89eb7e0756e15d100711ea4917c1fd04db43dd31695581e5ede5905924c41f1f

Analysis

user interaction
yes
max time kernel
149s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TradingView.exe
Size 212.8MB
Sample260916-qafeasba75
SHA256 89eb7e0756e15d100711ea4917c1fd04db43dd31695581e5ede5905924c41f1f
MD5 2f904b669194f6317decfc361a0b6d7e
SHA1 629950812db16aaf855221f9f381d2f75623f4ce
SHA512 a846fa58b94febfb8abe1e544013585a88aad6d83572c332b553887a5c9398f3ddbc1a0675aceb54c375094047596c61e12f776ad003faacf3a38a3e6b66f99b
SSDEEP 1572864:5xqwgQZY3HpcBOhBFAm/mOOJaja+jIWmwjZCQtIJHnbWLCImsuxm6j/g5R+lLSiS:78+GZU4O/XImD8
TLSH
T164B88C03E29601E9C05DD175575A9633FEB1B8094B24A3DF2BA447522F76EF82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	TradingView.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4940	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	TradingView.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TradingView.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TradingView.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TradingView.exe\" \"%1\""	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview	TradingView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview\URL Protocol	TradingView.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview\ = "URL:tradingview"	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview\shell\open\command	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview\shell	TradingView.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\tradingview\shell\open	TradingView.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	TradingView.exe
2916	TradingView.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe
Token: SeShutdownPrivilege	2580	TradingView.exe
Token: SeCreatePagefilePrivilege	2580	TradingView.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe
2580	TradingView.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4940	2580	TradingView.exe	80
PID 4940 wrote to memory of 464	4940	cmd.exe	82
PID 2580 wrote to memory of 2212	2580	TradingView.exe	83
PID 2580 wrote to memory of 4928	2580	TradingView.exe	84
PID 2580 wrote to memory of 4928	2580	TradingView.exe	84
PID 2580 wrote to memory of 3120	2580	TradingView.exe	85
PID 2580 wrote to memory of 1520	2580	TradingView.exe	86
PID 2580 wrote to memory of 5796	2580	TradingView.exe	87
PID 2580 wrote to memory of 5316	2580	TradingView.exe	89
PID 2580 wrote to memory of 4668	2580	TradingView.exe	90
PID 2580 wrote to memory of 5068	2580	TradingView.exe	91
PID 2580 wrote to memory of 1604	2580	TradingView.exe	92
PID 2580 wrote to memory of 1604	2580	TradingView.exe	92
PID 2580 wrote to memory of 4220	2580	TradingView.exe	93
PID 2580 wrote to memory of 4220	2580	TradingView.exe	93
PID 2580 wrote to memory of 4888	2580	TradingView.exe	94
PID 2580 wrote to memory of 2916	2580	TradingView.exe	103

C:\Users\Admin\AppData\Local\Temp\TradingView.exe
"C:\Users\Admin\AppData\Local\Temp\TradingView.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:464
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  C:\Users\Admin\AppData\Local\Temp\TradingView.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\TradingView /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\TradingView\Crashpad --url=https://f.a.k/e --annotation=_productName=TradingView --annotation=_version=3.4.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.7.1 --initial-client-data=0x518,0x51c,0x520,0x514,0x524,0x7ff71e972114,0x7ff71e972120,0x7ff71e972130
  2⤵
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:4928
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2820 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5796
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4220
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --app-user-model-id=electron.app.TradingView --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\TradingView.exe
  "C:\Users\Admin\AppData\Local\Temp\TradingView.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\TradingView" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,9449113161140806323,9081144739779145633,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,4756705346278938981,5231975970564170754,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TradingView\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 6e88c274c03812e86a492192e1bcbb76cbd08cf486de4dfaaffc62e4182dfe50
MD5 5723c892a59319deb00eece3907185b3
SHA1 7e5215097a20b198e25a25bee6f1e770ccf119c9
SHA512 33510515af31858a00866e2c736326b84c7d5ad2a5a048f2801e63b307ecd1e8cd88d985ff2edffa52dec78864d1f63383c83cfecf4dd58f5031b721a6e33307
SSDEEP 96:7dUjpoRMeEc8VcsqnHkOm3EjIy45z58O125kXWkB9SQGv3EI1s8UN9kzRG6EXm17:pz9aDV4s1IO6H17
TLSH
T1E4F1BA2998E07842CFC3BD71A7DA4D492130719C6913ABB3F54BA9746F97ADB3760C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TradingView\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 7590bde102b9128112bbf2071211de6967545b45d4431ebd18dfa11581070725
MD5 9f163a60bd350d7446da25aa249e837e
SHA1 055b13b12ab3b104baa5a154f7f8dfe0f1870825
SHA512 fa428bd50cd64ccfc314786cf2f013808cab18cf320074feec9d73d9dce761b7fcee88ef36a7ea3e9562d7ac9cab62a793c9a94f895de415a9ee48d7b9216782
SSDEEP 96:idUjpoRMeEc8VcsqnHkOm3EjIy45z58O125kXWkB9SQGv3a1s8UN9kzRG6Ezm12:sz9aDV4s1I/6L12
TLSH
T13FF1A92998E07842CFC7BD71A7DA4D492030719C6913ABB3F54BA9746F57ADB37A0C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59cf0e.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Code Cache\js\index-dir\the-real-index~RFe59cf0e.TMP
Size 48B
SHA256 fa95ee0ef1a34e72c656c13711f01af756aa6bc7fec7b20a8d3822f2aebc81e4
MD5 033f9b6e1b14305f39599b7ca617f6af
SHA1 96c27565ba1cbdd3fa257c2a740eac741b98689a
SHA512 99f801d741bbd7c90f1833f7638c414d147d1d4c47a0a5c9aeece1c770cf71bbccb46ce862f12c17be666dc3a8279146b2aac5ef4295f1622bd317d67b113337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\TradingView\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\TradingView\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\TradingView\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\TradingView\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\TradingView\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\TradingView\Network\Network Persistent State
Size 1KB
SHA256 c872a43156691a0283687c0d0a7db4b0ab1bf7d759d3f53a5e23a53f4cf0b9b9
MD5 a6ff9026c556f25b462a55b309a3bf0a
SHA1 5e79cba7dfdae1681a9c5761bb61fed08c7cf90e
SHA512 618d96e7515ede2693e89d09b0d87c327ed2cbab0bb849b15ba6eea1da084a495a464b75a910e62b49473cdae0ffe8ff6d5a725ab4f612b110688b82fca4ffbc
TLSH
T19131E6EB87B4057E6762A6F02E252E33C8FD222C075CB99646C4BF1957B3432990178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595308.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Network\Network Persistent State~RFe595308.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\e687f7d4-a913-45d0-8884-1e47e230d969\index-dir\the-real-index
Size 96B
SHA256 48ee20922615363ef36b1c51657f3f4ae390318608ec171a993d736d37e22b80
MD5 868bf28e39bdf869b0aa5b152e9e50c0
SHA1 4fcbc7e9d87fd98b528529577bcc528cef8ed938
SHA512 f3f8b9f08f499cf0178ed297308229440a32bb59b9a4e00cab731209beaf6c09efd69e0d5635743d93f47ec405280effced4cdad5936d246c492d032e9901091
TLSH
T199B022000800C033C02383B800C200EC323C8E3C0383208202AC0FB0C2233A00A30028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596a59.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\e687f7d4-a913-45d0-8884-1e47e230d969\index-dir\the-real-index~RFe596a59.TMP
Size 48B
SHA256 eea21491beb2d52e6802068d5b80c45c874d9c6660fec8e0b6b7a8c152019d7e
MD5 9a15aba8d86e95ac31b5d360e6a9bd9e
SHA1 67ba12023f0afb9293ede2baa157e773902fb99a
SHA512 7bfb692165309f5c4b78f38a92b30c35d96fc7ce695ce1a552f52cc62e9888f360a0b923a5cec1078bab6c1116f1dd924c9bbdb12a045ef472b292fdefa55612
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt
Size 146B
SHA256 8b41d0b26cae884c2b2e30523e0ae6a110695aa59e588aaa8cf7c8522945c4df
MD5 e0e22b6720abef2ce5a0bce8c6a1e1eb
SHA1 9fcdb7517959dd87835f91cb05429056968cae65
SHA512 89ddfafd0ddbcb80afcc729dd20fdb2b95c42a43b320bcfccfbc34116840538229e7e625870e9418ef558bacbafd99817c91db1e3194ae0ebac9ec764876a965
TLSH
T155C02BB7E221AC003C4EC1823031B239DA0631DCCC02E9CC523030091EF0236080073E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe596a97.TMP

Path C:\Users\Admin\AppData\Roaming\TradingView\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt~RFe596a97.TMP
Size 151B
SHA256 5fbebb871a3f7e262511e2f5c01722d29924fd54e1bee1f42bdd400e85fac14d
MD5 1103cd9b69ee9c30ad086c2cc69b38ed
SHA1 4ce988661aa1737b77a191d4d4c5f2aac126d85a
SHA512 e26f3e53109f490945671fd37d82a82b2b4cb9c332e3f3bbcf8bcd7ad0f27cd7bd198e08853591339437373a84c1c84abb56ce56bc026f6108acf6af2d33e294
TLSH
T115C08CA6A13098013D4E8082603192799A062C9C8C01A9C8512130052EB0232080462E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\TradingView\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/1604-125-0x000001FBAFE90000-0x000001FBAFE91000-memory.dmp

Download

memory/1604-124-0x00007FFA48460000-0x00007FFA48461000-memory.dmp

Download

memory/1604-131-0x000001FBAFE60000-0x000001FBAFE8B000-memory.dmp

Download

memory/2916-1372-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1374-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1373-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1384-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1383-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1382-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1381-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1380-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1379-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/2916-1378-0x00000199C8A10000-0x00000199C8A11000-memory.dmp

Download

memory/4220-127-0x000001EAC5AE0000-0x000001EAC5AE1000-memory.dmp

Download

memory/4220-639-0x000001EAC5AB0000-0x000001EAC5ADB000-memory.dmp

Download