fbe5d3a5abec6f6960f5611ab2c76332da86e3f259609e35aa2f20d2bca21a91

Analysis

max time kernel
60s
max time network
49s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orbit_MWIII.exe
Size 10.5MB
Sample260910-2gv9waxamd
SHA256 fbe5d3a5abec6f6960f5611ab2c76332da86e3f259609e35aa2f20d2bca21a91
MD5 091b7f96665cbcd6e67dc99f797da14b
SHA1 205e19a572b1399866e0fb416803689dfbae65d3
SHA512 6ea6c1ab599b98a82ada578402b3e73153fd92feaacbb7c4a14578a08f2924c0ea84f91b91939ab35e169ba2ac709924c889d2a27734b6e7a415a60727c8b2aa
SSDEEP 196608:q+hcb4CYyAuYh//Tr44vWFTE9On6W35y6y1Fl4:Svk3PcTEw6l6s
TLSH
T1FFB623DE71543768C01A84389137BD05F1B5461E16EAC8AE72CB7ED03B7B425EA82F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3408	cmd.exe
1220	powercfg.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5020	sc.exe
2476	sc.exe
6900	sc.exe
3808	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2912	cmd.exe
2664	cmd.exe
6596	cmd.exe
6288	cmd.exe
7116	cmd.exe
3580	cmd.exe
5324	cmd.exe
6304	cmd.exe
3348	cmd.exe
3512	cmd.exe
5540	cmd.exe
5380	cmd.exe
3324	cmd.exe
5476	cmd.exe
4716	cmd.exe
6456	cmd.exe
1716	cmd.exe
1268	cmd.exe
6548	cmd.exe
2896	cmd.exe
2064	cmd.exe
5856	cmd.exe
3432	cmd.exe
2548	cmd.exe
1460	cmd.exe
7076	cmd.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
4692	taskkill.exe
3404	taskkill.exe
3120	taskkill.exe
6180	taskkill.exe
616	taskkill.exe
4124	taskkill.exe
7120	taskkill.exe
3124	taskkill.exe
4556	taskkill.exe
1240	taskkill.exe
4816	taskkill.exe
1532	taskkill.exe
4384	taskkill.exe
2308	taskkill.exe
6848	taskkill.exe
3228	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
3936	powershell.exe
3936	powershell.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe
6048	Orbit_MWIII.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1220	powercfg.exe
Token: SeCreatePagefilePrivilege	1220	powercfg.exe
Token: SeShutdownPrivilege	1220	powercfg.exe
Token: SeCreatePagefilePrivilege	1220	powercfg.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeSystemEnvironmentPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	7120	taskkill.exe
Token: SeDebugPrivilege	6848	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	3124	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	2308	taskkill.exe
Token: SeDebugPrivilege	6180	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 3408	6048	Orbit_MWIII.exe	91
PID 6048 wrote to memory of 3432	6048	Orbit_MWIII.exe	92
PID 3432 wrote to memory of 3936	3432	cmd.exe	94
PID 3408 wrote to memory of 1220	3408	cmd.exe	95
PID 6048 wrote to memory of 6456	6048	Orbit_MWIII.exe	96
PID 6048 wrote to memory of 6288	6048	Orbit_MWIII.exe	97
PID 6048 wrote to memory of 7116	6048	Orbit_MWIII.exe	98
PID 6048 wrote to memory of 3348	6048	Orbit_MWIII.exe	99
PID 6048 wrote to memory of 3580	6048	Orbit_MWIII.exe	100
PID 6048 wrote to memory of 1716	6048	Orbit_MWIII.exe	101
PID 6048 wrote to memory of 3512	6048	Orbit_MWIII.exe	102
PID 7116 wrote to memory of 1240	7116	cmd.exe	103
PID 3512 wrote to memory of 4648	3512	cmd.exe	104
PID 6288 wrote to memory of 7120	6288	cmd.exe	105
PID 3580 wrote to memory of 4124	3580	cmd.exe	106
PID 6456 wrote to memory of 6848	6456	cmd.exe	107
PID 3348 wrote to memory of 5020	3348	cmd.exe	108
PID 6048 wrote to memory of 2548	6048	Orbit_MWIII.exe	110
PID 6048 wrote to memory of 5540	6048	Orbit_MWIII.exe	111
PID 6048 wrote to memory of 1268	6048	Orbit_MWIII.exe	112
PID 6048 wrote to memory of 1460	6048	Orbit_MWIII.exe	113
PID 6048 wrote to memory of 5380	6048	Orbit_MWIII.exe	114
PID 6048 wrote to memory of 7076	6048	Orbit_MWIII.exe	115
PID 1268 wrote to memory of 3404	1268	cmd.exe	117
PID 1460 wrote to memory of 2476	1460	cmd.exe	116
PID 2548 wrote to memory of 4816	2548	cmd.exe	118
PID 5380 wrote to memory of 3228	5380	cmd.exe	119
PID 5540 wrote to memory of 4692	5540	cmd.exe	120
PID 6048 wrote to memory of 6548	6048	Orbit_MWIII.exe	121
PID 6048 wrote to memory of 2912	6048	Orbit_MWIII.exe	122
PID 6048 wrote to memory of 2896	6048	Orbit_MWIII.exe	123
PID 6048 wrote to memory of 2664	6048	Orbit_MWIII.exe	124
PID 6048 wrote to memory of 5324	6048	Orbit_MWIII.exe	125
PID 6048 wrote to memory of 6596	6048	Orbit_MWIII.exe	126
PID 6048 wrote to memory of 3324	6048	Orbit_MWIII.exe	127
PID 6048 wrote to memory of 2064	6048	Orbit_MWIII.exe	128
PID 6048 wrote to memory of 6304	6048	Orbit_MWIII.exe	129
PID 6048 wrote to memory of 5476	6048	Orbit_MWIII.exe	130
PID 6048 wrote to memory of 5856	6048	Orbit_MWIII.exe	131
PID 6048 wrote to memory of 4716	6048	Orbit_MWIII.exe	132
PID 2912 wrote to memory of 4384	2912	cmd.exe	133
PID 2664 wrote to memory of 3808	2664	cmd.exe	134
PID 5324 wrote to memory of 1532	5324	cmd.exe	135
PID 5476 wrote to memory of 6900	5476	cmd.exe	136
PID 5856 wrote to memory of 3124	5856	cmd.exe	137
PID 6548 wrote to memory of 3120	6548	cmd.exe	138
PID 2896 wrote to memory of 2308	2896	cmd.exe	139
PID 3324 wrote to memory of 616	3324	cmd.exe	140
PID 6304 wrote to memory of 6180	6304	cmd.exe	141
PID 2064 wrote to memory of 4556	2064	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe
"C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C Powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\powercfg.exe
    Powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Confirm-SecureBootUEFI"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6456
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6288
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:7116
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe" MD5
    3⤵
    PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6548
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6304
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:6900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

secureboot_status.txt

Path C:\secureboot_status.txt
Size 420B
SHA256 a9aac8c0cfbbeefd52ba4cca1c99c6bd4e16d28792d695ce0271761701868e0a
MD5 6bb2c33bff35de3d3e6660cb183f7182
SHA1 b00ef727ef3df7a501caa49c5b4e458c6bd90eba
SHA512 3650c068da0c025611a2d3716a6017296329bfa49e68e03f8da4fdf1984ccef176679584b455156e1f46468cd5861804e06104db39cb26097ecd1e7addc79617
TLSH
T1FCE0D83E81B955435880E0C1154223AD2B43E2376C8586577A1E2F081F3E6F6F96E2EB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3936-23-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-27-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-33-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-7-0x00007FF98DD7F000-0x00007FF98DD80000-memory.dmp

Download

memory/3936-10-0x00000217727E0000-0x0000021772802000-memory.dmp

Download

memory/3936-11-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-12-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-13-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-14-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-16-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-15-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-22-0x0000021772F50000-0x0000021773002000-memory.dmp

Download

memory/3936-30-0x0000021772BF0000-0x0000021772C0E000-memory.dmp

Download

memory/3936-29-0x00000217726A0000-0x00000217726AA000-memory.dmp

Download

memory/3936-17-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-21-0x0000021772BB0000-0x0000021772BCE000-memory.dmp

Download

memory/3936-24-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-25-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-26-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-18-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/3936-28-0x00007FF98DBF0000-0x00007FF98E594000-memory.dmp

Download

memory/6048-0-0x00007FF9B06B0000-0x00007FF9B06B2000-memory.dmp

Download

memory/6048-1-0x00007FF6E9BA0000-0x00007FF6EAEB7000-memory.dmp

Download

memory/6048-6-0x00007FF6E9BA0000-0x00007FF6EAEB7000-memory.dmp

Download

memory/6048-2-0x00007FF6E9C90000-0x00007FF6EA441000-memory.dmp

Download

memory/6048-36-0x00007FF6E9C90000-0x00007FF6EA441000-memory.dmp

Download

memory/6048-37-0x00007FF6E9BA0000-0x00007FF6EAEB7000-memory.dmp

Download