Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    63s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 00:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260710-ajnt2act7y
  • SHA256 85b03313465a137a440676d938b9c4829f592a54e3cfc1dbf178430bb942caa2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • xoilaczzwwz.tv

  • malware.xoilaczzwwz.tv

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5572
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SZa1Wma7mwM3.bat" "
      2⤵
        PID:2768
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:2296
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:6060
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rZ8RFZfHTwbd.bat" "
                4⤵
                  PID:3020
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:248
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:1728
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oLXCdmOXx2Xg.bat" "
                          6⤵
                            PID:796
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:4204
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:1812
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tT1fpWx88aDR.bat" "
                                    8⤵
                                      PID:4504
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:5856
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:5912
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hY27fjByZf6y.bat" "
                                              10⤵
                                                PID:3732
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:3464
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:5804
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eCVWzliMIGmO.bat" "
                                                        12⤵
                                                          PID:1968
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:6104
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:4884
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1GXso0pZoWik.bat" "
                                                                  14⤵
                                                                    PID:4224
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:5428
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:1052
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\V2jmTVkHUCZL.bat" "
                                                                            16⤵
                                                                              PID:4356
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:3232
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:5112
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bZ4WMJ0n6VH3.bat" "
                                                                                      18⤵
                                                                                        PID:4912
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:2496
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:2112
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5vjk4kFBenoA.bat" "
                                                                                                20⤵
                                                                                                  PID:3352
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:4532
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:5564
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o7wJiJCoigPK.bat" "
                                                                                                          22⤵
                                                                                                            PID:4436
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:1540
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:3536
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B5aPOdjvKg5T.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:5972
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:5348
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:5616
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E6rfaHtKFcRy.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:4872
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:2772
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:3496
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bwFNUxhesHAU.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:1096
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:248
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:1756
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\K5Xy1Ug2tcW8.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:404
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:2724
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:2756
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QNSYALfcRYN1.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:2564
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:4996
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:3176
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\txcQSq9dagmJ.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:3756
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:4580
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:5636
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wzLhExt2aCJu.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:4488
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:6044
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:4352
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PdLgFh7ot0uB.bat" "
                                                                                                                                                                                          38⤵
                                                                                                                                                                                            PID:1324
                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                              39⤵
                                                                                                                                                                                                PID:720
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                39⤵
                                                                                                                                                                                                  PID:2092
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SHfsJYY4HVcw.bat" "
                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                            PID:2996

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Matrix

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                1GXso0pZoWik.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1GXso0pZoWik.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 8c42876fee5a13b0a70cbc3a00b52296ec44db52a7e19b833fa7310454f0ce0f
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                5vjk4kFBenoA.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\5vjk4kFBenoA.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 a9d30265f65780b8ec174d4f078ca45cc3376db273b7d9f9b2bfee8a165dceff
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                B5aPOdjvKg5T.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\B5aPOdjvKg5T.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 e89d1ae64a0d03582d012a67ec54f8446d559622a3810066e63d3c72c9a3b692
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                E6rfaHtKFcRy.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\E6rfaHtKFcRy.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 d239bdfa4ddf4cad0b9af0026c16cdc23c5435c40862c94db80e1ee50b6c19d5
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                K5Xy1Ug2tcW8.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\K5Xy1Ug2tcW8.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 fc198b28c4f5ab876a5c0ff1e0d33c35da1bf29313a25e0c95f2f4e2d63e7cd8
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                PdLgFh7ot0uB.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\PdLgFh7ot0uB.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 c6226f9ebd81eed91dadcf290ec1678630ada72b2a96a6d8b80890b8ee8807a1
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                QNSYALfcRYN1.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QNSYALfcRYN1.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 0eba3174cefe95ee97a70afd06c99fcd5e83a094c164e87bbe54a9fc49be60b7
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SHfsJYY4HVcw.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SHfsJYY4HVcw.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 5b1aa78b2b7becd9c279f658079ece6fd83ee866860ec7d200240a918da308a6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SZa1Wma7mwM3.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SZa1Wma7mwM3.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 581e06ef157758ffe42935e40fa503622260eeee5a9d5923a8d988a8ae3e8932
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                V2jmTVkHUCZL.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\V2jmTVkHUCZL.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 9a1445530203070a0ba4580f3396d7ef8ed185d5c0ddb1bd9f0cd4f60f38d02b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                bZ4WMJ0n6VH3.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\bZ4WMJ0n6VH3.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 32f0ea79bab90d2c208ff4874103409dd60b740a785fac2f709442cf50013a92
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                bwFNUxhesHAU.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\bwFNUxhesHAU.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 b0f5a127ef5bbd6e33109ca618dc30b421d7d807580c337d11555fd648e2b875
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                eCVWzliMIGmO.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eCVWzliMIGmO.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 f481b3f0e49d42eb70ef66decd6563f225c95eaa3be3bd5ca25d11a10fd42ea2
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                hY27fjByZf6y.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\hY27fjByZf6y.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 fb6a5225dbcfbc1cf689cb07759abfc741ddb117cf13e39e9b50387414079d36
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                o7wJiJCoigPK.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\o7wJiJCoigPK.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 5ee330e3e3818e02fe67a6af3bf300f1eeaa917908e829b53cd536cf8a3c6292
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                oLXCdmOXx2Xg.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oLXCdmOXx2Xg.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 7f32d1096bc2065d606f57bc029c4c60b07faa820fa87352c04705429d43fd75
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                rZ8RFZfHTwbd.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\rZ8RFZfHTwbd.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 d2196c1079aa597e66dc18024a2af66b6faf493537a9d416c08b02d387bd5c2e
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                tT1fpWx88aDR.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tT1fpWx88aDR.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 d633505d28066018657fc61ee7f91445fd26f7d9c46a04f20712a65c8398b9a9
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                txcQSq9dagmJ.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\txcQSq9dagmJ.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 c7b57bdee44de2caae2fd3192e33f5b39184dccc7c13817d48a7516f0cb27da7
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                wzLhExt2aCJu.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wzLhExt2aCJu.bat
                                                                                                                                • Size 185B
                                                                                                                                • SHA256 c526aa73e7988760a46fdaf32ced911cb3c9f7d36702a790302633b2197f188c
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/5572-12-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-6-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-1-0x0000000000100000-0x000000000042C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-2-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-3-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-4-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-5-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-22-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-7-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-8-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-9-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-10-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-11-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-0-0x00007FFDA502F000-0x00007FFDA5030000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-13-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5572-14-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-34-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-23-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-24-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-25-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-43-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-26-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-36-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-35-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-27-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-33-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-32-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-31-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-30-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-29-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6060-28-0x00007FFDA4EA0000-0x00007FFDA5844000-memory.dmp
                                                                                                                                Download