Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    62s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 07:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260706-jrt6fsft5k
  • SHA256 2d8ab2d100fcf6a05465f25b7e3cec6ceb9701b0e741a8d652e0894ccb6abf33
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • qrtac.io

  • malware.qrtac.io

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2708
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yoI6tAcQeErB.bat" "
      2⤵
        PID:4984
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:2524
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:1456
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5hyCuLPIK7Yx.bat" "
                4⤵
                  PID:2152
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:2472
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:1576
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\irNV0r3CG4Mc.bat" "
                          6⤵
                            PID:5844
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:1516
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:4480
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0g1ohL6OQy1T.bat" "
                                    8⤵
                                      PID:2788
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:6020
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:6076
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DTyfJARq8Ces.bat" "
                                              10⤵
                                                PID:4204
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:2508
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:4456
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1fNv2cvXZWwU.bat" "
                                                        12⤵
                                                          PID:5056
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:4484
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:4260
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNHMb6R65m8I.bat" "
                                                                  14⤵
                                                                    PID:4184
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:3800
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:1748
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8cd6vGV8oC1Y.bat" "
                                                                            16⤵
                                                                              PID:4312
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:1220
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:2044
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bQY5fCXdAjJQ.bat" "
                                                                                      18⤵
                                                                                        PID:5160
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:5812
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:5028
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wMKy7ADI3Iva.bat" "
                                                                                                20⤵
                                                                                                  PID:1504
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:4424
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:752
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AXJJMzfoRQvr.bat" "
                                                                                                          22⤵
                                                                                                            PID:4588
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:4160
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:4616
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oLKuOLkYqLSe.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:3124
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:5260
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:4864
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e5Wk47TzNtrq.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:5112
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:4920
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:4240
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1d3TWilI28sm.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:5992
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:4256
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:2844
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mvzPpw0bMmaA.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:4896
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:5172
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:1596
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e99sqa7sAE0w.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:5960
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:5552
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:1992
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ObxiNqUH1aRh.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:5816
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:2984
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:3100
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UUhNsLklitoI.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:5764
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:992
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:5048
                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                sihost.exe
                                                                                                                1⤵
                                                                                                                  PID:4104
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe /LOADSAVEDWINDOWS
                                                                                                                    2⤵
                                                                                                                      PID:5568
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:4264
                                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                      1⤵
                                                                                                                        PID:4988

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Matrix

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                            • Size 595B
                                                                                                                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            0g1ohL6OQy1T.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\0g1ohL6OQy1T.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 166972797764ed7db17d43b83ae9f2d1d83a1b0ccd1b7b1ce640d2ec4ac8c4c8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            1d3TWilI28sm.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\1d3TWilI28sm.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 578206bd9f030f05d679a3ab51e0e005a549f9f734d01c92c8564fb40381b03b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            1fNv2cvXZWwU.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\1fNv2cvXZWwU.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 73157695938aaf8891c08211222169dcdb6540a2ca15d7310aadc58ef237b0b6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            5hyCuLPIK7Yx.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\5hyCuLPIK7Yx.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 6ddf59441c13f6dc86db9a81691a946d679c2a15668e585cc942f8831f685df0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            8cd6vGV8oC1Y.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\8cd6vGV8oC1Y.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 7c874d35684da4d9c74a70d02288240fe47214a4d7b0d00220715407f84cd53e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            AXJJMzfoRQvr.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AXJJMzfoRQvr.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 3f89f2141706c81acee0add1f337ab653db4cd2a69770e134edc3c568c9ae16c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            DTyfJARq8Ces.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\DTyfJARq8Ces.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 69d5c0fecad6524e5f4c0c0a8b8975f16109c81f45cf1202ea49d6c393dc9cc2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            JNHMb6R65m8I.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\JNHMb6R65m8I.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 0e2ff64e95a874171f848f4f8250b4e3dee01a3bec9c16ea5ee12c67cbedf954
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ObxiNqUH1aRh.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ObxiNqUH1aRh.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 340b2320742819dfbdbbb39227e78a9f45e5994247ca9647fc90892a64ab743f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            UUhNsLklitoI.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\UUhNsLklitoI.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 f93e0f194387f8e4eac653bfa68572be7baa93b1540d53435f6b7d7bb01bdac1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            bQY5fCXdAjJQ.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\bQY5fCXdAjJQ.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 5daa786577fc1a0cced9c0f7f94dd6cf5789e4fa837e63aeb89a2913404f4a5c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            e5Wk47TzNtrq.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\e5Wk47TzNtrq.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 36e51a0a3b6640a2020e8254de0e784b05e6a141549344b0c0801e60219a84aa
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            e99sqa7sAE0w.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\e99sqa7sAE0w.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 17d0c0d1e63272e22c7658fbeeee620519551ca9f0403bd2a7f7e7ce6bf2b9f7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            irNV0r3CG4Mc.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\irNV0r3CG4Mc.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 20fe335fcb9a8ee033a3c8e648acd49913188ee0b943db0824d185e37cdafcfd
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            mvzPpw0bMmaA.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\mvzPpw0bMmaA.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 31710bf49d431a1470a961c602f979dc67453148b07d59d66bb4b4efd36c6f10
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            oLKuOLkYqLSe.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\oLKuOLkYqLSe.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 2573e54c177a0c70334a221ce91cd2bde5834d8a0fbeb19aa0cf64840b562ca3
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            wMKy7ADI3Iva.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wMKy7ADI3Iva.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 01f88757d66dceaa7006670198e76be42bd739288fe5d26a8a32600b936edfa0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            yoI6tAcQeErB.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yoI6tAcQeErB.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 29e56a6769c143c9731c9b6ce61943484877f882ae10b8c18967a8fb02524251
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/1456-26-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-30-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-27-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-28-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-29-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-31-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-32-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-25-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-33-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-34-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-35-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-36-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-24-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-43-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1456-23-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-13-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-1-0x0000000000B40000-0x0000000000E6C000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-14-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-0-0x00007FFD67DAF000-0x00007FFD67DB0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-12-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-11-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-21-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-6-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-2-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-3-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-4-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-5-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-10-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-9-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-8-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2708-7-0x00007FFD67C20000-0x00007FFD685C4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-108-0x0000011AE02D0000-0x0000011AE03D0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-152-0x0000011A93840000-0x0000011A93860000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-121-0x0000011A93000000-0x0000011A93100000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-107-0x0000011AE02D0000-0x0000011AE03D0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-120-0x0000011A80AD0000-0x0000011A80AF0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-138-0x0000011A80D30000-0x0000011A80D50000-memory.dmp
                                                                                                                            Download