Analysis
- user interaction
yes - max time kernel
1055s - max time network
1057s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 04:24
General
- Target Madium-Launcher.exe
- Size 13.0MB
- Sample260422-e1nb2sgz4p
- SHA256 2ee90a1ea33cabb04324c4c81fbf5e10324555daa15a5ce1cca057c12e61b096
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 17 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 7 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Madium-Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Madium-Launcher.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /F /IM Madium.exe /IM Loader.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Madium.exe /IM Loader.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3308.2160.78296906420019478333⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff9d660b078,0x7ff9d660b084,0x7ff9d660b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4468,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4504,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4700,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4124,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=992,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3840,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4684,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4672,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4136,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3880,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4492,i,4505654412052750511,10891060937041877720,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:144⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eaedc728,0x7ff9eaedc734,0x7ff9eaedc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7281923313488652442,13958142780669817258,262144 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,12520283906696691638,962982858860028404,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2304 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,5929632925544423166,18288815832921390497,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2552 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,2198007583958014639,8852062008916135623,2097152 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,3055840444816263698,10311665656564306953,2097152 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,8195323583553630623,3512223720209558127,2097152 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4256 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,3537399704128338294,1055599726213114808,2097152 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,14015534840999353177,14726578237452900574,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4848 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,9330477791343996464,17767581861072606080,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4988 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7980587834212257280,9139683378897298900,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5508,i,17100675447543364665,955514447038022447,2097152 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,2648015161511418209,11901485573141453951,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3668 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3852,i,1258460671896459975,6974795470544839887,2097152 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,2300111671073665783,12361134776239476907,524288 --field-trial-handle=1988,i,16222283914945926925,9493158610641805876,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6100 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eaedc728,0x7ff9eaedc734,0x7ff9eaedc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,53651793405854651,10948044306484881201,262144 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1556,i,14620355011521855263,7886790819383589771,524288 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=1956 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,17889597020100279666,10010083096744041165,524288 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=2264 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,3965153127447262152,3374806127908257605,2097152 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,4277578038178653785,7803518155337543136,2097152 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4412,i,17192813092573503440,2199678949701743741,524288 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=4400 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4572,i,2612750300695847231,12968708435430028430,2097152 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=4584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,94652432465251717,9523565372323560888,524288 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=4768 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,3697009597638515624,3017360393283113200,524288 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5196 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5552,i,16873785328024033751,5163593145492124359,2097152 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,10785897903303549155,13608218729727338252,524288 --field-trial-handle=1908,i,15423445169598945840,17825344540376840688,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 48602⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eaedc728,0x7ff9eaedc734,0x7ff9eaedc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,4091655744126053980,15921662902774602813,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=2020 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,16020840169135965059,6832447143008797075,262144 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,5405233672612611156,15060394839432837325,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=1924 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,12420517260494350417,8998288178282906017,2097152 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,14225750441889538683,10190016591198169156,2097152 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4384,i,15209141457263216445,1250921272470368721,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=4396 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,4179609855320911303,9396084349305509532,2097152 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=4604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,833366533599944056,5535046887473411780,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=4748 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,13367507696501420158,14069885601066837494,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5208 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5552,i,2613430953774014378,13800998510546001489,2097152 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3696,i,7578505216178452135,7099299075461302009,2097152 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3528,i,6392394234042746164,6583853072881485835,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3552 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5612,i,17835213233063338358,4691865727915435752,2097152 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=3800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,8374244670686268792,16352295499968685076,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5884 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,18346613987211480043,1371050177656181786,524288 --field-trial-handle=1992,i,10334267805810325536,1163362787562247705,262144 --variations-seed-version=20260421-170100.624000-production --mojo-platform-channel-handle=5924 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe"C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
-
C:\Windows\SystemTemp\GUMD702.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUMD702.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntCREFGRTAyRC0xODFCLTRDMTktODUwNi04MjM4N0M5MjE4MDR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NTcyOERDMTctNTFGOC00MjhFLTkzM0ItOTQ2RjRFQTIzMkQ5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE1MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI1OTgiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{BDAFE02D-181B-4C19-8506-82387C921804}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\gui1620.tmp"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\gui1620.tmp" --brave-referral-code="BRV010"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=147.1.89.141 --attachment=C:\Windows\SystemTemp\chromium_installer.log --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff65df9aa68,0x7ff65df9aa74,0x7ff65df9aa804⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\gui1620.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{49C59ADB-0E9F-4798-B43A-B791E515829B}\CR_1885C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=147.1.89.141 --attachment=C:\Windows\SystemTemp\chromium_installer.log --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff65df9aa68,0x7ff65df9aa74,0x7ff65df9aa805⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntCREFGRTAyRC0xODFCLTRDMTktODUwNi04MjM4N0M5MjE4MDR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MEFEMUEzNDMtQkUxRS00NkNELTg1MzAtMTg2RDk5QkE5NzczfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntBRkU2QTQ2Mi1DNTc0LTRCOEEtQUY0My00Q0M2MERGNDU2M0J9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNDcuMS44OS4xNDEiIGFwPSJyZWxlYXNlIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly91cGRhdGVzLWNkbi5icmF2ZXNvZnR3YXJlLmNvbS9idWlsZC9CcmF2ZS1SZWxlYXNlL3JlbGVhc2Uvd2luLzE0Ny4xLjg5LjE0MS94NjQvYnJhdmVfaW5zdGFsbGVyLXg2NC5leGUiIGRvd25sb2FkZWQ9IjE0NTI4ODc4NCIgdG90YWw9IjE0NTI4ODc4NCIgZG93bmxvYWRfdGltZV9tcz0iNzkwNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzU0IiBkb3dubG9hZF90aW1lX21zPSI4OTY5IiBkb3dubG9hZGVkPSIxNDUyODg3ODQiIHRvdGFsPSIxNDUyODg3ODQiIGluc3RhbGxfdGltZV9tcz0iMzE5NTUiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=147.1.89.141 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d5967828,0x7ff9d5967834,0x7ff9d59678404⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,11051794629181214774,15793371454250955066,262144 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1944 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2096,i,6916004189293615631,7143783648520754065,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2244 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,13802915440893921730,1009015670803569850,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2428 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3424,i,4383278331690260998,13443855780726879719,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3440 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3468,i,11273972464460278840,9137806593914099687,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3492 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,6460178939642007822,368269074554646501,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5312 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3732,i,3275503093369633604,2521433678916439840,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5304 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,12972785974538948936,1631851069212014467,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5544 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,5711455129400183360,13557763088226432754,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5528 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,17169116301772743769,11053029168176779115,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5812 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,8923918684003782557,11642448299702937685,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5960 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,12927114382577589779,6157567058756599543,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6044 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,2507125580705256400,7447138719593020550,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5548 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6996596648644577120,16608003473123411808,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6032 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,17493874303637343838,981822447781972706,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5808 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,8681884469998727302,10520934297734003013,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5528 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=147.1.89.141 --attachment=C:\Windows\SystemTemp\chromium_installer.log --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7644eaa68,0x7ff7644eaa74,0x7ff7644eaa805⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=147.1.89.141 --attachment=C:\Windows\SystemTemp\chromium_installer.log --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7644eaa68,0x7ff7644eaa74,0x7ff7644eaa806⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,2445975817145643197,9153304556492360916,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5856 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,1475862050786474996,14691223093592459188,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5416 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,13894623954194127817,8319841224399797133,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6104 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,6351166662207658337,616753133090712621,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5408 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,10571703933380994418,12685589595752445427,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=3720 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,9617337021502786955,17177575361807983540,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6324 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,13275259938677622220,10225145199487074554,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6492 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6496,i,4974631159026641286,14310681853996333164,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6416 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6564,i,6670793826147274859,8682324854672787792,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6376 /prefetch:94⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3724,i,13402226864414928923,8137645573543102286,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=3504 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,360236259430893753,2045529561684911052,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=3636 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6016,i,3296102484301179826,2256897180500209035,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=5968 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5996,i,9521463618277633586,9499984970355530321,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=4040 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1272,i,13498174877780491055,17054355503915855708,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=5728 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,9495622056688313568,6189031195465330100,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=3596 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,5807503334934137769,4244434244933285713,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,2331805858957136677,16767098904563271228,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6416,i,4618142774141288004,12544246937403276373,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,5703098184390000709,6791748942158875077,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,17994330539196767138,9386046842099374058,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3544,i,4172900556410956771,8091314402605363889,262144 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=1272 /prefetch:104⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,10487965346733431549,16338851367645142291,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=3464 /prefetch:124⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=3560,i,13729815785237898141,12271802470007304690,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=5540 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5592,i,3426500880025258933,4198306748392642046,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=5632 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5548,i,2200008835169349009,11284748989745361200,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=5480 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6048,i,3191545281747026538,8246527612614274199,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=5748 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6700,i,6277104149368182515,2172021036448325503,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=5860 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5544,i,6842015804605522762,6424043748099859274,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=5480 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5464,i,139714406234176646,6449196945337469092,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=3200 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,10737464433638893325,9467222611302138087,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=6792 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,14747304283097155935,14441296001637144607,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=6908 /prefetch:144⤵
- NTFS ADS
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6752,i,17152642664640026328,5885594488712770313,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=6680 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4040,i,5990127938499432385,3164092967702490196,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=6112 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,11922728263786545410,10839648746235971827,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6756,i,11711609833998355236,14538154550959799744,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=6692 /prefetch:94⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7004,i,13558677378118291086,2968006274996439013,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=6912 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7080,i,17499780875584871915,8483322618239795379,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=6728 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6048,i,12063852305215090232,11948412558698460473,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=7180 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6984,i,9606059983401242921,7270883022484978991,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=7280 /prefetch:94⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7388,i,2462919611552205083,2269404450577736593,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=7412 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7400,i,11496978238860597915,6473348438472125711,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=7284 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7636,i,9925399251349827311,4495027977067425312,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=7616 /prefetch:144⤵
- NTFS ADS
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7636,i,2341312650020272271,6805779344589249204,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=7264 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7272,i,3309836822788211587,7051788121894400025,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=7732 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7672,i,4603535095869317715,13454981100363925647,524288 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=7656 /prefetch:144⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7808,i,12893586510222124955,1381692913381181568,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7832 /prefetch:94⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=5688,i,2756858958267040056,15354302100029937153,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=7712 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7988,i,2362165596363211827,3142619158173176450,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=7840 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7488,i,5486181534838849188,1195967433091042378,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8000 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8140,i,15507276568010510217,14288862062842743613,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=8164 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=7116,i,8365919277764872628,11464256958820796262,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=6660 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=6868,i,5091601562018603020,8215748096414428187,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=5544 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=7792,i,236457448358056437,14193020110090968362,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=7920 /prefetch:14⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=7216,i,10995668760486060934,14959747270938506677,2097152 --field-trial-handle=1940,i,2509095640380437032,6996101217847388883,262144 --variations-seed-version=main@d513b4d7190e8b519c44d5e13604ba2466d8e55d --pseudonymization-salt-handle=2004,i,4104634573311574993,14988992465428647436,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=8140 /prefetch:14⤵
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\147.1.89.141\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
BraveUpdateComRegisterShell64.exe
BraveUpdate.exe
RobloxStudioInstaller.exe
setup.exe
messages.json
crl-set
settings.dat
Preload Data
f_000001
f_000002
f_000003
f_000004
f_000014
f_000015
f_00001d
f_00001e
f_000022
f_000027
f_000030
f_000057
f_00005b
f_00005c
f_00005d
f_00005e
f_00005f
f_000062
f_000066
f_000067
f_000068
f_000069
f_000079
f_00007d
f_000086
f_000087
f_000088
f_000089
f_00008b
f_00008d
f_000092
01f106f565a36b31_0
0915b5e85683bb72_0
0e4ad1c6de90ade1_0
0ef075775c69ab20_0
2ce3f8b24e69f5dd_0
2ed6620f3cf890c1_0
2f41bad2258362f7_0
3075d6c1cc428f3d_0
33893acde9096157_0
3cbea388fc6882fc_0
3d60bb809275db53_0
3d6e1a4601df0a0a_0
3f7f5798bda0f2ba_0
41993505af169b35_0
4647192cc380dca6_0
4c0f5c56a5e5665b_0
504530f6c7a16c18_0
5d74cd4e4ff66bfb_0
766a271c2ab62f16_0
77195b185a2fe572_0
89e99665c9fcaf9e_0
8c604469d73b911e_0
8f343e154c4b47f0_0
90822489e2ee0639_0
9656145e21de2ea1_0
9843211dc0adf611_0
a1c3370f89835ecc_0
a43885731b91e179_0
ab7bafda5bbfe6e1_0
af26e6570f7091cf_0
b370b58e48dabffd_0
bbe1e32b17cfd24c_0
cf50b842cda60219_0
d3e06f5af569ce76_0
e5e19d43a55c7f5c_0
eb55e59acd10d165_0
ff8374e9ae716b37_0
the-real-index
the-real-index
the-real-index
the-real-index
index
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.fbs
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
rules.json
content.js
index.js
fr.svg
verified_contents.json
background.js
content.js
index.html
build.js
index.html
content.js
location.js
index.html
build.js
index.html
build.js
index.html
100.js
101.js
200.js
301.js
302.js
303.js
304.js
304j.js
305.js
306.js
307.js
308.js
501.js
animation-frame-1.png
animation-frame-2.png
icon-blue-16.png
icon-pink-48.png
extend-native-history-api.js
processor.js
requests.js
index.html
offscreen.js
worker.js
build.js
Aileron-bold.otf
Aileron.otf
QR_dev.png
QR_prod.png
android.svg
arrow.svg
bin.svg
eula.svg
hamburger.svg
info.svg
interruption.svg
invite_friends.svg
invite_friends_btn.svg
ios.svg
loading_btn.svg
logo-legacy.svg
logo_with_text.svg
macos.svg
no-internet.svg
pause.svg
play.svg
privacy_policy.svg
products.svg
report_issue.svg
rocket.svg
search.svg
shield-shadow.svg
shield.svg
temporary_unavailable.svg
urban-text.svg
where.svg
windows.svg
verified_contents.json
background.js
index.js.LICENSE.txt
index.html
index.js
index.js.LICENSE.txt
100.js
101.js
200.js
301.js
302.js
303.js
304.js
304j.js
305.js
306.js
307.js
308.js
501.js
manifest.json
popup.js
popup.js.LICENSE.txt
Satoshi-Variable.ttf
checkmark.svg
close.svg
ad.svg
ae.svg
af.svg
ag.svg
ai.svg
al.svg
am.svg
ao.svg
aq.svg
ar.svg
as.svg
at.svg
au.svg
auto_server.svg
aw.svg
ax.svg
az.svg
ba.svg
bb.svg
bd.svg
be.svg
bf.svg
bg.svg
bh.svg
bi.svg
bj.svg
bl.svg
bm.svg
bn.svg
bo.svg
bq.svg
br.svg
bs.svg
bt.svg
bv.svg
bw.svg
by.svg
bz.svg
ca.svg
cc.svg
cd.svg
cf.svg
cg.svg
ch.svg
ci.svg
ck.svg
cl.svg
cm.svg
cn.svg
co.svg
cr.svg
cu.svg
cv.svg
cw.svg
cx.svg
cy.svg
cz.svg
de.svg
dj.svg
dk.svg
dm.svg
do.svg
dz.svg
ec.svg
ee.svg
eg.svg
eh.svg
er.svg
es.svg
et.svg
eu.svg
fi.svg
fj.svg
fk.svg
fm.svg
fo.svg
ga.svg
gb-eng.svg
gb-nir.svg
gb-sct.svg
gb-wls.svg
gb.svg
gd.svg
ge.svg
gf.svg
gg.svg
gh.svg
gi.svg
gl.svg
gm.svg
gn.svg
gq.svg
gr.svg
gs.svg
gt.svg
gu.svg
gw.svg
gy.svg
hk.svg
hm.svg
hn.svg
hr.svg
ht.svg
hu.svg
id.svg
ie.svg
il.svg
im.svg
in.svg
io.svg
iq.svg
ir.svg
is.svg
it.svg
je.svg
jm.svg
jo.svg
jp.svg
ke.svg
kg.svg
kh.svg
ki.svg
km.svg
kn.svg
kp.svg
kr.svg
kw.svg
ky.svg
kz.svg
la.svg
lb.svg
lc.svg
li.svg
lk.svg
lr.svg
ls.svg
lt.svg
lu.svg
lv.svg
ly.svg
ma.svg
mc.svg
md.svg
me.svg
mg.svg
mh.svg
mk.svg
ml.svg
mm.svg
mn.svg
mo.svg
mp.svg
mq.svg
mr.svg
ms.svg
mt.svg
mu.svg
mv.svg
mw.svg
mx.svg
my.svg
mz.svg
na.svg
ne.svg
nf.svg
ng.svg
ni.svg
nl.svg
np.svg
nr.svg
nu.svg
nz.svg
om.svg
pa.svg
pe.svg
pf.svg
pg.svg
ph.svg
pk.svg
pl.svg
pn.svg
pr.svg
ps.svg
pt.svg
pw.svg
py.svg
qa.svg
ro.svg
rs.svg
ru.svg
rw.svg
sa.svg
sb.svg
sc.svg
sd.svg
se.svg
sg.svg
sh.svg
si.svg
sk.svg
sl.svg
sm.svg
sn.svg
so.svg
sr.svg
ss.svg
st.svg
sv.svg
sx.svg
sy.svg
sz.svg
tc.svg
td.svg
tf.svg
tg.svg
th.svg
tj.svg
tk.svg
tl.svg
tm.svg
tn.svg
to.svg
tr.svg
tt.svg
tv.svg
tw.svg
tz.svg
ua.svg
ug.svg
um.svg
un.svg
uy.svg
uz.svg
va.svg
vc.svg
ve.svg
vg.svg
vi.svg
vn.svg
vu.svg
wf.svg
ws.svg
xk.svg
ye.svg
za.svg
zm.svg
zw.svg
high.svg
icon-128.png
icon-48.png
icon-blue.png
icon.png
loader.svg
logo-with-text.svg
logo.svg
low.svg
main-bottom.svg
max.svg
medium.svg
menu.svg
normal.svg
polygon.svg
poor.svg
progress.svg
settings.svg
shield-background.png
shield-shadow.svg
spider.svg
stars.svg
start.svg
content-styles.css
resource.js
index.js.LICENSE.txt
Google Profile.ico
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe63eda1.TMP
Preferences
Preferences~RFe63be93.TMP
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences~RFe63ec3a.TMP
the-real-index
the-real-index
the-real-index~RFe6718ca.TMP
download_file_types.pb
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe63be16.TMP
cr_en-us_500000_index.bin
p3a_manifest.json
crs.pb
ct_config.pb
kp_pinslist.pb
ssl_error_assistant.pb
safety_tips.pb
list.txt
clean-urls-permissions.json
clean-urls.json
debounce.json
https-upgrade-exceptions-list.txt
webcompat-exceptions.json
intricate-explorer.jpg
photo.json
rod-long.jpg
list.txt
list.txt
resources.json
00504d8f6fcff62b73c70f65a963a475913d6d44544045089b6884f944125ed6
00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
08ba369ed7d473e0c791f706487e0cc7e8c40d2de2c0bc864f019c2e85c3d316
1dea841c75c8bc448f7dc024d09e62dddf6bd8326c04d59c43bfebbc355bcf3e
23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
2434c8429b4cc0cc607d25e738a48012270e8a21a586f8e0c80b4a75711acd39
261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
3330412a1b9d7ad1b88bd77f47b488c486c075db883c66293414512729ac15de
3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
70f69d30a09def46bbfc68c42482a9023320f981e0782a322a7b262d495bd4fe
78d7842c375771daea1ce1e8e53076e1af9c26bba2711cbdc9807b81301c4ce3
7d846b6f9e5ebc3a524f21fb946c10d7a54129bb05a9c9adf8b4827e20be7de1
7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
907f45112c85be3efde1fe6267ebfa0a974289ccbbebe20fc2103476c16095e3
98c6f5b7b1c5379bc01cf958ce86dcd03265924665310c4feac90c0ce1bfe00d
9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
c47a70a7a176cf7f1a8fbc15b4aa8686e80ccbf94ed4142b0a924a96b9d024af
c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
c7fd501f8fb814805214c7c0d5907f7ed46d8e995bc9066a2c99e9b87dc9dc25
cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
e36fb13380b21ee6c48c50b72b5c2f3536998109eda084a214c4f1b176f60d26
ec1e07abf57f91c1325f48f968d9862dc472b063db7db0405ae5ef4ea1f4bdec
metadata.json
metadata.json
metadata.json~RFe64aa6a.TMP
campaigns.json
list_catalog.json
resources.json
list.txt
list.txt
resources.json
campaigns.json
brave-checks.txt
2cf6bd01-1ffc-4491-ac3f-b05d002c9ae5.tmp
CrashpadMetrics-active.pma
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index
Favicons
History
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
000003.log
LOG
the-real-index
the-real-index~RFe5d5631.TMP
Tabs_13421305819764694
000003.log
LOG
LOG
QuotaManager
000003.log
LOG
000003.log
LOG
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
metadata.json
ukm_db
SearchHoverUnifiedTileModelCache.dat
messages.json
messages.json
index.js
index.js.LICENSE.txt
index.html
index.html
nc.svg
no.svg
us.svg
index.js
almalgbpmcfpdaopimbdchdliminoign_3886.crx
messages.json
messages.json
icon-pink-128.png
icon-pink-128.png
manifest.json
index.html
index.js
eppiocemhmnlbhjplcgkofciiegomcon_55849.crx
eppiocemhmnlbhjplcgkofciiegomcon_55849.crx:Zone.Identifier
3162f6db-cfd2-45ab-b759-1772b6cadad0.tmp
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State~RFe59cab9.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity~RFe621f79.TMP
Preferences
Preferences
Preferences~RFe594387.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe58a2f2.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
manifest.fingerprint
keys.json
Madium.exe
Brave.lnk
default.dic
407962ce3d4220f.customDestinations-ms
407962ce3d4220f.customDestinations-ms
407962ce3d4220f.customDestinations-ms
407962ce3d4220f.customDestinations-ms
407962ce3d4220f.customDestinations-ms
BraveBrowserSetup-BRV010.exe
RobloxPlayerInstaller.exe
RobloxPlayerInstaller.exe:Zone.Identifier
manifest.json
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
manifest.json
manifest.json
photo.json
manifest.json
2297758d-3212-4024-83a0-daa8e037403b.png
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
ranked_dicts
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
crl-set
manifest.json
Staging
manifest.json
manifest.json
memory/244-1730-0x000001DB67A70000-0x000001DB67A7C000-memory.dmp
memory/1068-2005-0x0000023C1D820000-0x0000023C1D82C000-memory.dmp
memory/1208-3215-0x00000000018E0000-0x0000000001944000-memory.dmp
memory/1572-10767-0x0000000001DA0000-0x0000000001E04000-memory.dmp
memory/1648-10727-0x0000000002230000-0x0000000002294000-memory.dmp
memory/1808-2670-0x0000000003600000-0x0000000003664000-memory.dmp
memory/2256-4749-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4742-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4743-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4741-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4747-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4748-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4750-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4752-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2256-4751-0x000001B853470000-0x000001B853471000-memory.dmp
memory/2564-28-0x0000027196970000-0x000002719697C000-memory.dmp
memory/2564-2-0x00007FF61D990000-0x00007FF61EEC6000-memory.dmp
memory/2564-39-0x0000027196970000-0x000002719697C000-memory.dmp
memory/2564-0-0x00007FF61D9E3000-0x00007FF61E1CE000-memory.dmp
memory/2564-1-0x00007FF9F5CF0000-0x00007FF9F5CF2000-memory.dmp
memory/2564-27-0x00007FF61D9E3000-0x00007FF61E1CE000-memory.dmp
memory/2564-5-0x00007FF61D990000-0x00007FF61EEC6000-memory.dmp
memory/2564-48-0x00007FF61D9E3000-0x00007FF61E1CE000-memory.dmp
memory/2564-46-0x00007FF61D990000-0x00007FF61EEC6000-memory.dmp
memory/2564-45-0x00007FF61D990000-0x00007FF61EEC6000-memory.dmp
memory/2628-2793-0x0000000001780000-0x00000000017E4000-memory.dmp
memory/2628-3213-0x0000000001780000-0x00000000017E4000-memory.dmp
memory/2840-268-0x000002A03FA60000-0x000002A03FDD8000-memory.dmp
memory/2840-68-0x00007FF9F44F0000-0x00007FF9F44F1000-memory.dmp
memory/2840-2008-0x000002A03FA60000-0x000002A03FDD8000-memory.dmp
memory/2840-1271-0x000002A03FA60000-0x000002A03FDD8000-memory.dmp
memory/2948-1973-0x000001B41FA40000-0x000001B41FA4C000-memory.dmp
memory/2956-2657-0x0000000002890000-0x00000000028F4000-memory.dmp
memory/3224-1970-0x000001E0324F0000-0x000001E0324FC000-memory.dmp
memory/3380-3206-0x0000000002E80000-0x0000000002EE4000-memory.dmp
memory/3644-3216-0x0000000001F80000-0x0000000001FE4000-memory.dmp
memory/3644-2796-0x0000000001F80000-0x0000000001FE4000-memory.dmp
memory/4140-2682-0x0000000003120000-0x0000000003184000-memory.dmp
memory/4220-2794-0x0000000002930000-0x0000000002994000-memory.dmp
memory/4220-3211-0x0000000002930000-0x0000000002994000-memory.dmp
memory/4460-1999-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1994-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1990-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1989-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1988-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1995-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1998-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1997-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4460-1996-0x000001F72A9D0000-0x000001F72A9D1000-memory.dmp
memory/4580-2683-0x00000000027E0000-0x0000000002844000-memory.dmp
memory/4600-625-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-613-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-622-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-621-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-624-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-623-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-620-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-615-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-619-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4600-614-0x00000252C3490000-0x00000252C3491000-memory.dmp
memory/4860-1746-0x0000000001890000-0x00000000018F4000-memory.dmp
memory/4860-1613-0x0000000001890000-0x00000000018F4000-memory.dmp
memory/5148-2684-0x0000000002F70000-0x0000000002FD4000-memory.dmp
memory/5408-3207-0x00000000027A0000-0x0000000002804000-memory.dmp
memory/5408-3208-0x0000000002DC0000-0x0000000002E8B000-memory.dmp
memory/5408-2795-0x00000000027A0000-0x0000000002804000-memory.dmp
memory/5804-281-0x0000020389C00000-0x0000020389F78000-memory.dmp
memory/5804-151-0x00007FF9F44F0000-0x00007FF9F44F1000-memory.dmp
memory/5908-1959-0x0000016156350000-0x000001615635C000-memory.dmp
memory/7184-10700-0x0000000001540000-0x00000000015A4000-memory.dmp