AD5000-memory.dmp
                      Download

                      memory/5092-239-0x00000000015B0000-0x0000000001625000-memory.dmp
                      Download

                      memory/5092-238-0x0000000000690000-0x0000000000A18000-memory.dmp
                      Download

                      memory/5092-993-0x00000000015B0000-0x0000000001625000-memory.dmp
                      Download

                      memory/5092-992-0x0000000000690000-0x0000000000A18000-memory.dmp
                      Download