Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    61s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 03:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260711-eavnfaa16m
  • SHA256 10835de7c4766806cf93854ec914207dcdfa5f25e4ff249227a2d5a185583cbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • xoilac365uu.cc

  • malware.xoilac365uu.cc

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5476
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hGGFwfV593my.bat" "
      2⤵
        PID:4832
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:5828
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:4928
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P3XVSg8GkIEj.bat" "
                4⤵
                  PID:3772
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:2520
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:1692
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7O5Nx6fPVgzo.bat" "
                          6⤵
                            PID:4316
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:5064
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:4432
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hf7btKlUdacp.bat" "
                                    8⤵
                                      PID:5268
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:3464
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:4532
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FRhQLiqL8OS6.bat" "
                                              10⤵
                                                PID:5908
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:2872
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:1120
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G2JCzI38sImm.bat" "
                                                        12⤵
                                                          PID:3548
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:5100
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:2064
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eNlGpMe2XPsX.bat" "
                                                                  14⤵
                                                                    PID:6000
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:4220
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:5920
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YbfWoZ5j5KwG.bat" "
                                                                            16⤵
                                                                              PID:4680
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:4956
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:4264
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0dZTbzsE2kt3.bat" "
                                                                                      18⤵
                                                                                        PID:880
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:4936
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:3680
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kvFUP2gdOFub.bat" "
                                                                                                20⤵
                                                                                                  PID:3652
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:3764
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:1204
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2pQdRo5LXcdz.bat" "
                                                                                                          22⤵
                                                                                                            PID:1128
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:4496
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:4480
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2lGELyQFoxJR.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:5336
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:4112
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:4244
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Okp893d0GeLm.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:3020
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:1840
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:4504
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qM8OFDlPgj2T.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:5000
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:3136
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:2432
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LG8Vkwf4JClV.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:1316
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:6012
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:1372
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jA3U0wXbjaBQ.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:4296
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:2328
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:5964
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e1V0rSraWM6s.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:4864
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:3944
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:244

                                                                                                        Network

                                                                                                              MITRE ATT&CK Matrix

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              0dZTbzsE2kt3.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\0dZTbzsE2kt3.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 ba1d62a4a388415b5107b5cd7eb67ecbf4b71666489b67c4bf6cdd89b3dd5a3f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              2lGELyQFoxJR.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2lGELyQFoxJR.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 25250b61444b86123064ef37fcb25dc5706153dd35d552e1ef9e9483ba2b14ed
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              2pQdRo5LXcdz.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2pQdRo5LXcdz.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 d461f44626cd25f38ec198142ee8503dd86b704a4b50be6675a57ed98dc30635
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              7O5Nx6fPVgzo.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7O5Nx6fPVgzo.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 58252a3556067882744a21cb21c9269f16f17439f34be427f9a473e65571b117
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              FRhQLiqL8OS6.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\FRhQLiqL8OS6.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 59e5a589b1cfacf8fa71ac84a84a8b4df92fb6cb2bc9498eaa9b526e549f347f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              G2JCzI38sImm.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\G2JCzI38sImm.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 cd513a30c7fb2f0ceaf9bce61df9ccaa845fda6beba1d720f018481042ad7d29
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              LG8Vkwf4JClV.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\LG8Vkwf4JClV.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 33f2ca08ae62c7b53255986cfd4d73186f87d13228b8ada5f4f89bce11c6d207
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Okp893d0GeLm.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Okp893d0GeLm.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 f60843773c254c1e0df165dfdf68a7ecf670b30e1831ae8e28f163b4ce8684ae
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              P3XVSg8GkIEj.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\P3XVSg8GkIEj.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 489d8bf3e8716af34811d05d4bcade1a642fa0f991d120b5e72c2b318bbda5c4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              YbfWoZ5j5KwG.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YbfWoZ5j5KwG.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 9a80068f6317defcd7c82fe4939747a98248a14139167a3cc153d3fc7663cad5
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              e1V0rSraWM6s.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e1V0rSraWM6s.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 130cf294cb9e7d12dfda013f32f08890380dcaf9d1437ed1b37146633106565d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              eNlGpMe2XPsX.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\eNlGpMe2XPsX.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 0e316dcba1705ef869882a85dd1372628716b804c3eba0d7ffef198ddc142c12
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              hGGFwfV593my.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hGGFwfV593my.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 a757ff398afb52d32d2a3b75cbd1204581375328823cb9bb9a88fd77dc53581e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              hf7btKlUdacp.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hf7btKlUdacp.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 3024bbdc1552982ec510e1ca6fe451cf165517849b1ee20fecf1e11ae8da3ead
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              jA3U0wXbjaBQ.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jA3U0wXbjaBQ.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 71c3438f3995bbf2d5a052854f9b7c03e9b3c58e874a4c5f5c59d35e68448de1
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              kvFUP2gdOFub.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\kvFUP2gdOFub.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 41286d5c7e3dea18a87a6bcffceac037f8c91dcb3fb1a7142a42784f388ea4ce
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              qM8OFDlPgj2T.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\qM8OFDlPgj2T.bat
                                                                                                              • Size 185B
                                                                                                              • SHA256 a7a11d1ccdcbfaa97ae8e8967cfe63e9c7ce17f4d25919913889d389f996514a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              memory/4928-30-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-44-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-25-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-26-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-28-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-27-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-29-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-24-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-31-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-32-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-33-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-34-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-35-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-36-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4928-23-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-8-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-7-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-14-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-13-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-12-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-11-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-22-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-10-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-0-0x00007FFD1A67F000-0x00007FFD1A680000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-9-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-6-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-5-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-4-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-3-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-2-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-1-0x0000000000200000-0x000000000052C000-memory.dmp
                                                                                                              Download