03cf6fdb79201cbce7d19c93459a393f4dbe8eda07d7a759f3d7e66ba734af8c

Analysis

max time kernel
149s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TradingView.exe
Size 201.4MB
Sample260815-c3eftadp2x
SHA256 03cf6fdb79201cbce7d19c93459a393f4dbe8eda07d7a759f3d7e66ba734af8c
MD5 b084192de350b7f25056ce2313f2a852
SHA1 dab055ec73c6bb9849b3aee84c182e585c670711
SHA512 daf95ed8556f0de724d6f5efc9d9c0af18f5aa8ff2b162378f2cfaf98926ca9b34055e1234969658e7e6443e8e4daf1d3956a7408c7654f022540632964b7d07
SSDEEP 1572864:i8vG3kPghp8lrIoewGRwyfKKEeAr4apjsnwUrW6DkjLXjPqEYsuA/o9VqQ+NT5eW:pGLmlarKpHgom2+9Lg8
TLSH
T176A88C13E29601D9E05DD175974A9733FE72B8064B28A3DF2A5407922F77EE42B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2312	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	TradingView.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview\shell\open\command	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview\shell	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview\shell\open	TradingView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TradingView.exe\" \"%1\""	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview	TradingView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview\URL Protocol	TradingView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\tradingview\ = "URL:tradingview"	TradingView.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	TradingView.exe
5536	TradingView.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe
Token: SeShutdownPrivilege	1312	TradingView.exe
Token: SeCreatePagefilePrivilege	1312	TradingView.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1312	TradingView.exe
1312	TradingView.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2312	1312	TradingView.exe	79
PID 2312 wrote to memory of 4396	2312	cmd.exe	81
PID 1312 wrote to memory of 1640	1312	TradingView.exe	82
PID 1312 wrote to memory of 464	1312	TradingView.exe	83
PID 1312 wrote to memory of 464	1312	TradingView.exe	83
PID 1312 wrote to memory of 3128	1312	TradingView.exe	84
PID 1312 wrote to memory of 3668	1312	TradingView.exe	85
PID 1312 wrote to memory of 752	1312	TradingView.exe	86
PID 1312 wrote to memory of 3744	1312	TradingView.exe	87
PID 1312 wrote to memory of 4680	1312	TradingView.exe	88
PID 1312 wrote to memory of 3868	1312	TradingView.exe	89
PID 1312 wrote to memory of 3460	1312	TradingView.exe	90
PID 1312 wrote to memory of 3460	1312	TradingView.exe	90
PID 1312 wrote to memory of 2508	1312	TradingView.exe	91
PID 1312 wrote to memory of 2508	1312	TradingView.exe	91
PID 1312 wrote to memory of 4564	1312	TradingView.exe	92
PID 1312 wrote to memory of 5536	1312	TradingView.exe	93

C:\Users\Admin\AppData\Local\Temp\TradingView.exe
"C:\Users\Admin\AppData\Local\Temp\TradingView.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4396
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  C:\Users\Admin\AppData\Local\Temp\TradingView.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\TradingView /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\TradingView\Crashpad --url=https://f.a.k/e --annotation=_productName=TradingView --annotation=_version=3.3.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=38.2.2 --initial-client-data=0x574,0x578,0x57c,0x56c,0x580,0x7ff79fca0e14,0x7ff79fca0e20,0x7ff79fca0e30
  2⤵
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:464
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
  2⤵
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:1
  2⤵
  PID:3668
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:1
  2⤵
  PID:752
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3460
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,14088114026889109155,975750147563710262,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TradingView\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 58d89457aeb5da35a4e537aa38316bfba291e444d2b4d2188c0104bb1c653943
MD5 bdc644527dcef9a1ca7c9a626087cd55
SHA1 941bc82737fd5f8a40d581e624f6cece7cfca9c1
SHA512 159d50ad49d253c096a88ea8ceba641377b28987fb7d21f3548e72bb4e98aad271f4e470bb194882ee43e24d522173b318a16161fc2b6a3c47e82f6fe4ada275
SSDEEP 96:qQfEPyydal1APvUtUc/FltTPo+AJ7x5HCMGBk3pOs600b0zxawiSOATBhPzp/diS:qQf89dmt/heiMr3f70Qzxp9h7pwzIpK0
TLSH
T120F17161C5E3E1FFDFD435B0CA912CC42B2681A7C43A1B03A235FDA8695BEE540E0836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595877.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Code Cache\js\index-dir\the-real-index~RFe595877.TMP
Size 48B
SHA256 fae4509817ce0cf2dbf8579388c958cdd05a8fcc0c24a54b0c2b33bfd700c3df
MD5 a165ae917481a7b0e0697aca845b0c5d
SHA1 aa38dc8cfe89e81990a333fbdfd1c0be009f0e43
SHA512 7c708f39b8acb970e4a3100d5f46c4d76cd9573717f32589fce285ee55e0403e9aa7f0f270c4d48f4a38f2f1e09eaa45d4a226e773717d7eef149020145e9b86
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\TradingView\Network\Network Persistent State
Size 1KB
SHA256 ef6e0c4ab6c0df9ab25a93f6461edb21f1e61c11b6a275544cf67e9ce5544fc3
MD5 0f9a00e360646736362d39dd854106ca
SHA1 8d675d74d1e8503dff254676a28ff589f2e301fd
SHA512 01b4b2ed7f2fe667474a102caf59783be0da356978713f9ece89d2e006e366433ab33b8914ff4e60dbc4dc34fd48a00421ba9a5e40557a96a767fc0bc26d31da
TLSH
T17E3128EB87B4057EA662A2F42E253E33C5FD162C075C7C8686C47F1967B243299007CE
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe599f15.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Network\Network Persistent State~RFe599f15.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\c87b4671-c3d6-418f-9c64-8d5256bf39a6\index-dir\the-real-index
Size 96B
SHA256 309137400f0a21c71cf2da1dfa965f8b81298c146c39b25326c7602d6ce2fee6
MD5 9e0b7cf1b6b4a30410d7be807d368ed7
SHA1 75d1da43c63f5f0a01f080a8ae28ed375d95d396
SHA512 954eaa76c77a52cb33f07cae56efac18124d3adf857d97199ce5e8758b41afdb676d9c918ef71b12ac02a3615e995b7164d1caf55d691e8dfc764f5466780292
TLSH
T1C2B022208080C833CF0303BC20C300CC33B08C08A38B08C082AC0FE8CA033A28028030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f4fa.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\c87b4671-c3d6-418f-9c64-8d5256bf39a6\index-dir\the-real-index~RFe58f4fa.TMP
Size 48B
SHA256 88fbc8bb6a0a94cfca2f895004acf7632a78835bdd46705b363d7adeeb120b24
MD5 304e47373afe9bf2d941d42b3a71d9b2
SHA1 d817944b4b23fee31da8119693d27dd78b0f7a80
SHA512 cb3f1767caac980fa9d991388b641f195932fa642f1a3a611e37c5fcf1161f77ea0170ab3f661163e12637b8f70313a19faeee9d9bb30e4d360d4c3d996786ef
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt
Size 146B
SHA256 b7d99b15ed48227c54ce3f5092132ccd9e034c705672fbeeb1b888bd42f55b82
MD5 039941ca81eec8cfb3b997f891a905bb
SHA1 37674f0e934147971d011ed5a838bd4877f7c772
SHA512 8d59ee5e8ed32403f6c63f813524af6c78d4555941353efc3757e0267daf0ddcd5c1abd11847da03472bef7eee0f18089623616da83fa8c9858c00ea39f1c201
TLSH
T1C2C02BE79250CC0139DDD3C021305375D40F93EC984186C4C1B030041A2013340007AE
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58f529.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt~RFe58f529.TMP
Size 151B
SHA256 6f71ac90efc5a66b5d8daf8ebee7143fa803c9ec073bd7ab28a01abe6a837687
MD5 3882e142ce015b3fd2a7b4715694ca90
SHA1 f328c0f4c70d203d87386e0f3ea0e529dfa4588a
SHA512 7b7ca0ba878551ea7d1c7c1f151e36244c02dab532a3c8e86c9126d7566b257e7462ccd3f3c46c2a947a19ce9d23fb81742c5937cf7bee7b6f5d0340c65367fd
TLSH
T1A8C02BE75268CC023AEDD0C1613093B5940B5FEC8C0186C8C17130042A30133410476E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\TradingView\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

appState.json

Path C:\Users\Admin\AppData\Roaming\TradingView\TVAppStorage\appState.json
Size 1KB
SHA256 c14543421e7b2ff15dd24a5f08d3a57da1cca53c5408a43c5df85157838d77f6
MD5 dab59f9c6652a6b954546c43051aea52
SHA1 59ca8c41b4b40e53efe8e912f153f0735d0a2396
SHA512 5e3bf422f80b6599eef2e69b5d26f9a06742c4d481e7ffb8bc962e7f06ab283215a1d9abf2ddd742be8c577ce993682c7594d8ce078aa7e2cca5e4d2bc5a6b48
TLSH
T1A4214614C26808BA90B5813598AE21C393301E8705593D247F4F604D2F5CF6F6AF2BFA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-930-0x0000018E6C6A0000-0x0000018E6CC0C000-memory.dmp

Download

memory/464-1266-0x0000018E6C6A0000-0x0000018E6CC0C000-memory.dmp

Download

memory/2508-88-0x00007FFFB1690000-0x00007FFFB1691000-memory.dmp

Download

memory/2508-89-0x00007FFFB3120000-0x00007FFFB3121000-memory.dmp

Download

memory/5536-1317-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1306-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1305-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1304-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1316-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1315-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1314-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1313-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1312-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1311-0x000001ADB03B0000-0x000001ADB03B1000-memory.dmp

Download

memory/5536-1318-0x000001ADADE20000-0x000001ADAE38C000-memory.dmp

Download