Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    61s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 16:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260711-vgehsshv5x
  • SHA256 c110c7c1e2ed1ba9def71a3f52b2e0f2472bab963883cda542370ec07a9bec98
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • xoilac-worldcup2026g.com

  • malware.xoilac-worldcup2026g.com

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3128
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0kAhOgqS5lku.bat" "
      2⤵
        PID:4228
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:4284
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:1268
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fpzKrz1w47QR.bat" "
                4⤵
                  PID:4964
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:4812
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:2232
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g8cFFlxD9snm.bat" "
                          6⤵
                            PID:2924
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:3484
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:4140
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G4rqTsXDBLwz.bat" "
                                    8⤵
                                      PID:4500
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:1700
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:1844
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hvs3cUfo1AA6.bat" "
                                              10⤵
                                                PID:824
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:2804
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:2260
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ADZwH7V6vZUY.bat" "
                                                        12⤵
                                                          PID:2348
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:1128
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:2760
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IDe9YaP84tB7.bat" "
                                                                  14⤵
                                                                    PID:2440
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:5804
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:5808
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Yz29FodkI7vM.bat" "
                                                                            16⤵
                                                                              PID:4876
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:4060
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:4260
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1mYAUzTjVyC6.bat" "
                                                                                      18⤵
                                                                                        PID:1080
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:1108
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:2496
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8TnTAepEfDZk.bat" "
                                                                                                20⤵
                                                                                                  PID:2360
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:4804
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:812
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WgEYzLrVbyQq.bat" "
                                                                                                          22⤵
                                                                                                            PID:3812
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:2200
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:4216
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vKlJvIDuowpW.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:4492
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:3336
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:3496
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dJjUe1vqm84N.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:3176
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:4220
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:6124
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sXOyrN9249PZ.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:5228
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:5412
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:5220
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4VBsRGp2imac.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:5748
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:1328
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:5548
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TDNui4R3xYiC.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:5976
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:4980
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:1700
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XHZ1tkyxBUjt.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:5156
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:5864
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:2332
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lLz9YJYEmMag.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:4788
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:1516
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:6080
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PVY31cot6wNp.bat" "
                                                                                                                                                                                          38⤵
                                                                                                                                                                                            PID:1372
                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                              39⤵
                                                                                                                                                                                                PID:4200
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                39⤵
                                                                                                                                                                                                  PID:5028

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Matrix

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          0kAhOgqS5lku.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\0kAhOgqS5lku.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 6535f65c1df7c3a38ffd8bc85fcb75a0aff29e136dee984b542b6ec17a338305
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          1mYAUzTjVyC6.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\1mYAUzTjVyC6.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 2cfae2a722a5fc242cf964c95b0beef977c338ceca0da84bee8a1134ec44b6b1
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          4VBsRGp2imac.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\4VBsRGp2imac.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 2006715c91d252d4bdbdf2c825ad0cc10392759e5831caf3a8a7960b783405d1
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          8TnTAepEfDZk.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\8TnTAepEfDZk.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 0fa9686e20208ef65e053527e3cc360c96fe02695b3a2d7470ef1a1d79d7855b
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          ADZwH7V6vZUY.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ADZwH7V6vZUY.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 0d09c4528392bb74304b004f9bdbef850e5bf093169edfc64cf4a4e819c06cef
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          G4rqTsXDBLwz.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\G4rqTsXDBLwz.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 e0568c700848a1f84899855b921486ecfff9feaf8f8ebcc5a984cbc42cb934a5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          Hvs3cUfo1AA6.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Hvs3cUfo1AA6.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 fa35daf6f727976845de9a7a2503e20b153cc14be84357cf32fc00daa7d6d024
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          IDe9YaP84tB7.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IDe9YaP84tB7.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 25d265f768d510e2c3913062fd33225c305f09f069bd985cb318dcf1c843303f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          PVY31cot6wNp.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\PVY31cot6wNp.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 05b6f3de8773ff87092f7a01f67ae8e6a8f518ba7d4de7dd295e079ce5a7bbd5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          TDNui4R3xYiC.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\TDNui4R3xYiC.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 3c32d78549257257b93e4ed7c09a53afe0b031f55fbfb30d78e1ab25c58226dd
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          WgEYzLrVbyQq.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WgEYzLrVbyQq.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 75a6b917caefec8ea2fb5892eeb787a4d332772230d2ef3e7cf7a2a6b672db06
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          XHZ1tkyxBUjt.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\XHZ1tkyxBUjt.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 b3797eb4d1d93abe3fe32e883a90a9ff8cfdbbcbd1b60007e74a69965b28031c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          Yz29FodkI7vM.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Yz29FodkI7vM.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 370b027c7c872a5e0735ea906cee58c471a6c0597d0889708252b32c27746ca3
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          dJjUe1vqm84N.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\dJjUe1vqm84N.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 65f3a0704230dd6428ac812fbed82b7e3af12df72805e856a58c814797ec6768
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          fpzKrz1w47QR.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\fpzKrz1w47QR.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 ddd0f93f28c9604da7c3bfed7a4f1b64564671eabe9b4176a55bba43a2e5353c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          g8cFFlxD9snm.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\g8cFFlxD9snm.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 1ec5454275031efe486de8b9b0bcb67b722c48df1d324489bafeb083ad5e2305
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          lLz9YJYEmMag.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\lLz9YJYEmMag.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 03b867f1ec2540fadd468b89af450872458ebb0f65c67af3417cfba28ea4f55c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          sXOyrN9249PZ.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sXOyrN9249PZ.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 a81f5620c9cbbb3d79f99116c4b626f7470c7838f05e6e18126306305c715957
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          vKlJvIDuowpW.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\vKlJvIDuowpW.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 8665bd3a140d04f143607d5c04a47038d8063a41832364ba83db37b360b5b2fd
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/1268-30-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-23-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-27-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-28-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-29-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-26-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-31-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-32-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-33-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-34-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-35-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-36-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-43-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-25-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1268-24-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-8-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-7-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-14-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-13-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-12-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-11-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-21-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-10-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-0-0x00007FFCAADAF000-0x00007FFCAADB0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-9-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-6-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-5-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-4-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-3-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-1-0x00000000000C0000-0x00000000003EC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3128-2-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
                                                                                                                          Download