Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    61s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 03:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260712-eawwhacx3k
  • SHA256 89087fc3b15582ac1bd97425011baad9a70f2781bc49802220610c25df92c240
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • porno-buch.com

  • malware.porno-buch.com

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5492
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aHqa72rjKvi0.bat" "
      2⤵
        PID:252
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:1220
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:4156
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5jEyHGVNQhIv.bat" "
                4⤵
                  PID:5140
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:932
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:1984
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\llPQ9xJifihQ.bat" "
                          6⤵
                            PID:5780
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:4744
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:3304
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAdnYHE7ptPa.bat" "
                                    8⤵
                                      PID:2168
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:2920
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:2860
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\29Dkuye47HRb.bat" "
                                              10⤵
                                                PID:1788
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:5024
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:4284
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G4rtBnpLQ8E9.bat" "
                                                        12⤵
                                                          PID:2988
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:3420
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:6080
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OfEFpNJ97ndK.bat" "
                                                                  14⤵
                                                                    PID:3484
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:5760
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:3932
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UyLDylEzmorp.bat" "
                                                                            16⤵
                                                                              PID:2160
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:1084
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:4168
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2jd05NLyKLO3.bat" "
                                                                                      18⤵
                                                                                        PID:5836
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:4924
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:4124
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bSTgjGHRs7y0.bat" "
                                                                                                20⤵
                                                                                                  PID:2816
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:1528
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:4472
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GLn2vJpCiCKu.bat" "
                                                                                                          22⤵
                                                                                                            PID:1112
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:3224
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:5668
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R1j1gwvBtpgY.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:4528
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:3308
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:5260
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BsWNKVVrAOCQ.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:1188
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:300
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:256
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4liruYY1npy5.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:5484
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:4780
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:2964
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CRn8Gsuxnymf.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:5416
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:5060
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:1136
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\48RrebPufmck.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:2744
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:5548
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:1280
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6zYfWT2zmVsI.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:4956
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:1948
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:1472
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PlCMPV5BpmEg.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:4180
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:4536
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:5384
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uPN1bB72YVvg.bat" "
                                                                                                                                                                                          38⤵
                                                                                                                                                                                            PID:4140
                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                              39⤵
                                                                                                                                                                                                PID:2916
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                39⤵
                                                                                                                                                                                                  PID:5336

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Matrix

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          29Dkuye47HRb.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\29Dkuye47HRb.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 985972ffc3f1100d0ea6ecf454327c0861e6ede9f7841341655eb9ce9097e9db
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2jd05NLyKLO3.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2jd05NLyKLO3.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 af77b15780cde563b58fce3dfc44f8111ecd57bc19d68e9797992f83e9d7a61b
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          48RrebPufmck.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\48RrebPufmck.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 85ac6fb4201692bd9525a821e627dab059649dfd46cd8cfebc602a0939d80813
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          4liruYY1npy5.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\4liruYY1npy5.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 6fbe93ca10dbc3b5a2ff4f0a3cddb99da47efad5398de19843fdd0e490b66f38
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          5jEyHGVNQhIv.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5jEyHGVNQhIv.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 ecb3be0782aa187a85baa23c372fd09d02f8d33aa28b075144f25cc49d621933
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          6zYfWT2zmVsI.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6zYfWT2zmVsI.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 28c7c60c45f0513aeb79cd638acf1229d3387373b8d96092ff95a2d2984a9f07
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          BsWNKVVrAOCQ.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\BsWNKVVrAOCQ.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 66872da725518e4e23410ee7c86140369e7777e74e34b6bd7162a86230540ae8
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          CAdnYHE7ptPa.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CAdnYHE7ptPa.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 ff0ee41fa130c3548f2ac9b96cb688b6e17916b07fd524ed7d33321f0cd4cf19
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          CRn8Gsuxnymf.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CRn8Gsuxnymf.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 2bf05d59709095a947a933c22dc98d428817e2267e0408537c553bd45d04ff33
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          G4rtBnpLQ8E9.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\G4rtBnpLQ8E9.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 ee37a90b451e277c5d22d41b701d34f55bb1ac06d1cdfd04ac1a363926d1e32e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          GLn2vJpCiCKu.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GLn2vJpCiCKu.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 70748c347effc1cc681f454e835edc1804567b588f8afa790f11b52b83608718
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          OfEFpNJ97ndK.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OfEFpNJ97ndK.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 e8d6058cf192ede68b119068bd8f2eaf18d3ad522afd334c3cb377889ddd7a49
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          PlCMPV5BpmEg.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\PlCMPV5BpmEg.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 5621ddb6132195a9907f1867ca878f4c7d359ba9e65b89e7684241620f5d8774
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          R1j1gwvBtpgY.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\R1j1gwvBtpgY.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 68628820df833b3516be2247d20af4b29f02c859b67935c69eee8d70746e353a
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          UyLDylEzmorp.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UyLDylEzmorp.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 bf0c9dcb254dbb534acb235221fb75f9a2dc6b037bf0b77521a6a415e2bbe326
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          aHqa72rjKvi0.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aHqa72rjKvi0.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 43b7fdcd72812290eab27e15ee9bfb36cc2ccaf978f9014f312f44e3f5a4c8a6
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          bSTgjGHRs7y0.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\bSTgjGHRs7y0.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 999353cd9bbe8a41f6981909e272b6d50f3cbbe5ab1df386c78b664751edec88
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          llPQ9xJifihQ.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\llPQ9xJifihQ.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 54cbf2c92b223df6286e1f6bab9d65827aca097e24978e7bcb8dccaf0471b6a1
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          uPN1bB72YVvg.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uPN1bB72YVvg.bat
                                                                                                                          • Size 185B
                                                                                                                          • SHA256 208e886722cd7dd6c17fc792d1e5e52673a823be9d8de42d1cefb062dcff221c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/4156-30-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-23-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-27-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-28-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-29-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-26-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-31-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-32-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-33-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-34-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-35-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-36-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-25-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-43-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4156-24-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-8-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-6-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-14-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-13-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-12-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-11-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-22-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-10-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-0-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-9-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-7-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-4-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-5-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-3-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-2-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5492-1-0x0000000000AA0000-0x0000000000DCC000-memory.dmp
                                                                                                                          Download