e1f179df4b7c946e7161d61da71c136c2ddd203434f6cd926556894b48c712ea

Analysis

max time kernel
299s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OficioDigitalPCPA.exe
Size 54.0MB
Sample260511-wref8abw4j
SHA256 e1f179df4b7c946e7161d61da71c136c2ddd203434f6cd926556894b48c712ea
MD5 0ff35344478cec5e62b5ba644c5780e1
SHA1 a060ee81b9a3624555f63944bc7a82339daf514d
SHA512 f9b4ec438fd45e7a8bab667bfc5ed6cd51202088f50a44f52acdc6f60755aed4ba6bd5f7b61fd986f11591918f1831ab55db91a1cfd4425ce8cfa2b4d975a0cf
SSDEEP 1572864:TZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkYW:TZTVLZuFbQlPjs+X
TLSH
T17EC73337F298993FD12497315AB28165553B7A10BC02CD4E92EC78D8CF762A13E3B64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\ProSoftxUltraToolator\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\ProSoftxUltraToolator\\Grape.exe"	Grape.exe

Executes dropped EXE 9 IoCs

pid	Process
4204	OficioDigitalPCPA.tmp
1116	Grape.exe
4776	Grape.exe
2076	Grape.exe
2984	Grape.exe
4816	Grape.exe
484	Grape.exe
1320	Grape.exe
1980	Grape.exe

Loads dropped DLL 14 IoCs

pid	Process
1116	Grape.exe
4776	Grape.exe
4776	Grape.exe
4776	Grape.exe
4776	Grape.exe
2076	Grape.exe
2984	Grape.exe
4816	Grape.exe
4816	Grape.exe
4816	Grape.exe
4816	Grape.exe
484	Grape.exe
1320	Grape.exe
1980	Grape.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OficioDigitalPCPA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OficioDigitalPCPA.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/3980-1-0x0000000000A70000-0x0000000000B58000-memory.dmp	innosetup
behavioral3/memory/3980-334-0x0000000000A70000-0x0000000000B58000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2076	Grape.exe
2076	Grape.exe
484	Grape.exe
484	Grape.exe
1320	Grape.exe
1320	Grape.exe
1980	Grape.exe
1980	Grape.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4204	3980	OficioDigitalPCPA.exe	80
PID 4204 wrote to memory of 1116	4204	OficioDigitalPCPA.tmp	81
PID 1116 wrote to memory of 4776	1116	Grape.exe	82
PID 1116 wrote to memory of 4776	1116	Grape.exe	82
PID 1116 wrote to memory of 2076	1116	Grape.exe	84
PID 2984 wrote to memory of 4816	2984	Grape.exe	87
PID 2984 wrote to memory of 4816	2984	Grape.exe	87
PID 2984 wrote to memory of 484	2984	Grape.exe	88
PID 1116 wrote to memory of 1320	1116	Grape.exe	90
PID 2984 wrote to memory of 1980	2984	Grape.exe	91

C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe
"C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\is-KTJ5TBQLJ4.tmp\OficioDigitalPCPA.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KTJ5TBQLJ4.tmp\OficioDigitalPCPA.tmp" /SL5="$70276,55365982,887296,C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
    "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
      "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1752,12211829424777848580,6151458576138910632,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1748 --ignored=" --type=renderer " /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4776
  - - C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
      "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=utility --field-trial-handle=1752,12211829424777848580,6151458576138910632,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2188 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2076
  - - C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
      "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1752,12211829424777848580,6151458576138910632,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
  "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1764,14144877625621343288,5148761725718159739,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1772 --ignored=" --type=renderer " /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4816
- C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
  "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=utility --field-trial-handle=1764,14144877625621343288,5148761725718159739,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:484
- C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe
  "C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1764,14144877625621343288,5148761725718159739,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\D3DCompiler_47.dll
Size 4.3MB
SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
MD5 fea40e5b591127ae3b065389d058a445
SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
TLSH
T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\chrome_200_percent.pak
Size 312KB
SHA256 cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a
MD5 bd66e8de6979dfe12cbaa29390d11a64
SHA1 967916eb7587f0163fbce50c7b4822d06e939d5a
SHA512 f77bd5004d8da54e8588ffcf6962b3244b8e4a9f6310d31f0c7c44d913504577c9e3fb858078705c384649fbcf26223d8f98dd02778e259a8924028f2be3bc1c
SSDEEP 6144:8DQYaR+9bITNNz73QYV85u/oFYvwoytKi6obByPGlPFYKKo+:RfIITDg5u/oFFpxLlFYb
TLSH
T1C064F1E6F3F4AC3CE9971E3351560AA3DD7711350AB7434AC28AAC343D56B9489C938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\ffmpeg.dll
Size 2.2MB
SHA256 1a5ea394d48ec44bdffc87a0a414553acd7496058546fda51f2aa7afc774d277
MD5 8b9523d7903086ac856883180ebacb62
SHA1 2dd60ab51c395faee96d3ce88936124c6cb8cdb1
SHA512 5047265d676c0422d48466fd670f406e4cadb1f673b3caca14fe475e710949f8daae3acf4ed59a1e0a4aec322761bd1f606eeabc39b37e6b9a4f523635a33be4
SSDEEP 49152:+spMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRtL:+4b2aux6LNbHD
TLSH
T1BCB5AF07F5FA00E9C02AC27487ABA633FA367C4A4521772F1690A6253F7BF905B5E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\icudtl.dat
Size 10.0MB
SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
MD5 3f019441588332ac8b79a3a3901a5449
SHA1 c8930e95b78deef5b7730102acd39f03965d479a
SHA512 ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
SSDEEP 196608:gmXwSv9AAQMlptodliXUxR0rHf93WhlA6tnoB:gjKlQMlpgliXUxR0rHf93WhlA6tnoB
TLSH
T167B62846B2EB4EC2F9FBAE70D9F463675426BC016E31815946042F3B1C777E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\locales\en-US.pak
Size 75KB
SHA256 3333cf1fb2b0c15ea819787ba672d2274f3136e6a8729f2e5d2796b740688183
MD5 a2201115723fd61d1e68ab001e6cdca0
SHA1 a97073e22adf7b300e702e717743cd249e64b4fb
SHA512 e68c451602a0c2cd47ee3652daf1d74d87e6e61ebda9166cbb182301f03118b72288968695f85a1bcdefb45e4753ba7187dd5159b6694952f33238af39d89479
SSDEEP 1536:2GBj+Xuwnu0fzEphzDiQ2trhu5uBlgfSOqJedMprkhxv+fDgglgqfowv:2yqXJtzEphSBBlgm+xKgglgFwv
TLSH
T1E2734D5BE3C42235059303627A0377A6AB25E0A967521197BC9CC16C33B7FE4C2776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\resources.pak
Size 8.9MB
SHA256 7b2bccc7c2469d516116e9e9fb3ef9ee397ac98508ccd4f3f6714b7ccd1b9c3f
MD5 fc8c0d2bf591195c8a7ec32b034d3ba4
SHA1 58ada360ee3482b424a8b876446d864ba02e7b7c
SHA512 46d033b476963310fe7386e4ad764ec583d50cc1df2e91e1ae0660f50ee7bad624fa146d867659f6bdb1072f34d2baec466637233e45b5f6df05201a51049dbd
SSDEEP 98304:mOdRYaPrtXSElgA1hMoJm7bgGMy6NFfwbPPs:mOdRYaPrtnWahMWmbl6N0Pk
TLSH
T1ED967D573255103A82DA86FB64BA0603BF376046B41090BCF9ACDDCD5BEED429277B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\swiftshader\libGLESv2.dll
Size 3.6MB
SHA256 f1d11680aeba15d3f31fd3982da7a78b460705fd54e6033fd791e5298cdbfcd5
MD5 5d71cefb8378b025f941eba3ccf328e3
SHA1 e6de9c0de7e2c9157bbd4c01f26d2fde6f34e9f4
SHA512 65fdeda1239de431ba4694123ee136f035b21d635d1e17982690e2103d04632023c82571d467dc2fbb349eb8f36765cbaff5e0ea93bd49b64a7fb797bdd79120
SSDEEP 49152:UE8gY3DuOpn+em8kINB/2xPkhDZ0SmDxcJtaRL96Om9MQ0xehKyRGZP+mt1G3eWE:i7GkhDpoWJtaPm9MQ3cA3
TLSH
T12006E803D66F90EFE056EA35971BB332D1B578C574387976676239112BE27202B3B388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\swiftshader\libegl.dll
Size 392KB
SHA256 91e118f71d5605b24d58002f152fe7bfe95af85a0027076a944c62609357e16e
MD5 a686afbd8b63a663ab6af10ae14b4f38
SHA1 76f1d873233dc5a2ffd5ed8b003614825755236c
SHA512 b5307e6b254491cbc11bd18395036604ac333f65ee3d64cbd62f2f12bb615f080f1740c3e55e69e3758fa19daefcb8b9bd3cbe19956b77e7ca7a539a7c9ccae5
SSDEEP 6144:C3lNvD9dUn+x5WiqCff0vDixSx9+6ipIJqH48rrAtaWL0W:C3lNvxdUn9iqCfsFcIJqUtar
TLSH
T1FE847D16F7A048B9D067C034C9278A42DA71BCDE0F65E29F2395425E2F77BE49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\v8_context_snapshot.bin
Size 607KB
SHA256 172d37f02295e53a548907baac6eb33b3c2acaa49c1008bae27acf3a1a0d1c1a
MD5 059c46a6c2a64b3c787d1479cd1e28a6
SHA1 93ab53fd9ffa4822a7c2bf33b3248863bef1abef
SHA512 aec0893b15e3df8c459b3d3c4710d8b0df6809f10dd3138ac0abbee1abe58743a47a31a46c327b8724a34de54b465dc6dfc24d458242cbf335dfa5805dc8a774
SSDEEP 6144:wdBNIyNEDV3VySacNOOU/coSWoiC5/8N2vEtncL+S+3:wdBuLDV3c9cL5m2oHS+3
TLSH
T181D4A454B761EF8BF336817A56C15BA036A4E0441F01BB5B53684FBD3C2FA210D29BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\is-97HST0J874.tmp\chrome_100_percent.pak
Size 175KB
SHA256 65cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f
MD5 3ff806f44723cee528a1aaee4d3a289e
SHA1 56830e7ff31f803077aed774fafebd4e6c5e6c90
SHA512 03dafb839308d644a9943ba66838536fbd1f606cafe392f90925ce51766b5e3a9064d60ca8463bacf7238258beded570d5a0007f3ce11c14f87b10faa2da2977
SSDEEP 3072:ISzwVnp8YdJtroNdX2w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJsgfI:ISzwVSTNhx5c1YC7x10fSucY7OP2ITQ
TLSH
T1EC04D0E3B3F0AC7EE65B0A3375550B77E93B413506A30309C28689752D5AB80D9DD78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OficioDigitalPCPA.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KTJ5TBQLJ4.tmp\OficioDigitalPCPA.tmp
Size 4.2MB
SHA256 e607637b946940c09fd8e1b440cb323ef4c028e985607cba74d342ad7e02dfed
MD5 33aaf6cb9b7065c0548a056bfbbb6417
SHA1 b845b2a934dca2b320ac03df71821031f1a16ed4
SHA512 e6c09067ffac9cdfcb3837a932bbcc4216dcb7dca92a4d8d50a4d8e98a471b97d94dcd7b7088ab948f36677ebef8d541918b30c49d20db3d8e26bc2185508cc6
SSDEEP 98304:nicG2nYJWxvmv99qfccaTY8TXfJjc2Ux333P/:lnYJWZWzfJj6/
TLSH
T1B1266E13F788753EE4B71A3A883BA654583B7A213A16CC477BFC2D4C4E39640AD26747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.txt

Path C:\Users\Admin\AppData\Roaming\setup.txt
Size 8B
SHA256 bfcd9a7f1abea620234acbc6decdf0ffa111748d648eacd22c2681868f1c3ae8
MD5 9c38b191e1923193a6bf1318a3031f8c
SHA1 00786fd268a072e0e368455f2f21b4822722ddfc
SHA512 fad7d19b08f1f5bc2712e5d68f3a04ec3bce628e26ee5952c061bf5ddd57b77e4a803e010c6a89be5d4eec2a53f637210754f486743527ed7f95a1f07080d487
MD5 SHA1 SHA512

Submit Download

memory/484-344-0x0000025A6CBF0000-0x0000025A6CCDA000-memory.dmp

Download

memory/1116-337-0x00000208AD060000-0x00000208AD14A000-memory.dmp

Download

memory/1320-428-0x0000022D41E00000-0x0000022D41EEA000-memory.dmp

Download

memory/1980-434-0x000002407B330000-0x000002407B41A000-memory.dmp

Download

memory/2076-339-0x000002C04A6B0000-0x000002C04A79A000-memory.dmp

Download

memory/2984-340-0x000002589DCB0000-0x000002589DD9A000-memory.dmp

Download

memory/3980-1-0x0000000000A70000-0x0000000000B58000-memory.dmp

Download

memory/3980-334-0x0000000000A70000-0x0000000000B58000-memory.dmp

Download

memory/4204-335-0x0000000000130000-0x000000000057A000-memory.dmp

Download

memory/4204-336-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/4204-5-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/4776-338-0x000001B8737F0000-0x000001B8738DA000-memory.dmp

Download

memory/4776-311-0x00007FFE0AE90000-0x00007FFE0AE91000-memory.dmp

Download

memory/4816-343-0x000001ABCC850000-0x000001ABCC93A000-memory.dmp

Download