96b5ebc196a3824ef22667ba9ae1a6ab92e83b70615d0afe96031ab11c6ce6df

Analysis

user interaction
yes
max time kernel
449s
max time network
497s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TradingView.appx
Size 141.2MB
Sample260815-c3eftadp2x
SHA256 96b5ebc196a3824ef22667ba9ae1a6ab92e83b70615d0afe96031ab11c6ce6df
MD5 ba81ac703cdd83102e77f0cb41660c47
SHA1 899aae001e63943c586ba1b2ab4f4cbc29a34ab7
SHA512 ba947cc10408981ec80ff7fa7cabd129ed05544bfd523e30e2d18ec2cc51a14060f6064435ecb88fb303588c4e0ff2f7caf0cf00fc26ebcb0c00db16254d3d29
SSDEEP 3145728:r6A7FzVRcjcM5YU+skXB1xXnlQEQ/6yNWfQKxbd0XlaISTZ9+:n5V5Y4dBnwLNtsK04
TLSH
T1FE68332BB8103587C223EAFBABF3E9F7187756EA582089BF47A7C34F05550D0918594B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5452	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	TradingView.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\tradingview	TradingView.exe
Key created	\Registry\User\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\tradingview\shell\open\command	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4828	PowerShell.exe
4828	PowerShell.exe
4828	PowerShell.exe
5440	chrome.exe
5440	chrome.exe
5740	TradingView.exe
5740	TradingView.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	PowerShell.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe
Token: SeCreatePagefilePrivilege	1144	TradingView.exe
Token: SeShutdownPrivilege	1144	TradingView.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1144	TradingView.exe
1144	TradingView.exe
1144	TradingView.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 5452	1144	TradingView.exe	93
PID 5452 wrote to memory of 4924	5452	cmd.exe	95
PID 1144 wrote to memory of 4900	1144	TradingView.exe	96
PID 1144 wrote to memory of 4316	1144	TradingView.exe	97
PID 1144 wrote to memory of 4316	1144	TradingView.exe	97
PID 1144 wrote to memory of 1748	1144	TradingView.exe	98
PID 1144 wrote to memory of 4536	1144	TradingView.exe	99
PID 1144 wrote to memory of 1100	1144	TradingView.exe	100
PID 1144 wrote to memory of 3152	1144	TradingView.exe	101
PID 1144 wrote to memory of 3844	1144	TradingView.exe	103
PID 1144 wrote to memory of 5448	1144	TradingView.exe	104
PID 1144 wrote to memory of 5772	1144	TradingView.exe	105
PID 1144 wrote to memory of 5772	1144	TradingView.exe	105
PID 1144 wrote to memory of 5904	1144	TradingView.exe	106
PID 1144 wrote to memory of 5904	1144	TradingView.exe	106
PID 1144 wrote to memory of 3980	1144	TradingView.exe	107
PID 1144 wrote to memory of 5740	1144	TradingView.exe	110

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell start shell:AppsFolder\TradingView.Desktop_n534cwy3pjxzj!TradingView.Desktop
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
"C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4924
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\TradingView /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\TradingView\Crashpad --url=https://f.a.k/e --annotation=_productName=TradingView --annotation=_version=3.3.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=38.2.2 --initial-client-data=0x578,0x580,0x584,0x57c,0x588,0x7ff75dec0e14,0x7ff75dec0e20,0x7ff75dec0e30
  2⤵
  PID:4900
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
  2⤵
  PID:1748
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=583566422 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=583592555 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=584204976 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=584843969 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=584854627 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=585639830 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=585951520 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1786761014494025 --launch-time-ticks=597409915 --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe
  "C:\Program Files\WindowsApps\TradingView.Desktop_3.3.0.7992_x64__n534cwy3pjxzj\TradingView.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,12553745423256936421,285284988946715152,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3680,i,8931198045861767556,14555602878770717063,262144 --field-trial-handle=1996,i,11810871911362317466,2165347079457784618,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:10
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,2957530303844900755,18026420218557434581,524288 --field-trial-handle=1996,i,11810871911362317466,2165347079457784618,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1528 /prefetch:14
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 c5e59d0275c71aed58a41f76a4fc3ac7d66f8984f1a3225c836d9ea60aed4423
MD5 42235c7888674fff371e6379f2ba35a6
SHA1 f4651b3fd7fb8289df785a5de136159eab74a8bc
SHA512 92d7a1eb7cf072aaf1f4a002fee37ee3cace519b38c154e70ffc351e184e8649c1af31b7a1ac4ef8ed24cd6db7d4a26623c50b5b544ac2b86d74ac13fabb657b
SSDEEP 192:KtvxIg5Ky8q/zTrReald0bNN+j+fAlVao:KtvxIg5zhld0bNUj+fAlVao
TLSH
T171F1415B88F5A032CF0566B1C4B28ED87FE440A74443AB436BA75D64784F6D943BC27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a204b.TMP

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Code Cache\js\index-dir\the-real-index~RFe5a204b.TMP
Size 48B
SHA256 27e3260e57177a0ae0d51ea761e22b3d4cb65c863eddd563c9505b7f1e82dd80
MD5 c243915f471e7eab1939717fb5f507c6
SHA1 5fae2bd0e5a14d9fe9eda1f7de86bbd9acf20016
SHA512 64e0e85b725e1bf1159d00a897e6b4ba86a11035f01616fd93b603298f3e0a6210e58747b19579a4f2b0cc014c9734c3bdd4f641a45f9e261b94a2bc5d84f99f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Network\Network Persistent State
Size 1KB
SHA256 f6708a5e0b2d4511d9c02996bb63b9f7b18c5226765c80d087c45afc047740e6
MD5 ae5e77c0adbe052048b71bc10a457b3b
SHA1 b892b4e8c061748d0231da967a63c6bc66faed74
SHA512 d106591bdd1233168ac5cd77a21b90add8c2bc53be90a75d81738bb42c1eb308e9413e0a430e8c8811312f9fac8e7307ae228b6a9af07b65af923a03b603b4c1
TLSH
T19E3139EB87B4057E6662A2F02E253E33C5FD222C075C7D8686C4BF0917B283255007CE
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a610d.TMP

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Network\Network Persistent State~RFe5a610d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\b9811252-d39c-4874-91d5-86abf3c8678c\index-dir\the-real-index
Size 96B
SHA256 97f1c3a31874e589b2975fccf5851d4cc274d5a572e69e37338652b0603100ff
MD5 76e5fc383bf1cdadbd107b85a550a2af
SHA1 adee6857ecf40aaf8f52e80e2e766eed8a18e7d9
SHA512 dca209381d1cc460fb1e43198c1be6c21f5a2d884f0d12c2d52e31c3f8188612e7ffd4ca2c71d18447b4964467dba0898ae719251c4164fad2edabebbc831de5
TLSH
T1F1B022000820C833E02333F030E000EC33308E28A38F02C0038C0FA0C8AF3B00020000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf7e.TMP

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\b9811252-d39c-4874-91d5-86abf3c8678c\index-dir\the-real-index~RFe59bf7e.TMP
Size 48B
SHA256 2edf69dcd342453847ba1c304727298ae5dbcf0c790decf54cce4cb7b90c3d78
MD5 4b64ab76c03f6432bc2dd5b15cf96fc2
SHA1 377fd9c882c8e9e60e20657efae6c5dbeefd5a41
SHA512 c8055edb4f24fe4841615902375cc2d04f308211d43cb2551dfbb204555c71cef4a215f2a5846812862307d345270b37e874db011946c608b7e0bef07e5358b8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt
Size 146B
SHA256 8218e7c882d1d6b566e2d3964b51d2ddc0a7aba5e4dbabb12c00cfdb5ae179a5
MD5 7e2dcf8d1808e79ddb76053b9da155a4
SHA1 70bdd08b4d97a1dc30c897e94f0df7c70277406a
SHA512 cca7b332361ab10029332acbebb28936ec31e3830522cbe2970f0a9b09ce4fed48dca63ca3766e4ff162bc5f967ef76698e54f663d99f154e4833d9133f171d2
TLSH
T176C09BE763204D407B8DD3912131D676D406139DCC56D6C893A87055157793548427AE
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59bfac.TMP

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt~RFe59bfac.TMP
Size 151B
SHA256 42ee4114b9853767b19ce6d663a8389ac86fd66e57b4c91abd70fdc669e63d76
MD5 c8aee4130b03aa6abb1d83dda87485d1
SHA1 5be6d0b7507411d27a3ef754258d87b867801dff
SHA512 7f5eaebe87ac4a77fdb0a7c4f660476a43caeeae323a52fb19dd5cd40fcab6d4cec69df5e529a897f49bf27c884359e0d945f239afe8280683ac1361c15cc26b
TLSH
T1FCC09BE753304D417B8ED2E16131DAB655061E9DCC42D6CC536570555533931484676D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

appState.json

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\TVAppStorage\appState.json
Size 1KB
SHA256 f36bcb0b6e37f6960e152f190052256615de7640f95bb54303303fae4015b1a5
MD5 67b87348854efdd81bba3c00bc3defe1
SHA1 e12cbd23f0d7b84ae4e76bde80e23be1030f9e55
SHA512 51f4116993a9513b6f2bde76e0df275ea04eacab2843e3d58e5a7e892ac2df818c48607afbdb12a2ea311afed25856152e0a8e7e8dc35e942e1397ed0642d4ef
TLSH
T191213814C27818BA90B4913598AE268353301E8705593D247B8F605D2F5CF6FAAF2BFA
MD5 SHA1 SHA512 TLSH

Submit Download

session.json

Path C:\Users\Admin\AppData\Local\Packages\TradingView.Desktop_n534cwy3pjxzj\LocalCache\Roaming\TradingView\sentry\session.json
Size 260B
SHA256 ed703195b89bf010821212d058e0ee2019919d9a49bf87635d0d649884220abd
MD5 dc7a56bcf70c803191defccdeea56676
SHA1 70537d947418b57309f452fd40f47b1e88b1afd5
SHA512 74558887c11b79cca122540a0acac41c0c5bb9e7a777f3aed140393e335e95da5f89f5870830d6076cd96a2b446f94a14549bd1d892ae24737c74348c97d4f16
TLSH
T13ED09780CA2EC02BB90325CFD00E2CC83B3A61601C0DAD8AD82F2C1805B16529A671BF
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bigdujbp.atw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bigdujbp.atw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1100-1366-0x000001AEBE5E0000-0x000001AEBE9AE000-memory.dmp

Download

memory/1100-992-0x000001AEBE5E0000-0x000001AEBE9AE000-memory.dmp

Download

memory/1100-466-0x000001AEBE5E0000-0x000001AEBE9AE000-memory.dmp

Download

memory/1100-1335-0x000001AEBE5E0000-0x000001AEBE9AE000-memory.dmp

Download

memory/1100-1441-0x000001AEBE5E0000-0x000001AEBE9AE000-memory.dmp

Download

memory/3152-467-0x0000033A28000000-0x0000033A283CE000-memory.dmp

Download

memory/3844-486-0x000001D3107A0000-0x000001D310B6E000-memory.dmp

Download

memory/3844-993-0x000001D3107A0000-0x000001D310B6E000-memory.dmp

Download

memory/3844-1337-0x000001D3107A0000-0x000001D310B6E000-memory.dmp

Download

memory/3844-1376-0x000001D3107A0000-0x000001D310B6E000-memory.dmp

Download

memory/3980-1309-0x000002470D020000-0x000002470D3EE000-memory.dmp

Download

memory/3980-1396-0x000002470D020000-0x000002470D3EE000-memory.dmp

Download

memory/4536-465-0x0000019495CB0000-0x000001949607E000-memory.dmp

Download

memory/4536-991-0x0000019495CB0000-0x000001949607E000-memory.dmp

Download

memory/4536-1334-0x0000019495CB0000-0x000001949607E000-memory.dmp

Download

memory/4536-1440-0x0000019495CB0000-0x000001949607E000-memory.dmp

Download

memory/4536-1365-0x0000019495CB0000-0x000001949607E000-memory.dmp

Download

memory/4828-9-0x000001FD5B010000-0x000001FD5B020000-memory.dmp

Download

memory/4828-0-0x000001FD5B010000-0x000001FD5B020000-memory.dmp

Download

memory/4828-1-0x000001FD5B010000-0x000001FD5B020000-memory.dmp

Download

memory/4828-6-0x000001FD413E0000-0x000001FD41402000-memory.dmp

Download

memory/5448-1394-0x00000253F9C20000-0x00000253F9FEE000-memory.dmp

Download

memory/5448-1338-0x00000253F9C20000-0x00000253F9FEE000-memory.dmp

Download

memory/5448-488-0x00000253F9C20000-0x00000253F9FEE000-memory.dmp

Download

memory/5448-994-0x00000253F9C20000-0x00000253F9FEE000-memory.dmp

Download

memory/5740-1421-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1423-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1420-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1414-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1413-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1412-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1425-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1419-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1424-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5740-1422-0x0000021ED5DD0000-0x0000021ED5DD1000-memory.dmp

Download

memory/5904-1388-0x000002648CB80000-0x000002648CF4E000-memory.dmp

Download

memory/5904-1346-0x000002648CB80000-0x000002648CF4E000-memory.dmp

Download

memory/5904-1308-0x000002648CB80000-0x000002648CF4E000-memory.dmp

Download

memory/5904-133-0x00007FFE8A8C0000-0x00007FFE8A8C1000-memory.dmp

Download

memory/5904-134-0x00007FFE8B410000-0x00007FFE8B411000-memory.dmp

Download

memory/5904-591-0x000002648CB80000-0x000002648CF4E000-memory.dmp

Download

memory/5904-1577-0x000002648CB80000-0x000002648CF4E000-memory.dmp

Download

memory/5904-1648-0x000002648CB80000-0x000002648CF4E000-memory.dmp

Download