f2681cf48b9dddcf302dea60715a142df3a61c4ccdcd7e7721a155bc3900b12e

Analysis

max time kernel
30s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xococolStudio.exe
Size 180.0MB
Sample260418-2mb37ahs3j
SHA256 f2681cf48b9dddcf302dea60715a142df3a61c4ccdcd7e7721a155bc3900b12e
MD5 660976312c151867262836babce3bc90
SHA1 4a502b5d61fe903fa2149ce6c46ddcb6d5a8a09c
SHA512 a0f4de5da7153931b51b359699820abe01176150680e80be7db9659120df04980c4bf92def32e27f699884feb5c89002cb05147bb654245fc3e9184a44c1e5c6
SSDEEP 1572864:pH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:esok+hK7
TLSH
T1E8988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2dc77e1942674c75.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2dc77e1942674c75.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2dc77e1942674c75.exe

Executes dropped EXE 1 IoCs

pid	Process
4524	2dc77e1942674c75.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral12/files/0x000900000002439e-38.dat	themida
behavioral12/memory/4524-42-0x0000000140000000-0x0000000140798000-memory.dmp	themida
behavioral12/memory/4524-43-0x0000000140000000-0x0000000140798000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2dc77e1942674c75.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4524	2dc77e1942674c75.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	xococolStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	xococolStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	xococolStudio.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2316	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4716	powershell.exe
4716	powershell.exe
1092	powershell.exe
1092	powershell.exe
4108	powershell.exe
4108	powershell.exe
4524	2dc77e1942674c75.exe
4524	2dc77e1942674c75.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeIncreaseQuotaPrivilege	4716	powershell.exe
Token: SeSecurityPrivilege	4716	powershell.exe
Token: SeTakeOwnershipPrivilege	4716	powershell.exe
Token: SeLoadDriverPrivilege	4716	powershell.exe
Token: SeSystemProfilePrivilege	4716	powershell.exe
Token: SeSystemtimePrivilege	4716	powershell.exe
Token: SeProfSingleProcessPrivilege	4716	powershell.exe
Token: SeIncBasePriorityPrivilege	4716	powershell.exe
Token: SeCreatePagefilePrivilege	4716	powershell.exe
Token: SeBackupPrivilege	4716	powershell.exe
Token: SeRestorePrivilege	4716	powershell.exe
Token: SeShutdownPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeSystemEnvironmentPrivilege	4716	powershell.exe
Token: SeRemoteShutdownPrivilege	4716	powershell.exe
Token: SeUndockPrivilege	4716	powershell.exe
Token: SeManageVolumePrivilege	4716	powershell.exe
Token: 33	4716	powershell.exe
Token: 34	4716	powershell.exe
Token: 35	4716	powershell.exe
Token: 36	4716	powershell.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeIncreaseQuotaPrivilege	1092	powershell.exe
Token: SeSecurityPrivilege	1092	powershell.exe
Token: SeTakeOwnershipPrivilege	1092	powershell.exe
Token: SeLoadDriverPrivilege	1092	powershell.exe
Token: SeSystemProfilePrivilege	1092	powershell.exe
Token: SeSystemtimePrivilege	1092	powershell.exe
Token: SeProfSingleProcessPrivilege	1092	powershell.exe
Token: SeIncBasePriorityPrivilege	1092	powershell.exe
Token: SeCreatePagefilePrivilege	1092	powershell.exe
Token: SeBackupPrivilege	1092	powershell.exe
Token: SeRestorePrivilege	1092	powershell.exe
Token: SeShutdownPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeSystemEnvironmentPrivilege	1092	powershell.exe
Token: SeRemoteShutdownPrivilege	1092	powershell.exe
Token: SeUndockPrivilege	1092	powershell.exe
Token: SeManageVolumePrivilege	1092	powershell.exe
Token: 33	1092	powershell.exe
Token: 34	1092	powershell.exe
Token: 35	1092	powershell.exe
Token: 36	1092	powershell.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe
Token: SeShutdownPrivilege	2736	xococolStudio.exe
Token: SeCreatePagefilePrivilege	2736	xococolStudio.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 436	2736	xococolStudio.exe	84
PID 2736 wrote to memory of 436	2736	xococolStudio.exe	84
PID 2736 wrote to memory of 2172	2736	xococolStudio.exe	85
PID 2172 wrote to memory of 4716	2172	cmd.exe	87
PID 2736 wrote to memory of 2296	2736	xococolStudio.exe	89
PID 2296 wrote to memory of 1092	2296	cmd.exe	91
PID 2736 wrote to memory of 1784	2736	xococolStudio.exe	92
PID 1784 wrote to memory of 2612	1784	cmd.exe	94
PID 2612 wrote to memory of 772	2612	net.exe	95
PID 2736 wrote to memory of 3752	2736	xococolStudio.exe	96
PID 3752 wrote to memory of 2316	3752	cmd.exe	98
PID 2736 wrote to memory of 4108	2736	xococolStudio.exe	99
PID 2736 wrote to memory of 968	2736	xococolStudio.exe	101
PID 2736 wrote to memory of 4524	2736	xococolStudio.exe	102

C:\Users\Admin\AppData\Local\Temp\xococolStudio.exe
"C:\Users\Admin\AppData\Local\Temp\xococolStudio.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\xococolStudio.exe
  "C:\Users\Admin\AppData\Local\Temp\xococolStudio.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\xococolstudio-neox" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1756,i,796721259611879362,13187139862705155042,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgApAC4AQwBvAHUAbgB0AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\xococolStudio.exe
  "C:\Users\Admin\AppData\Local\Temp\xococolStudio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\xococolstudio-neox" --field-trial-handle=2020,i,796721259611879362,13187139862705155042,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
  2⤵
  PID:968
- C:\Users\Admin\AppData\Local\Temp\2dc77e1942674c75.exe
  C:\Users\Admin\AppData\Local\Temp\2dc77e1942674c75.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dbb08386cd9f304d5aa17935079b599760b504b45709c408ff5f2378bbdb0b9e
MD5 71207fb9532b557fde35300361bcd25a
SHA1 67512f831c48abdfe4dc1efee8dd3c668906110f
SHA512 c8ac4bfd772aee505705e956393edccae3fd5cecfc7a7a5e241d61ae1c0b3ebde9289e2b59ab705afd3a1f92a98922ed495cea2ab1383aa014e835f0e425a85f
TLSH
T1D4216527B39CC821CC99253A209CAC1172B683C7809ECF8F6EC0D224A47FA84CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b5b90094dac3d1015520ddc25136f5ceeb672c479eabd09799f12af543803e91
MD5 8f0f0bdcbe702bed64996636fcef4e78
SHA1 70309052c181844e964217d8ef515332c151415d
SHA512 3c41b164bf66d4c17c433a51a9b789b11a98fb0549e72b5c9fe75bb97797af866ce4e042499e1cb14a6a9c91274eb4f911e0e9e6cf6d1fcf80dd9b3790da289d
TLSH
T1B8218727B39CC921CC99153A209DAC5172B683C7809ECF8F6FC0D224A17FAC4CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

2dc77e1942674c75.exe

Path C:\Users\Admin\AppData\Local\Temp\2dc77e1942674c75.exe
Size 3.1MB
SHA256 be19c65b4611bd85f45ad369ef6bf10facd350019f1d0f766e02974d369df007
MD5 48d92fce54545b02d82b12d2eaa3279c
SHA1 17f9f1f8fe7eb6e0d2bb6ddaf6e4c5bd43a87ddf
SHA512 7198eab50c77303de58413152e565382395f9cebc14116cbc37a2bf107e0934ccd1b316a5c90c23491b03bd7117ea77785ea0044e01b5fa8e8e423f95db866a8
SSDEEP 49152:tsICLEb+fWldNtcdlEnL6Ce07ivaN2pMX/SkjsVWpVnV4rKWfrYJ6M+fEUShkZ:t49dlaLmvVp+KavWTY+fEUvZ
TLSH
T1AFE5233A32A815A6FD77B178CE06A773D7F2B1029380A39E07648B751F53A65F12D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_s100i1fh.s0j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s100i1fh.s0j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1092-25-0x000001FB600B0000-0x000001FB600BC000-memory.dmp

Download

memory/4108-35-0x0000025925660000-0x000002592566C000-memory.dmp

Download

memory/4524-42-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/4524-43-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/4716-14-0x00000206AA0D0000-0x00000206AA0DC000-memory.dmp

Download

memory/4716-11-0x00000206C2D00000-0x00000206C2D24000-memory.dmp

Download

memory/4716-2-0x00000206C27B0000-0x00000206C27D2000-memory.dmp

Download

memory/4716-10-0x00000206C2D00000-0x00000206C2D2A000-memory.dmp

Download