Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    62s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 03:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260709-drn2jsb19q
  • SHA256 eeff39a3c0347e4752cec12ed5413c4a07b8ae952d37268e2d194a608baf0af0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • xoilacxxt.cc

  • malware.xoilacxxt.cc

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3012
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4XJ6SsVhqAni.bat" "
      2⤵
        PID:6060
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:1096
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:1980
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yrvaGMB8HyDC.bat" "
                4⤵
                  PID:5796
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:1588
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:1092
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sWRhZJlecH5J.bat" "
                          6⤵
                            PID:2128
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:2608
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:3804
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oUqOnqTctZBB.bat" "
                                    8⤵
                                      PID:1680
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:1560
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:5684
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0t09curjcNZv.bat" "
                                              10⤵
                                                PID:5840
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:1968
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:1144
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ySXelqtc2dRr.bat" "
                                                        12⤵
                                                          PID:5868
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:2892
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:2784
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZoY161JsOwTQ.bat" "
                                                                  14⤵
                                                                    PID:2668
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:1140
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:6036
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8fewR92cVoDS.bat" "
                                                                            16⤵
                                                                              PID:3380
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:3880
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:2876
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XBT3ueDpvi0x.bat" "
                                                                                      18⤵
                                                                                        PID:528
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:2984
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:3208
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zz87V57Qssz5.bat" "
                                                                                                20⤵
                                                                                                  PID:6004
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:1484
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:1596
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VlgLhQzvPYzz.bat" "
                                                                                                          22⤵
                                                                                                            PID:2508
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:5652
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:5672
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PNDImSXLVn4U.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:2340
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:3336
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:4832
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\frtbbbDuGlki.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:304
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:4732
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:5088
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Wp6YQLQkUmlC.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:1588
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:560
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:988
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cooLYpX8e8MI.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:4496
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:2924
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:4984
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YBJ51cuPFNmJ.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:5276
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:5740
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:3104
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmC2WIYbUUsL.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:6032
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:2752
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:5424
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KtJZHhgtY3Ny.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:3724
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:4360
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:1632
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z7FASKOXh11c.bat" "
                                                                                                                                                                                          38⤵
                                                                                                                                                                                            PID:3864
                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                              39⤵
                                                                                                                                                                                                PID:5272
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                39⤵
                                                                                                                                                                                                  PID:6128
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aSDYyRjWGkPX.bat" "
                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                            PID:6048

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Matrix

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                0t09curjcNZv.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\0t09curjcNZv.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 9f18310ed3859fc8063d6d0c7cff10a4a417654ee4a0db6a11be6750babac645
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                4XJ6SsVhqAni.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\4XJ6SsVhqAni.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 aef715bf4c8bc7df2b302e4c746d8de9430e7206552b7c751a613e8ebd67cabe
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                8fewR92cVoDS.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8fewR92cVoDS.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 70d9af657a1ba8592f8b9c8e279bff536a03475ec8b57cce6f1d90927270671a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                KtJZHhgtY3Ny.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KtJZHhgtY3Ny.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 2d31bb393b8d132fb02a9e9686d1a7dc91ccd8982c22caca14c5a0463506ce10
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                MmC2WIYbUUsL.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MmC2WIYbUUsL.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 511330a7be3e2b05aabb6ed368e2ae3766cdc29ec3d33ff1776b9e0d565325f2
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                PNDImSXLVn4U.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\PNDImSXLVn4U.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 f718179359d6114627765eb2d8dff0c2e96586ca5117e3435fc0127e544cd373
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                VlgLhQzvPYzz.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\VlgLhQzvPYzz.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 e172afb0bfd846e0506dad798faa7e48e2a6a6b2082ce4d776f10d9f61e4c924
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                Wp6YQLQkUmlC.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Wp6YQLQkUmlC.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 3c079a91fa1b0101be62131de3be535017048a48242389079038ee4dc722ffe8
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                XBT3ueDpvi0x.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\XBT3ueDpvi0x.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 6fcdeb60ee308cb6244d6cbe3e10f9f30a03b393ab75cb231e1938e13e4be81e
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                YBJ51cuPFNmJ.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YBJ51cuPFNmJ.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 47d8ae7b94815641ddbff383f0ac1bd3a6d8f61aca75ddc25552b03d90a99472
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                ZoY161JsOwTQ.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ZoY161JsOwTQ.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 983c70faa4952f3ec994c39c73e7b6c7cd6769e09c4d03b07e1c16a4cfcdb29b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                aSDYyRjWGkPX.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aSDYyRjWGkPX.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 41a82db4b94da95a8b99d293bd8b70f4cc691a927e7e9c6859d0d9dcca78e4dd
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                cooLYpX8e8MI.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cooLYpX8e8MI.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 2c9d1ff48f3261fcd6a3b35a5010cfb054b5ad62d161c580753ff55087b8ec34
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                frtbbbDuGlki.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\frtbbbDuGlki.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 4f3be882b4cffa669691d020ceae7f19978a07b67cde2430f7174af67950ea6e
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                oUqOnqTctZBB.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oUqOnqTctZBB.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 2b3913547d963ccf2c5f5a6221291de3ae6eec0a19b1d01e3693a0464b10b477
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                sWRhZJlecH5J.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\sWRhZJlecH5J.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 36b4936899e46a065a9d230c9d0679ab5f219eaac1308125fd08b899b8093e8a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                ySXelqtc2dRr.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ySXelqtc2dRr.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 71c4ed44d37b0cc61b826a0ead88f7e8242235f20f8df89bf50c8b35934a7a7c
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                yrvaGMB8HyDC.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yrvaGMB8HyDC.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 273ef875f8601c31b46999c50f4897cb53cd00c55d77fab763ddaa412b841a34
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                z7FASKOXh11c.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\z7FASKOXh11c.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 061a3e436015ae7585f39bd087e3c8bc7537e41b82ed19a7851f4fe42814a6d2
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                zz87V57Qssz5.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\zz87V57Qssz5.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 a92b404b3eef326ea58f131ca665fad922402cf0ed9d1eb46d5046c6134c176d
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/1980-30-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-24-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-28-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-29-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-27-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-31-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-32-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-33-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-34-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-35-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-36-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-26-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-44-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-25-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1980-23-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-8-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-7-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-14-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-13-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-12-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-11-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-22-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-10-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-0-0x00007FF8D55FF000-0x00007FF8D5600000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-9-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-6-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-5-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-4-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-3-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-2-0x00000000001E0000-0x000000000050C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3012-1-0x00007FF8D5470000-0x00007FF8D5E14000-memory.dmp
                                                                                                                                Download