Overview

overview

10

Static

static

1

Wasper Setup.exe

windows7-x64

10

Wasper Setup.exe

windows10-1703-x64

10

Wasper Setup.exe

windows10-2004-x64

10

Wasper Setup.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    103s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-08-2024 01:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Wasper Setup.exe

  • Size

    51.9MB

  • MD5

    a421f09731bc163abba8b85e660499e1

  • SHA1

    20dcf24c99b169a9b47c8f390e40508040a259b1

  • SHA256

    5f0637ae587d8dde726b69838ada990c771bf8c2a725e57e2a72c2d2165f0806

  • SHA512

    4d07fc1b1b441fd566e44f34442230d613e54e5987770aed58e458a3e3e8c64672dfdc58c394fde994f66d359db9b5e16e5d35f1319bf35a22d478762de68e32

  • SSDEEP

    1572864:R2eFjiaFO3kVFQXKuhsxCEmGhq3Nb2vBe6OkYiYhol0Yx:LFO93kVFx8sxCEmGU3V1zk8holzx

Score
10/10
hijackloaderrhadamanthysstealcwasp2credential_accessdiscoveryloaderspywarestealer

Malware Config

Extracted

Family

stealc

Botnet

wasp2

C2

http://45.152.112.103

Attributes
  • url_path

    /1cf3aa1810feeb67.php

Signatures

  • Detects HijackLoader (aka IDAT Loader) 7 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3008
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2856
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2276
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1860
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3052
    • C:\Users\Admin\AppData\Local\Temp\Wasper Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Wasper Setup.exe"
      1⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Program Files (x86)\WasperApp\WasperApp.exe
        "C:\Program Files (x86)\WasperApp\WasperApp.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2084
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1800
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:900
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1284
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1672
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3016
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:4468
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2296
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:4868
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:5112
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2460
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:572
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3880
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2760
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3112
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:5064
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2436
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:4084
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:4880
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4044
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:3352
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:3388
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3496
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:3952
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2744
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3716
        • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe
          "C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:1640
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:884
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\WasperApp\Accessibility.dll
      Filesize

      20KB

      MD5

      fb554f9fe0b91f135d26ac6459cfd6f2

      SHA1

      b1269a2c28bded872b14fe70b69484631ef3a65d

      SHA256

      929ea150ad45b7c7dd5427461fbec44d43b67c08081f59b42b6abf570feae271

      SHA512

      8dffde6cddfc59ec380111fd36048126559e1f1e080c081ca0d09021bb23d6888e93e1659c7b3a8fa46f76602b03cf3e638ec1a80fba79e51648dcb32362e10c

      Download Submit

    • C:\Program Files (x86)\WasperApp\Microsoft.Win32.Primitives.dll
      Filesize

      15KB

      MD5

      300c95ff95b52e8a02fec6bfcfa58225

      SHA1

      b646f89fcd463ad5c19889b4fea40540568b780c

      SHA256

      f1b40565e5c4c41da810aee5b7d2272a0906e88f796812435aa5ed712bcac40c

      SHA512

      9bfe0eb6eea98b2d35aa42986a273ec82424143965e173b32bb4b7e5537580a027940a6952a45fc54f0b665e871deb2a95651106c2f24c7de3b3d3cd2dec7e89

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Collections.Concurrent.dll
      Filesize

      270KB

      MD5

      38d21e067d7673194a84cced59066ac8

      SHA1

      e64362176f714b23603f3a67f1e741f12e35a832

      SHA256

      483130bfd1e57a0cbfd8a4f3c6e2353ac3f246276f9476c83cca1cadbc47ef47

      SHA512

      3fa6f78ff0cb527a8e82261549f24a8609d005821ac5c5e7257670dffd55472a134af3ef78d73779758303ae5a90728181cd4caebc871c5cfa4c309141201baf

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Collections.Specialized.dll
      Filesize

      102KB

      MD5

      cc26e9e30ffab763a1e54c0ef3713382

      SHA1

      c3be6646b7a4576ebd7729dbf4dccbd1fc159d51

      SHA256

      0cbabb81eae22f4c07c6c846054d207ae3f25da15649eb7fa29e4e2cecd24db4

      SHA512

      c8e57fb70cfa7667f9a5484c99eedd0bf34004ee26e9642e99a6b90624caa804af571d8aaafa7e9b121550af58205f8ed197b4ddb928210d394ff0b4c1897149

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Collections.dll
      Filesize

      254KB

      MD5

      92063926c04f2e4bf5b5fde16542831d

      SHA1

      e7be34eaff2d3d8796911d21f1fdbb93bf231dec

      SHA256

      9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

      SHA512

      e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.ComponentModel.EventBasedAsync.dll
      Filesize

      46KB

      MD5

      333639248121fb67d18323613a8203ea

      SHA1

      0cee5f7d46596239b833b3b30dccde27b0136959

      SHA256

      4c97d7bc0742faaa52ba86018b040aac44ddfc88a5835f9e6a659e03b4558999

      SHA512

      714fcb7299abcb26100b5f4103834c11c58f535ee9853fca2bcb22f43a3d1e7608d6ccae2dcc93d1687a4f1c8b521afe683d537f70f858681e62fff2d79c4acb

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.ComponentModel.Primitives.dll
      Filesize

      78KB

      MD5

      1c59c00ab0850af4b4d2bafd6be47db3

      SHA1

      4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

      SHA256

      133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

      SHA512

      8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.ComponentModel.TypeConverter.dll
      Filesize

      726KB

      MD5

      f6f78df8a3ef64639ac0cb7de24ed66b

      SHA1

      384422c0ceb6bb6870c4f7d9074e9c78d33e4c0c

      SHA256

      88129c110d748f7c8ef8a923f68cd26d39e0505b49bf5cc10cbd23b92f1a00a3

      SHA512

      ed63f75e3477196b5308c42f259c0294a29ef5edf6eb0df4f8268be3f0495b9cfd8ca3467bc1574db142571c368940468bb84d14c26aaccacd6eee66ddd98403

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Diagnostics.FileVersionInfo.dll
      Filesize

      46KB

      MD5

      1daf75cc369569182bbdb664eb8cb4c7

      SHA1

      ec0ff43694f0027a469d31221b591bff2ef29d69

      SHA256

      92ae8401342fd8484e749c65a7726a0f5bff69346ad4e96026bfa063ff567b8b

      SHA512

      9d0ee9b59354f721136a1631e46d395b763f755b212e44daea5c62a91b4c5edfd218587c8aa56db27f7efc7b9678c59ea822964f279a7837aa5e12f46be4e79b

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Diagnostics.TraceSource.dll
      Filesize

      142KB

      MD5

      fe6a4b96e144131788108c8396a849eb

      SHA1

      40e6e5d03cfe036645ae854d5a2262faec6bed32

      SHA256

      22365ee4e3ba3c991d495e41f92e29bf6ddb38a48c44f55651271b80ee62b6d1

      SHA512

      61644c0e970dd6a6ff697b110bf99962931dd94deda5a966ea0fded3d23cba7433b802656295e04f1a95421774ea3c838f0a642d26b5e46ae6c05becb52eb7f1

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Drawing.Common.dll
      Filesize

      1.5MB

      MD5

      e4715322db624dc52947a42ac67757ab

      SHA1

      ba0b0850142ecc3910927d6f2e5781b896d7d442

      SHA256

      75b1e772a4355145364121af00e5b5cf06c7212aa53d662fdc996bc11e8092a9

      SHA512

      3c86d44eb209a3a1f2001968a2b139e532a0513fd2decff04aa1bf8b30b6202c70fc0e7ac8b22ace563023671259cd74cf65062132e7f1b97d3580621686b05a

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Drawing.Primitives.dll
      Filesize

      130KB

      MD5

      b5ca10a41cc865048491f617678722a9

      SHA1

      afe171d9d676b78983b802e18ef8e00927073c64

      SHA256

      cbe9fbb1d1e4850460854474ffd8c01ddcc756dcb33a86d1674c0cb2e2a0b026

      SHA512

      2afdce56b7eec6deb82f8b2d5ec3029b5a0ee1e8bbf2e0ff9a0a5310bf265ddcdf63660546b4dbcc3c5fb0cba3cbb94f2408fe5cb4d14dbe0e74aba6dd5a2192

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.IO.FileSystem.dll
      Filesize

      15KB

      MD5

      35e27f4c681085a4b096826ee8ea4f53

      SHA1

      cf3ea4304e5558c8fdd4422e4d72509cd91ea719

      SHA256

      7bd41c6b12b73e6e90476f2d56db8581664abe07e7ab9bf2917bb254ed1d75ad

      SHA512

      1f9e6519ff29524e57cb0b3576ab118014293aade8f30027ef44b1f29a8e9a54e7bcb3b288a92dba996053b16016807d93fa9f44f2c43666ddc6425ddd7ae4b9

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Memory.dll
      Filesize

      154KB

      MD5

      7e999da530c21a292cec8a642127b8c8

      SHA1

      6585d0260ae98bab2ad1eaba0f9cfe8ebb8a0b3f

      SHA256

      3af25e0c81c1462d0db86f55c4e5fd8c048c70685f9a566d29d499bc46935fb4

      SHA512

      a18b6649b5c2f9f96bf639863df9faad436759200a64f91fb2d955f33c71ce4b2d5798be982f692a247ac864d8acb63fb731b31c06333e5c7d9a9c895ecd6451

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Numerics.Vectors.dll
      Filesize

      15KB

      MD5

      b7adf99da15738c602df256e8a1aac4a

      SHA1

      ff98005dfcf40f876b618a599f227397f36915df

      SHA256

      2466f7df763b191a6b4a536eae1016394d81e175fc53cefe56b8ce27459412af

      SHA512

      8eb34d00f8149d688bd5efe2ffdc834f669fa8c30d4c265814647de78a55502805104ccc3682010b246d26d805004b188ab19ad59fc2e866103bbe191e2225ad

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Private.CoreLib.dll
      Filesize

      12.6MB

      MD5

      805cf170e27dd31219a6b873c17dce88

      SHA1

      ac90fa4690a8b54b6248dcb4c41a2c9a74547667

      SHA256

      ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

      SHA512

      fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Private.Xml.Linq.dll
      Filesize

      394KB

      MD5

      60ed8b2bffc748d6a2a1fed8fa923368

      SHA1

      be411429b9a649a495124558c5e5d95a83525d58

      SHA256

      0b63cebb991d1911a607993ea5b4639f34a2b0b381a73973542db2d3591e9f90

      SHA512

      b0a4ac2aa96d827258bb30f098512741ad3f93585e05ceae0255e15cd8dc9ab8048788902c1eb32a813e9c69c8a923200a716b4e00f579c22a0b425665e575f8

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Private.Xml.dll
      Filesize

      7.6MB

      MD5

      46aebfbd6d7e74d4d558da62d7600d25

      SHA1

      9c1cd44ab8b5e283967427e91cbddddfc0c2bf5a

      SHA256

      834e304221e742a831be5c5178892258e689eae35b730172e74161af2785aab9

      SHA512

      9c4499d174a988cc3830aafcc42f79defff37b16198f49cf5d2dc86f88809fcb44e0c300351f813d46addf9998f64448c50213f1721c6a307aad21c205db1524

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Reflection.Emit.ILGeneration.dll
      Filesize

      15KB

      MD5

      0332c7e8e9a330080d6f0fb6c9b17b3f

      SHA1

      f168f25ccade467fe0efaac6ad2a09c1f2cb783b

      SHA256

      879b6c4221cb2bf24b79abca0709b2919904d8685fff5a69220fe6c2425d4112

      SHA512

      c3c4026d41f4e7832bf94e921fd6937918001fa98c52c5a8c115b5d538ad348425e290d93187af4779424b8142aca9b8bbfb6c5a1493ff2be655a2637b454512

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Reflection.Emit.Lightweight.dll
      Filesize

      15KB

      MD5

      23120034a510d234c79711940d1b809d

      SHA1

      1b1cb29537a8b78279909a794159fc4c70174430

      SHA256

      0518f171d45803ce07a79b27eb65e5d3277b711d15c8d2fd5964e044167db49f

      SHA512

      99af585ef71ff917d4c77f46b189cc14d1cd4efe9b35e6c33d0eef8112158574c8fb417801cf5207e412f7254de1a8cd789e208e17f01cd19ebafb7b133afd2a

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Reflection.Primitives.dll
      Filesize

      15KB

      MD5

      579b0fcf2dfe1a1250a0ad29ed54b1f8

      SHA1

      2157ad05803ec234606bf7e547bf644021b4f6fe

      SHA256

      d7769658065897653651107e0138f6bb7515932886374ba11833176a931411d7

      SHA512

      2666a0ac8591905af580afb25163485d773896d38de5f6a04b571103a821d7221d0e60ccee7752740e3465015b6bbea306e5fc9634e4c6c46b2d0c9d8da4c9c6

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Runtime.InteropServices.dll
      Filesize

      94KB

      MD5

      49c86e36b713e2b7daeb7547cede45fb

      SHA1

      75fe38864362226d2cce32b2c25432b1fd18ba37

      SHA256

      756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

      SHA512

      a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Runtime.dll
      Filesize

      42KB

      MD5

      53501b2f33c210123a1a08a977d16b25

      SHA1

      354e358d7cf2a655e80c4e4a645733c3db0e7e4d

      SHA256

      1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

      SHA512

      9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Security.Cryptography.Algorithms.dll
      Filesize

      17KB

      MD5

      8f3b379221c31a9c5a39e31e136d0fda

      SHA1

      e57e8efe5609b27e8c180a04a16fbe1a82f5557d

      SHA256

      c99c6b384655e1af4ae5161fe9d54d95828ae17b18b884b0a99258f1c45aa388

      SHA512

      377f4e611a7cf2d5035f4622c590572031a476dd111598168acea1844aaa425c0fe012c763fbc16290c7b32c6c7df7b2563c88227e3dbc5d2bd02250c9d368d9

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Security.Cryptography.Csp.dll
      Filesize

      15KB

      MD5

      c7f55dbc6f5090194c5907054779e982

      SHA1

      efa17e697b8cfd607c728608a3926eda7cd88238

      SHA256

      16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

      SHA512

      ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Security.Cryptography.Primitives.dll
      Filesize

      15KB

      MD5

      777ac34f9d89c6e4753b7a7b3be4ca29

      SHA1

      27e4bd1bfd7c9d9b0b19f3d6008582b44c156443

      SHA256

      6703e8d35df4b6389f43df88cc35fc3b3823fb3a7f04e5eb540b0af39f5fa622

      SHA512

      a791fa27b37c67ace72956680c662eb68f053fa8c8f4205f6ed78ecb2748d27d9010a8de94669d0ee33a8fca885380f8e6cfad9f475b07f60d34cdcb02d57439

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Security.Cryptography.dll
      Filesize

      2.0MB

      MD5

      75f18d3666eb009dd86fab998bb98710

      SHA1

      b273f135e289d528c0cfffad5613a272437b1f77

      SHA256

      4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

      SHA512

      9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Threading.Thread.dll
      Filesize

      15KB

      MD5

      72d839e793c4f3200d4c5a6d4aa28d20

      SHA1

      fbc25dd97b031a6faddd7e33bc500719e8eead19

      SHA256

      84c9a95609878542f00fe7da658f62d1a6943a43e6346af80d26bcff069a4dbd

      SHA512

      a414cd9d7cf6a04709f3bdbef0295349b845a8301171ed6394e97b9993f35816383b958736c814f91c359a783cca86ee04802856486d4b4e0ab90a45da39db1d

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Threading.dll
      Filesize

      82KB

      MD5

      32aa6e809d0ddb57806c6c23b584440e

      SHA1

      6bd651b9456f88a28f7054af475031afe52b7b64

      SHA256

      e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

      SHA512

      fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Windows.Forms.Primitives.dll
      Filesize

      2.9MB

      MD5

      8129c2d72bcba8b50576e7c43e558832

      SHA1

      f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

      SHA256

      5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

      SHA512

      40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

      Download Submit

    • C:\Program Files (x86)\WasperApp\System.Windows.Forms.dll
      Filesize

      12.9MB

      MD5

      a51632facb386d55cc3bc1f0822e4222

      SHA1

      59144c26183277304933fd8bb5da7d363fcc11fa

      SHA256

      efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

      SHA512

      2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

      Download Submit

    • C:\Program Files (x86)\WasperApp\WasperApp.dll
      Filesize

      670KB

      MD5

      fa9006dbbd4191cc4f1cba97dce3b493

      SHA1

      c48dd6237c7605d9ee12e1a3e701f492b7141f79

      SHA256

      7386bd96f63e5f3575a1a176b899b49429e74010e17a2005a8117095735352d3

      SHA512

      7137d4adf81978b5ded5a239469b86087d27d11e6390185a0a4e05bad4e1070dff6e3870c4265b41d2183e1fcddea11e347a024ac73b541571963f1cb15fe4a7

      Download Submit

    • C:\Program Files (x86)\WasperApp\WasperApp.exe
      Filesize

      305KB

      MD5

      7ca72d437db41745f139d1228b8d95e1

      SHA1

      810a931dec45e63d8d24448d44b1bb645a71047c

      SHA256

      dbb99b36387720cd0b997359da33ecdaab55cb68cf9643b34d9d6bc136a3805b

      SHA512

      9e3e10ac4b96191cbde207b69d0c0412fe4f312da59359b66807e319d0529c9851213d7ea2ffab6346343bf59dfe4288754e97d2b76b79f6171361dd4bd083e8

      Download Submit

    • C:\Program Files (x86)\WasperApp\clrjit.dll
      Filesize

      1.7MB

      MD5

      8b81a3f0521b10e9de59507fe8efd685

      SHA1

      0516ff331e09fbd88817d265ff9dd0b647f31acb

      SHA256

      0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

      SHA512

      ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

      Download Submit

    • C:\Program Files (x86)\WasperApp\coreclr.dll
      Filesize

      4.8MB

      MD5

      9369162a572d150dca56c7ebcbb19285

      SHA1

      81ce4faeecbd9ba219411a6e61d3510aa90d971d

      SHA256

      871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

      SHA512

      1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

      Download Submit

    • C:\Program Files (x86)\WasperApp\hostfxr.dll
      Filesize

      342KB

      MD5

      16532d13721ba4eac3ca60c29eefb16d

      SHA1

      f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

      SHA256

      5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

      SHA512

      9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

      Download Submit

    • C:\Program Files (x86)\WasperApp\hostpolicy.dll
      Filesize

      388KB

      MD5

      a7e9ed205cf16318d90734d184f220d0

      SHA1

      10de2d33e05728e409e254441e864590b77e9637

      SHA256

      02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

      SHA512

      3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

      Download Submit

    • C:\Program Files (x86)\WasperApp\mscorrc.dll
      Filesize

      133KB

      MD5

      53e03d5e3bffa02fbc7fb1420ac8e858

      SHA1

      36c44c9ff39815aa167f341c286c5cd1514f771f

      SHA256

      23a433398be5135222ee14bb1de6334e7b22bad1a38664a83f1cf19dfbddd960

      SHA512

      f6aca16b90f6b4efa413dc9a8f1d05e83c1e3791b2cb988f9bce69d5272a0077c1edcae4111a494d166b5e3ab4e25956dead4e93ee1e43417c2b7bb082292170

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\1ffb32d7
      Filesize

      1.1MB

      MD5

      879445c3847f6a02f0cd1134a7c87b95

      SHA1

      b729de8f3a5e7c73ba1ff23cbe2468271755a31d

      SHA256

      f09f3fb69514edefdec76e70b073a1cfdd32c12d1feef469e34fcb3e8763878f

      SHA512

      d6f5acb6fcde4fa24b740065a47016ee404200ed0cdbca687d19a86109c63204f492283fef0c680560016c4e8a57020a8b24f23eeca416c78b150c43548ea48b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss1.exe
      Filesize

      1.5MB

      MD5

      37f39d42469f898a063f5cf9931aa5e8

      SHA1

      eae3937c7a5c4c7e31ed84da81dee9ac03b8885f

      SHA256

      770f6abaa4cfa395c46f7271d86553e5ebb21448a7cf38047df00535bd3463f2

      SHA512

      424d4e3b9246df4c3f4d79e9a3b7f1b8d7f78c6c5d39f13247fe657637a426d472a08c4bd9e71c787f384020f1b60dd8db9d85961c7f01fd6d0ac69505644bee

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\204455e8-b734-441b-945f-55a38e9b9725\snss2.exe
      Filesize

      7.4MB

      MD5

      afea68327bd3cb05fea2420848065499

      SHA1

      e057f60b9e54b139e2fdbc63b141533c4946c8d5

      SHA256

      039b95904c2dacfb2fd0798010837023349478dbbb9f70bf52a2f79e4735b5b4

      SHA512

      be1c174bdbff87c38299c880ac93d4959d8048817439511bec59c281f9f1f773d501017cc52963da82ce8941eecd2cf002ed44dc34e3bd4e7ba6b8eec50c9dbb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ad843f93
      Filesize

      907KB

      MD5

      44ff6d271b35fc4b769dad4cebcbdca2

      SHA1

      12fcfdcba2114b1929f36d47a45c2eb89ca4f724

      SHA256

      8ad69fcbba9f66968456881ac4b76a3bd5896a763d5ece126af4e4242c86d3fb

      SHA512

      58ce786ba14b709ba219dcdba7752dc0529c5cc2279b2b022f1ee2df61ed41720c217bad99775b332d9cc8597b00f32259d7f7e311852313d669ba4828b9b48c

      Download Submit

    • memory/572-1044-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/572-1034-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/572-1033-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/572-1032-0x0000000000400000-0x0000000000582000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/900-1013-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/900-1010-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/900-1011-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/900-1009-0x0000000000400000-0x0000000000582000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1284-1022-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1460-1267-0x0000000000E10000-0x0000000000E8F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/1460-1216-0x0000000000E10000-0x0000000000E8F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/1528-999-0x0000000002620000-0x0000000002621000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1528-1001-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1528-1002-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1528-1003-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1528-1000-0x0000000000400000-0x0000000000582000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1672-1130-0x0000000001210000-0x0000000001455000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1672-1048-0x0000000001210000-0x0000000001455000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1672-1052-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1672-1054-0x0000000001210000-0x0000000001455000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1800-1050-0x0000000000F60000-0x00000000011A5000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1800-1040-0x0000000000F60000-0x00000000011A5000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1800-1042-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1800-1123-0x0000000000F60000-0x00000000011A5000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1800-1058-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

      Download

    • memory/2084-1012-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2084-1030-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2296-1125-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2296-1140-0x00000000008D0000-0x0000000000B15000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2296-1057-0x00000000008D0000-0x0000000000B15000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2296-1126-0x00000000008D0000-0x0000000000B15000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2436-1206-0x0000000000690000-0x000000000070F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/2436-1179-0x0000000000690000-0x000000000070F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/2460-1124-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2460-1136-0x0000000000C40000-0x0000000000E85000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2460-1092-0x0000000000C40000-0x0000000000E85000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2760-1132-0x0000000000950000-0x0000000000B95000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2760-1144-0x0000000000950000-0x0000000000B95000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/3016-1027-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/3016-1020-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/3016-1019-0x0000000000400000-0x0000000000582000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/3016-1021-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3496-1194-0x0000000000B80000-0x0000000000BFF000-memory.dmp

      Filesize

      508KB

      Download

    • memory/3496-1243-0x0000000000B80000-0x0000000000BFF000-memory.dmp

      Filesize

      508KB

      Download

    • memory/3716-1258-0x00000000005F0000-0x000000000066F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/3716-1198-0x00000000005F0000-0x000000000066F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/3880-1049-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/4044-1186-0x00000000008D0000-0x000000000094F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4044-1224-0x00000000008D0000-0x000000000094F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4468-1038-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/4868-1025-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/4868-1024-0x0000000000400000-0x0000000000582000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/4868-1026-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/4868-1035-0x0000000073960000-0x0000000073ADD000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/5112-1043-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

      Filesize

      2.0MB

      Download