Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    61s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 10:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260626-l2vabaat4v
  • SHA256 eb3a19a75e75a942dfb85d12551aa23bca04835ed1e2511c4bd2986142cab602
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • nextworks.io

  • malware.nextworks.io

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3308
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\moY8ZVbK7jic.bat" "
      2⤵
        PID:5000
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:2004
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:836
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3rsmOVnnQoj6.bat" "
                4⤵
                  PID:3576
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:3360
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:1548
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AysiqzAOmgpn.bat" "
                          6⤵
                            PID:2508
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:3140
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:4896
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P6jPWJdL6KKu.bat" "
                                    8⤵
                                      PID:3896
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:4632
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:3016
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\flueWIp0UGRa.bat" "
                                              10⤵
                                                PID:52
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:2008
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:2996
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\05GPBiDbN2eZ.bat" "
                                                        12⤵
                                                          PID:5212
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:4300
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:3092
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5olul0qNnW4m.bat" "
                                                                  14⤵
                                                                    PID:1068
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:2144
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:1076
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOPRIxq0SEqW.bat" "
                                                                            16⤵
                                                                              PID:5640
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:984
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:2540
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fH1SGCIY77t2.bat" "
                                                                                      18⤵
                                                                                        PID:3700
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:5884
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:5836
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WdsJmuEkuPVq.bat" "
                                                                                                20⤵
                                                                                                  PID:4968
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:3424
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:4496
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ubqiz9M4Na1f.bat" "
                                                                                                          22⤵
                                                                                                            PID:5936
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:668
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:3304
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\45xkxdYYBR6A.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:4976
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:5544
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:4560
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wNsxgmjUN5fQ.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:1032
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:5816
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:4792
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XUVk6Vcih3fx.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:4688
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:5064
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:5888
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\txaTSd6FrjU9.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:5216
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:3804
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:5736
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\I3jKFUI9kEw2.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:1200
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:3012
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:6008
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RTN1bHswLSBZ.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:4404
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:1080
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:260
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XvFDqfIWGOP0.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:1420
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:4244
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:2660
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u9PI8A1KtLuP.bat" "
                                                                                                                                                                                          38⤵
                                                                                                                                                                                            PID:2828
                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                              39⤵
                                                                                                                                                                                                PID:2852
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                39⤵
                                                                                                                                                                                                  PID:2428

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Matrix

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          05GPBiDbN2eZ.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\05GPBiDbN2eZ.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 5f1c87d215f4163993c4d5a976f5d8740c39f778c94df36a711c3aac53d97b06
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          3rsmOVnnQoj6.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3rsmOVnnQoj6.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 a59684b09da142f52e2ac2c0d234ed54d9bea7135d8abb75e4bf54d0ebc2d7a1
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          45xkxdYYBR6A.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\45xkxdYYBR6A.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 a35f3c3184ac51580b138adf4f159fd30085cb42a7132a9b6137e8cc756d8034
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          5olul0qNnW4m.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5olul0qNnW4m.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 7c351a86e201a3a3bbbbc0d0dc36a42de1015f62c2a6b5e2325dd1bfc028cd57
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          AysiqzAOmgpn.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AysiqzAOmgpn.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 2946e98bfd0c8a39de6ea0c1c56fc043bac09847f521f151f6974b8b815b6706
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          I3jKFUI9kEw2.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\I3jKFUI9kEw2.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 64204efc18189d2433e5790773c500c27c8f4a79bfb205cf316aacd903cab369
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          P6jPWJdL6KKu.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\P6jPWJdL6KKu.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 d9fdc47bda74e3363b16878c34fc4c7538639a8d9aa17a0344b58cfa055ae97e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          RTN1bHswLSBZ.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\RTN1bHswLSBZ.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 819028414f603376e6a1bbe5f4b7580af0fa263daef805ff8f9bf825f9ea149c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          Ubqiz9M4Na1f.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ubqiz9M4Na1f.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 8b5cef91025e8dab22cde4c3a02f7dd8baf1c7f783ea8d3184b435a67a334b59
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          WdsJmuEkuPVq.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WdsJmuEkuPVq.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 145c7efc3cafb5610da45f9035b0d03e2e55b5af0a320620e0be5df3f55afa8c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          XUVk6Vcih3fx.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\XUVk6Vcih3fx.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 512d0207485a6bb3b25777309efb36aaf5fba62bb086879c495871a5d536be0a
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          XvFDqfIWGOP0.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\XvFDqfIWGOP0.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 092121deeac5d2d4c9feb5e9fb95a27253dde118535a2847f1491f4c10897454
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          fH1SGCIY77t2.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\fH1SGCIY77t2.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 10f6dc2fa9703ddcd90305e0446c586f204ff31d33a24f7700934b78ee098556
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          flueWIp0UGRa.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\flueWIp0UGRa.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 95aff2d5cfdb321e549e0a2b626524e77eb1e7a9ad13d6f2b82d33e13a14990f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          mOPRIxq0SEqW.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mOPRIxq0SEqW.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 c1c1f0937d24cf0e0e1d43e2d3726b8939ca6b3507e8fe52f9ad57de9c80066b
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          moY8ZVbK7jic.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\moY8ZVbK7jic.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 cfa473aebfd07a7d3573c908cee1b8a6dcdad768d92266b4d6e1bf733b4c6e7d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          txaTSd6FrjU9.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\txaTSd6FrjU9.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 29b8299f1db15b5c4cfbc591c57bd76a612faf28cef797abcf86a7f05402db67
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          u9PI8A1KtLuP.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\u9PI8A1KtLuP.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 92151d6f9c174abf55bda1234dd5e328ef7a2e4c9bbdc3da2918b68e99b6cc5b
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          wNsxgmjUN5fQ.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wNsxgmjUN5fQ.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 55a5063ab6a3631fa40f356cbcb95b04459a3a00418da7e603893282d2d3b3af
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/836-30-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-23-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-27-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-28-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-29-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-26-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-31-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-32-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-33-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-34-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-35-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-36-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-25-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-43-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/836-24-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-7-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-8-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-14-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-13-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-12-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-10-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-21-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-11-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-0-0x00007FFC911BF000-0x00007FFC911C0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-9-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-6-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-5-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-4-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-3-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-2-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-1-0x0000000000DD0000-0x00000000010FC000-memory.dmp
                                                                                                                          Download