Overview

overview

6

Static

static

1

BraveBrows...10.exe

windows10-2004-x64

BraveBrows...10.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/06/2026, 22:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BraveBrowserSetup-BRV010.exe
  • Size 1.2MB
  • Sample260619-2j2vfac13y
  • SHA256 be0c2da77880af79ab780ae8a2deab8ca8470724743411d6fd2989a325cdffb0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 58 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe
    "C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Windows\SystemTemp\GUM36.tmp\BraveUpdate.exe
      C:\Windows\SystemTemp\GUM36.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3152
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4716
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:5336
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3900
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InswNUM5MEQ4QS04MDE5LTQzQzQtOTlBQy1CRkFEN0QxNTA3MEN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7Qjc1NTZCMEItNERBNC00RjY1LTk4MDAtNzJBQzEyOEE0QjA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTA1OSIvPjwvYXBwPjwvcmVxdWVzdD4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1492
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{05C90D8A-8019-43C4-99AC-BFAD7D15070C}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1304
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\gui59A1.tmp"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5128
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\gui59A1.tmp" --brave-referral-code="BRV010"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1548
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.175 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff6f77a4aa8,0x7ff6f77a4ab4,0x7ff6f77a4ac0
          4⤵
          • Executes dropped EXE
          PID:2132
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\gui59A1.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1532
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{66BE56BC-DEC9-4C88-8D96-05F51B09C733}\CR_7CCCD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.175 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff6f77a4aa8,0x7ff6f77a4ab4,0x7ff6f77a4ac0
            5⤵
            • Executes dropped EXE
            PID:1044
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InswNUM5MEQ4QS04MDE5LTQzQzQtOTlBQy1CRkFEN0QxNTA3MEN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MDVGREY1RDUtNzZEMC00NzlBLTgzNTYtNzE2Qzc3NkUxNzdGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTQ5LjEuOTEuMTc1IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNDkuMS45MS4xNzUveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNDgyODM0NzIiIHRvdGFsPSIxNDgyODM0NzIiIGRvd25sb2FkX3RpbWVfbXM9IjEyNTgzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNTMiIGRvd25sb2FkX3RpbWVfbXM9IjEzNzQzIiBkb3dubG9hZGVkPSIxNDgyODM0NzIiIHRvdGFsPSIxNDgyODM0NzIiIGluc3RhbGxfdGltZV9tcz0iNDQxMzMiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1756
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2960
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:260
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5504
  • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
    "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5772
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5328
      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.175 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffab027fa60,0x7ffab027fa6c,0x7ffab027fa78
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1708
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1916,i,5819684282991829203,2366365579903183367,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2080 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:3684
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,16606576786303444685,513991682424253177,262144 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2020 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3432
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2520,i,8836808027550174250,7040633769308388898,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2696 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5864
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3380,i,12309028201467053638,4283323195340397547,2097152 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3384 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4288
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3420,i,4217140958660527777,7410936079486299119,2097152 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3428 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5584
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,2208747811570298907,7149824215926167182,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5540 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3400
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,1087383447632024518,17226789079595207669,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5668 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4408
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,304434000983071639,17132758635249779978,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5820 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3552
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,15939418038323971075,7790262744664947894,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5972 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5944
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,4375908770245486756,6570478729652182495,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6128 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5856
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,10557321527829516329,3305322268426258121,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6268 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3148
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,12322800359523518048,612190211281462450,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5828 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6244
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,11170842606351595723,11265643205059116540,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5872 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6364
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6524
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.175 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff68dbf4aa8,0x7ff68dbf4ab4,0x7ff68dbf4ac0
            5⤵
            • Executes dropped EXE
            PID:6624
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:6664
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.175 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff68dbf4aa8,0x7ff68dbf4ab4,0x7ff68dbf4ac0
              6⤵
              • Drops file in Windows directory
              • Executes dropped EXE
              PID:6680
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,13753149132851393165,7934927774532908295,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6048 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6612
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,13783812512697352704,10624745306538598048,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5836 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6848
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,958644604445849648,16910728248687384608,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6324 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6832
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,730352952678950678,10873189689115321135,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6348 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6840
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,14088076961409646151,4362909793548180580,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6268 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6856
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,10004326578317114452,10940980527777504272,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6356 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6864
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,17405357664602731280,10084761802673809632,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6692 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4504
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,3961816501234890489,2017206320554157111,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6884 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6236
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6892,i,1453937337814166432,17136343172796134013,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6972 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6360
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,316297269705235126,15900708338898853974,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5676 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6484
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6944,i,17030764976274998099,1592251538602525206,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=5932 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:2460
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6980,i,4297020691322414998,15044540401217782312,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6948 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6864
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6872,i,867208347503770122,18440429898478686096,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6984 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6284
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6940,i,11914748989957660197,10713626326278299069,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7000 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6436
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6884,i,17974541529812581341,4087533797645413849,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6868 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6464
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,5320900319600914606,9549499104666760047,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=6788 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6820
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,9277195388647979903,9118123565562151820,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=6924 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:7052
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6948,i,10931015267320465651,7608725604190506659,524288 --field-trial-handle=2024,i,8852580211897915014,1412922161710121238,262144 --variations-seed-version=main@e301d3265c8a09b90b9505aa1196b279958e26b5 --pseudonymization-salt-handle=2028,i,5491633677192317804,8747546793794854812,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=6084 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:7164
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.175\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1464
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:2876
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:3308

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          messages.json
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1548_129774961\Chrome-bin\149.1.91.175\resources\brave_extension\_locales\sr\messages.json
          • Size 9KB
          • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8ef12afc-6f54-4028-93a8-9fcadf210f13.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\8ef12afc-6f54-4028-93a8-9fcadf210f13.tmp
          • Size 10KB
          • SHA256 80ff8cbac32651d87671844010f316de323cb2ee363dd3abf05a7e236bc35c8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          818d67c9-72a7-4cf4-a7af-f4004b98254e.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\818d67c9-72a7-4cf4-a7af-f4004b98254e.tmp
          • Size 165KB
          • SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extension Rules\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          45571e3f-4e25-4197-9653-70a4e45c3092.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\45571e3f-4e25-4197-9653-70a4e45c3092.tmp
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
          • Size 301B
          • SHA256 abc8902ec27ba8781e33b2fac0fd060bdb784cc62704faf547299dedaff33e03
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
          • Size 19KB
          • SHA256 ecc04777d92520cdd8dd580c3badbfee3162e935c72a7ab8c9f1d21621ca4c88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          dceb2f2b-858f-417d-93fa-587e343150e4.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\dceb2f2b-858f-417d-93fa-587e343150e4.tmp
          • Size 3KB
          • SHA256 ed7d107967aff2d9fb8784a188c0aede1dbea8a5014d2981946d4690c23aeba0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 65KB
          • SHA256 c68d7be7fd8739088c3e0bc47110759b9bd00cc9ad9bfe13562d394cce362b7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 53KB
          • SHA256 2fc7f8e4b0f87c473ca3d6b3e3de2dd10dbb622f9068137b9d05e89ad2ca5b9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 54KB
          • SHA256 92dfda9b66096f9eef1598477cd7a612428e95689e34ac08419c64799e6a78e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
          • Size 17.8MB
          • SHA256 00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          047e487a9deca5926772de2a5c8c7c56410d34ac47d67ae6b4d9b2535634a1dc
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\047e487a9deca5926772de2a5c8c7c56410d34ac47d67ae6b4d9b2535634a1dc
          • Size 372KB
          • SHA256 047e487a9deca5926772de2a5c8c7c56410d34ac47d67ae6b4d9b2535634a1dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
          • Size 7.6MB
          • SHA256 23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Size 11KB
          • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
          • Size 5KB
          • SHA256 3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          4f10b9cc1cd9c5cf22dc9fd9fd4dfae2007599a429856e2473f8b6d2a8ba0fdc
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\4f10b9cc1cd9c5cf22dc9fd9fd4dfae2007599a429856e2473f8b6d2a8ba0fdc
          • Size 12KB
          • SHA256 4f10b9cc1cd9c5cf22dc9fd9fd4dfae2007599a429856e2473f8b6d2a8ba0fdc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
          • Size 857KB
          • SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          563e60cd9dc4521592e54d7961667ab4edde9410f006b61e4be8fcc2d49e06a1
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\563e60cd9dc4521592e54d7961667ab4edde9410f006b61e4be8fcc2d49e06a1
          • Size 474KB
          • SHA256 563e60cd9dc4521592e54d7961667ab4edde9410f006b61e4be8fcc2d49e06a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          629b3489d172a2cf458dce2c4784b65c9bcf4bbbc242596df78dd7a542f53779
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\629b3489d172a2cf458dce2c4784b65c9bcf4bbbc242596df78dd7a542f53779
          • Size 3.3MB
          • SHA256 629b3489d172a2cf458dce2c4784b65c9bcf4bbbc242596df78dd7a542f53779
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          68d1def84361a98440f16ea1dcb16f420cdd0d51bf7356b0cfb5944fa4f30d35
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\68d1def84361a98440f16ea1dcb16f420cdd0d51bf7356b0cfb5944fa4f30d35
          • Size 5KB
          • SHA256 68d1def84361a98440f16ea1dcb16f420cdd0d51bf7356b0cfb5944fa4f30d35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          6b1a0e34-4563-4fb5-966e-7452b6098087.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\6b1a0e34-4563-4fb5-966e-7452b6098087.tmp
          • Size 1KB
          • SHA256 6127a6bbadd8f7cb8de625d4f816326fe59f3d1a11ccad9db25cb869d56b3e6c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7184156f4ddeb4de33fffc88c32141f2a907f4b6aca7bb0898568d4e8454eabc
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7184156f4ddeb4de33fffc88c32141f2a907f4b6aca7bb0898568d4e8454eabc
          • Size 1.5MB
          • SHA256 7184156f4ddeb4de33fffc88c32141f2a907f4b6aca7bb0898568d4e8454eabc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          71cbb1337f8b3d7023c4ba8e14a34db7afa4c9df2574d008bb039e2df8c2d0cb
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\71cbb1337f8b3d7023c4ba8e14a34db7afa4c9df2574d008bb039e2df8c2d0cb
          • Size 283KB
          • SHA256 71cbb1337f8b3d7023c4ba8e14a34db7afa4c9df2574d008bb039e2df8c2d0cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          78ec1c1bb9042d4ef117496c3a6dfd832c48adc1cf92742f36ed9b5a6dad8feb
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\78ec1c1bb9042d4ef117496c3a6dfd832c48adc1cf92742f36ed9b5a6dad8feb
          • Size 254KB
          • SHA256 78ec1c1bb9042d4ef117496c3a6dfd832c48adc1cf92742f36ed9b5a6dad8feb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
          • Size 12KB
          • SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Size 7KB
          • SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
          • Size 184KB
          • SHA256 9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Size 14KB
          • SHA256 acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          b309ef0ceecb85b42979e839c629d7e7306aba6f38a70efde86afeeb1565b14a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\b309ef0ceecb85b42979e839c629d7e7306aba6f38a70efde86afeeb1565b14a
          • Size 472KB
          • SHA256 b309ef0ceecb85b42979e839c629d7e7306aba6f38a70efde86afeeb1565b14a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          c0a13b0845bc3ac27007171296fcb13b729831d66d2c7c65785c78a1b87ad514
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c0a13b0845bc3ac27007171296fcb13b729831d66d2c7c65785c78a1b87ad514
          • Size 3.3MB
          • SHA256 c0a13b0845bc3ac27007171296fcb13b729831d66d2c7c65785c78a1b87ad514
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
          • Size 1.1MB
          • SHA256 c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Size 3KB
          • SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          d6d6a87ab10eb71dfb46a121d9499fc33bdca564fb302341504b949678525506
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\d6d6a87ab10eb71dfb46a121d9499fc33bdca564fb302341504b949678525506
          • Size 19KB
          • SHA256 d6d6a87ab10eb71dfb46a121d9499fc33bdca564fb302341504b949678525506
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          eab918f94c8f89c28caaa543c4fd972044e2176034ae1593555b5cf008fd4c58
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\eab918f94c8f89c28caaa543c4fd972044e2176034ae1593555b5cf008fd4c58
          • Size 88KB
          • SHA256 eab918f94c8f89c28caaa543c4fd972044e2176034ae1593555b5cf008fd4c58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fdaacce7677df8e921eb0d4d179a8584c911de797043a8593e19c570b3db7452
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\fdaacce7677df8e921eb0d4d179a8584c911de797043a8593e19c570b3db7452
          • Size 48KB
          • SHA256 fdaacce7677df8e921eb0d4d179a8584c911de797043a8593e19c570b3db7452
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ff120c1532596b77ad7b4ad43f94f68a555f4e8de8c6b95664b4529a9a26d5aa
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ff120c1532596b77ad7b4ad43f94f68a555f4e8de8c6b95664b4529a9a26d5aa
          • Size 1.5MB
          • SHA256 ff120c1532596b77ad7b4ad43f94f68a555f4e8de8c6b95664b4529a9a26d5aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
          • Size 1KB
          • SHA256 51538c6b0145e9f3cb0ed75c4c7ad26635f494857d05cbf30d5d07fcae0b1a5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7cc0f584-f9b2-4095-a841-dec2e6408b55.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\5c32d4f4-821e-4c60-aaf8-c2a19b08e18e\7cc0f584-f9b2-4095-a841-dec2e6408b55.png
          • Size 31KB
          • SHA256 5115310b76748565122cd676f89b57944b6f1405a4bd6d9d78359b0db30053e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f2a6c0b9-f49a-4bb5-88d1-0b6a3c780ebe.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\6087d941-5649-484b-8597-2eeb42d9e30a\f2a6c0b9-f49a-4bb5-88d1-0b6a3c780ebe.png
          • Size 31KB
          • SHA256 4a55d2db96ace3c79eb4264be0bf8f561ed2c160a892cbaa718e9a0eb4042c49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          verified_contents.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\brave_metadata\verified_contents.json
          • Size 8KB
          • SHA256 1c1cb1db61f40ed3dfc0af66f0814026dcca7d8a7697b91ae31bca1903879cfe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          campaigns.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\campaigns.json
          • Size 5KB
          • SHA256 ff24708b84b983af0c46e2907e3a3aea54f0cbd74f34ecddee7d27b012f7920f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
          • Size 341KB
          • SHA256 2a54364257349b6c145fa4dd7ec41d3e0b8ab3144205b6f0cd58578aa370e671
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ask-brave-icon-DdJTJrmV.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\ask-brave-icon-DdJTJrmV.webp
          • Size 2KB
          • SHA256 3788d823c7714a2e36547bd5fe86c834b86cb6c182858e047789aee196f1f598
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          de-de-wie-oft-hat-deutschland-die-fifa-weltmeisterschaft-gewonnen.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-oft-hat-deutschland-die-fifa-weltmeisterschaft-gewonnen.webp
          • Size 87KB
          • SHA256 e6eee01c4a960376f8a869a9c4d0147b7ae82735b52c4ceff7c81507947fe288
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de-de-wie-schlaft-ein-bar-im-winterschlaf.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-schlaft-ein-bar-im-winterschlaf.webp
          • Size 84KB
          • SHA256 63b446f4b75ba1d1875be2b0e20f400ec3f96bca8394f66bf8660eea9a1304fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de-de-wie-viele-burgen-und-schlosser-gibt-es-in-deutschland.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-viele-burgen-und-schlosser-gibt-es-in-deutschland.webp
          • Size 82KB
          • SHA256 e89556bb39055895cc561fc1a3ceabedd7cf0d2eb0ff68728bd0f795f1a81906
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-ca-which-canadian-players-are-ones-to-watch-at-the-2026-fifa-world-cup.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-which-canadian-players-are-ones-to-watch-at-the-2026-fifa-world-cup.webp
          • Size 87KB
          • SHA256 629e1c1566722ea38b64f3bff5fec7da894ea9d0033275b68f37a0ca658a0a94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-ca-why-do-geese-fly-in-a-v-formation.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-why-do-geese-fly-in-a-v-formation.webp
          • Size 79KB
          • SHA256 ba41b919b0476e121f01e53b23721bd0ed046cfe31b536adb8b847a4d7170ad6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-ca-why-does-canada-have-so-many-lakes.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-why-does-canada-have-so-many-lakes.webp
          • Size 122KB
          • SHA256 d55809b419cd2a5bdf63af6d30f98941b2e6f2486de47b216431ab72b4f83bf1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-gb-why-does-the-uk-get-so-much-more-rain-than-the-rest-of-europe.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-why-does-the-uk-get-so-much-more-rain-than-the-rest-of-europe.webp
          • Size 86KB
          • SHA256 328585aa6a3540b014e1fcf96072d3c025be5408d44f330a2eb4f6e4d55996f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-gb-why-is-dizzy-from-codemasters-an-egg.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-why-is-dizzy-from-codemasters-an-egg.webp
          • Size 78KB
          • SHA256 4ae12d3e50c6150c13c056c7892dd25d1ad19dd986985fa4a82afbde85501c4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-gb-why-is-england-considered-the-home-of-modern-football.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-why-is-england-considered-the-home-of-modern-football.webp
          • Size 92KB
          • SHA256 85b0778ad1760887e909f14c5758818cdbe5774e42cc3ad7d8192d0f6b06c99f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-us-how-many-bones-do-sharks-have.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-how-many-bones-do-sharks-have.webp
          • Size 61KB
          • SHA256 140b9c88d4ce610d54b411a30b0ef98bdd007cfcbb96bb2da69c11b2c63d6c9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-us-which-usmnt-players-are-ones-to-watch-at-the-2026-fifa-world-cup.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-which-usmnt-players-are-ones-to-watch-at-the-2026-fifa-world-cup.webp
          • Size 85KB
          • SHA256 0a6ef140f0802833a54adf994a4d9c58d07308b36e0d7d4bf596d28d53f7ca2b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-us-why-do-tornadoes-form-in-tornado-alley.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-why-do-tornadoes-form-in-tornado-alley.webp
          • Size 83KB
          • SHA256 9cfb24d66dafd02f82ad495d4a03d56eda4b1492a114cb6de32a02ae9e2d6cea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-us-cuales-son-las-estrellas-latinoamericanas-del-mundial-fifa-2026.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-cuales-son-las-estrellas-latinoamericanas-del-mundial-fifa-2026.webp
          • Size 74KB
          • SHA256 50f701ede827f31fc2089d12670db6d1e4845b8089182a71c95ae39f7c551599
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-us-cuantos-hispanohablantes-hay-en-estados-unidos.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-cuantos-hispanohablantes-hay-en-estados-unidos.webp
          • Size 73KB
          • SHA256 d520fa456dab2e0b25266ad0e978ea2bdd62ed7156c10b0e7c79bbf468a3e75b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-us-por-que-los-tacos-se-hicieron-tan-populares-en-todo-el-mundo.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-tacos-se-hicieron-tan-populares-en-todo-el-mundo.webp
          • Size 85KB
          • SHA256 45f525127b6720d412bf10574b63c5d3d92fd4218c51bf80a8c1888b5c94eb57
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-ca-combien-de-matchs-de-la-coupe-du-monde-fifa-2026-se-joueront-au-canada.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-combien-de-matchs-de-la-coupe-du-monde-fifa-2026-se-joueront-au-canada.webp
          • Size 71KB
          • SHA256 1fec1ebbebd5ed01a958cc31d3f4797f9b2eb343ea4991a4d4fc9416129b5e6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-ca-pourquoi-le-castor-est-il-le-symbole-du-canada.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-le-castor-est-il-le-symbole-du-canada.webp
          • Size 104KB
          • SHA256 38be772a363f79bd2ceae4b74e84941ea3609319f41b8014f4a84b4d1a68b19c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-ca-pourquoi-les-aurores-boreales-sont-elles-visibles-au-canada.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-les-aurores-boreales-sont-elles-visibles-au-canada.webp
          • Size 79KB
          • SHA256 cf3588aa406698aec361b51f63b8b9e901f1556d8e9462026d1e6925d546d9e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-fr-combien-de-buts-kylian-mbappe-a-t-il-marques-en-coupe-du-monde-fifa.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-combien-de-buts-kylian-mbappe-a-t-il-marques-en-coupe-du-monde-fifa.webp
          • Size 100KB
          • SHA256 fd96ee7076e34c315cfdebfb71b43d148818ace4d548e7e0f088dc8d9e0ef149
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-fr-pourquoi-la-tour-eiffel-retrecit-elle-en-hiver.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-la-tour-eiffel-retrecit-elle-en-hiver.webp
          • Size 77KB
          • SHA256 50792bc18866c771e2b4e843640af1206b70ea10f87b57a35c503479926c1a1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-fr-pourquoi-mange-t-on-des-escargots-en-france.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-mange-t-on-des-escargots-en-france.webp
          • Size 78KB
          • SHA256 de9abe961383605cc177cab996bbae6febcc546fc6584328fca757288b5cd4f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index-C8g22OGQ.css
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-C8g22OGQ.css
          • Size 30KB
          • SHA256 19b099627396007cfcf21d64ed208361dce53926523439f3102fb7ee96323ad4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index-DIxXAQ8B.js
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-DIxXAQ8B.js
          • Size 204KB
          • SHA256 3bb1e09dd8d40b0285093802c9d5af3387dfa4c2a378bacdc7d36fb774329dad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index.html
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index.html
          • Size 4KB
          • SHA256 bd6757f0a35dbae885268901830b3df76b84f7b13453bef62036c3593d6c1480
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\logo.webp
          • Size 6KB
          • SHA256 fbe1831f3abb9be1d5b81785055bac244f70553e51a25556f558c31cb2ac6e37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mouse-pointer-DSDsXotA.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\mouse-pointer-DSDsXotA.webp
          • Size 136B
          • SHA256 c53bc691edd32cbc245bdd461b5fc36ef21afc3d8e4304f0df49119204e0b0ff
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          search-icon-BD6Rfjhr.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-icon-BD6Rfjhr.webp
          • Size 1KB
          • SHA256 02f34d12e8f5f7a2838bde1be407fe1f9815dae8678cd6c77c7c031a6f41d8df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          search-logo.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-logo.webp
          • Size 5KB
          • SHA256 3a1dec651528a4b789020b9bc240f7c7a1ffef36cc3024095cc6c6c73da7ec85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wallpaper.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\ebec0987-c5ed-4874-8fbf-032c1cc6da91\wallpaper.webp
          • Size 38B
          • SHA256 2f9a4c22931833a8fc296bf89b86d94eec618752a62a1add43b753a77c80852b
          • MD5 SHA1 SHA512
          Submit Download

          927a146a-a090-4bfe-b53a-964648e05ab0.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\f428010a-1319-4e52-b8de-280dc6d8f181\927a146a-a090-4bfe-b53a-964648e05ab0.png
          • Size 29KB
          • SHA256 f670a1c3b1f3a16930d5d93789a7211b4778e11554280076b0b2651c8971e21c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          d96ba295-cb62-46c4-9fe3-7318aa22b075.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\f732144d-adf8-488e-8393-b0ca2a7c6101\d96ba295-cb62-46c4-9fe3-7318aa22b075.png
          • Size 32KB
          • SHA256 52ebe087b313ae6d29db6e4574345aa133e20cbe783642f363bd5840949c2634
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          photo.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_1192308766\photo.json
          • Size 50B
          • SHA256 c9b5c6de15d08254da3d561470114637abdf1715f2b24b4747152fd774d81bac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1cd59de4-791e-4a3d-9f1f-886c5ec70a96.jpg
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1368_209856119\f732144d-adf8-488e-8393-b0ca2a7c6101\1cd59de4-791e-4a3d-9f1f-886c5ec70a96.jpg
          • Size 280KB
          • SHA256 b07a8f015064056d4e1867a44b4b27f90b146d071ee7aedae9e51fdc2894378b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandler.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveCrashHandler.exe
          • Size 270KB
          • SHA256 c2a0b16c614f507c3ed28dd4ce51a50e5637133eb2c544ab46fe0ade6f8f0f47
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandler64.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveCrashHandler64.exe
          • Size 355KB
          • SHA256 7bdc237a05710d72c17a88a63dc7ccaa9ac4ef5caf9bfab814dcac191129f827
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandlerArm64.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveCrashHandlerArm64.exe
          • Size 353KB
          • SHA256 e5d27f351d296356a91964d47837aca147c3faf1ff86ae26b392aa375234af03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdate.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveUpdate.exe
          • Size 163KB
          • SHA256 74e5389a09960c000ba5168cf55775832df71ab7af53b69eeaf742d1a0c00e12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShell64.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveUpdateComRegisterShell64.exe
          • Size 170KB
          • SHA256 6aecc97c53c474de1f08fa98b803d917460fce04ee5a14cc91d209bcfb67c931
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShellArm64.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveUpdateComRegisterShellArm64.exe
          • Size 154KB
          • SHA256 3ea276ea20e83f8792f4bd70cec37384a02d541687f9ac65b51d93db0f605b06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateCore.exe
          • Path C:\Windows\SystemTemp\GUM36.tmp\BraveUpdateCore.exe
          • Size 195KB
          • SHA256 29c8c2acced66aa0ad2850e7339aa2281a01616325325081cfbde3cca7e8d168
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdate.dll
          • Size 1.0MB
          • SHA256 7e60a57d91c71b4d74f36056ce5626eb83d8076b44d7c58596b8d128c048875f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_am.dll
          • Size 42KB
          • SHA256 fef044fa72546b207f9f6ecadc9acbf2978013e3347e2705942a4a5c1cd78f5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ar.dll
          • Size 41KB
          • SHA256 79211d2f5fe202efed22021e5849753d5f9806ac3b05594df293bce399f06ba4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_bg.dll
          • Size 44KB
          • SHA256 19dd5329b1ceac473f36f1a573953ed08b30265aa16d3678e763139d2ffe4cec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_bn.dll
          • Size 44KB
          • SHA256 c6273700b2c02345cffaca5e0cf3f1405636bf7c693badae1a3c6338ff41b841
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ca.dll
          • Size 44KB
          • SHA256 2f752cffd57bc52c09cca3b7dc0c0fd87db08f8402d2a689c6c6815862d9a973
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_cs.dll
          • Size 43KB
          • SHA256 9f2514cd4503204f497fcf7b259090bdb89c17582e8318fcc63dd6f82fdabb88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_da.dll
          • Size 43KB
          • SHA256 6bae7655df54eacea959227940c9eb8a6b6cb41ba668e5b1135692d87ce80b54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_de.dll
          • Size 45KB
          • SHA256 58bce44c1b862c5bd45c547dacbb4be74fe0a18a8cf6fb2e3bd13d2317165069
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_el.dll
          • Size 44KB
          • SHA256 3ad9fd467078ad4cdd546f857ed8029f7f38e395e08aa3e24dc3a04ecd79601b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_en-GB.dll
          • Size 42KB
          • SHA256 c7e23f73232aed80ddca9e296c6dc428d9a768e58f7a7a1a4d308e3b77e06247
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_en.dll
          • Size 42KB
          • SHA256 d4aa6d5a97311c93ee4ad153132b0439770e7504d6585d87baa74b9bd4c07e0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_es-419.dll
          • Size 43KB
          • SHA256 966ba91900cca823af5aa71448ac703d56a3ca12b41ccf9fa7df02e2a47614e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_es.dll
          • Size 45KB
          • SHA256 95812a1c97101c3c0bf8f27b0fbabf487aed7f18a123a874c3e3eb663f6d5f3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_et.dll
          • Size 42KB
          • SHA256 8d74926a01b1657bdcc1ecae288e69daa4d9c009cd928a78d1661abd2405bcfa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_fa.dll
          • Size 42KB
          • SHA256 bc3b2c8bc85385a2164c62c019950a790d9d6eb3511d8d41da25c7fdff263c70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_fi.dll
          • Size 43KB
          • SHA256 8767d9ae5dfd381bb7d99f5ad33a16d0fb9180bc4257de2a3780f877c4695c80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_fil.dll
          • Size 44KB
          • SHA256 d08c39525b7dcb96c9433fcb932364caf656640a86e7533069595b0501fb9665
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_fr.dll
          • Size 44KB
          • SHA256 3027cb46df2865d149054e7e1fdd8d0ea4c9b7872e6ae2e0f4ebab9aa9f24afa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_gu.dll
          • Size 44KB
          • SHA256 696876bd9055d6f27a852e6ae3412ebbddb99d2baa02cda57ace8abd32784dda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_hi.dll
          • Size 43KB
          • SHA256 aac9c8baca6968c1c555eea08683d787f53719158a40f17400c060649b69006e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_hr.dll
          • Size 43KB
          • SHA256 26514142f68048bc714b2fe147032259cced7e4f2849d592a73d7e23ba811e15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_hu.dll
          • Size 43KB
          • SHA256 562b0468e4f44701aabb9eea334471d37155277d9059687a73f589a9da7bf00f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_id.dll
          • Size 42KB
          • SHA256 9d69cc82847299dc5c50ad7329d6a7620b907d0836361884fef15b6f369d9447
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_is.dll
          • Size 42KB
          • SHA256 fc2dbaed06fed803a1e6e355ad459b4157925a9338be6686ca55a39f7a5a93e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_it.dll
          • Size 44KB
          • SHA256 d23efbadab5faf9fbca88759b118fb40b1c08a9145dbbc2d6e99be3fb170307c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_iw.dll
          • Size 40KB
          • SHA256 81f421c95dd44c5408a69c7a4ac7909796e424b7acd4395123e733f292cbd6b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ja.dll
          • Size 39KB
          • SHA256 657664cbdb5985dc982cf2e4ac058edb99211ecdee326af353dad78223eb5928
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_kn.dll
          • Size 44KB
          • SHA256 dd0c00d4c9e89b277196f37a0904ea3b57bcb2fec01bead3827a3f8ddff80702
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ko.dll
          • Size 39KB
          • SHA256 901004d3e3d04e7f3390441ac65e840889378b8d11fcf07428e09119b4de9c2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_lt.dll
          • Size 42KB
          • SHA256 37069b7949666173200b15d4c9fc1fc722b4e833920db96db34a8d898399cdf9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_lv.dll
          • Size 43KB
          • SHA256 7032e5f29b0a2c230353efff1db66147a27008db4d70de019e5b7f106d59d160
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ml.dll
          • Size 46KB
          • SHA256 b69b96d3bc7cbbac17af80e63713028f61a92b66d7c1b1cbea4a453365a97929
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_mr.dll
          • Size 44KB
          • SHA256 4d812f1b2ad51f2211e6e587928be463a63cd4381806f99a5027ae3896305d0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ms.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ms.dll
          • Size 42KB
          • SHA256 67793b3637472bf3434293443c3c46c391873ea6ba1ba60a0d5d52433aad327e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_nl.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_nl.dll
          • Size 44KB
          • SHA256 bfac6a0abff99a873fbc4b51a8d0b1cdf81ce3543139ebbbf056a746ae574cac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_no.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_no.dll
          • Size 43KB
          • SHA256 118440c927f6cde262767f2f5d10344570679418da417230a82d98f65186993c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pl.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_pl.dll
          • Size 43KB
          • SHA256 cf6101c50ef8e3b3d3da7df395ecd092716f06b055b9eb6e4ab8a9c48949e186
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-BR.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_pt-BR.dll
          • Size 43KB
          • SHA256 bf890a10ed6442ffe15dfdab6ad06c896971df45c1e1f902f9c0628ef93bd63e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-PT.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_pt-PT.dll
          • Size 43KB
          • SHA256 208c5909f98b22924077e3bb14610b2027197c5e5d57f43bf5c55ae6e6050630
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ro.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ro.dll
          • Size 43KB
          • SHA256 4241a07504d14b90631d071f2ce8a2cfae7a2c1b5a17457fb1add935c3e69c8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ru.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ru.dll
          • Size 42KB
          • SHA256 bc5dc852b7ac4b44b5c344ba1707e59a6576fe27034eda1e33e347c547d5dc5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sk.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_sk.dll
          • Size 43KB
          • SHA256 88a9117c8d1624f98fcd88705e17aa9dca04092eb143a69d8ccb7315ff859b7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sl.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_sl.dll
          • Size 43KB
          • SHA256 4ef3eec5c1281632eb44e84e2865acf71287e771d82d6a6352a82ac68d3d12c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sr.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_sr.dll
          • Size 43KB
          • SHA256 c9b9a0b0aa8452a6ebdb35c6a3416545b54e74dcb55f10c00cf67da9a3b11bd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sv.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_sv.dll
          • Size 43KB
          • SHA256 9ec3006c7cec855dc1e4a394ebc4580fb7f76f2027bcb2cda27b21d7661737f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sw.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_sw.dll
          • Size 44KB
          • SHA256 c1cc4f118044000ba986947e17cd70b79cd1659b7941f345edcb069a1c9d5e9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ta.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ta.dll
          • Size 45KB
          • SHA256 b66ac653cd8c469ca7c16ebd2a6b3c4efcb088260f82f1d70f4987b8a805ae19
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_te.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_te.dll
          • Size 44KB
          • SHA256 6adbebeeed77fcde441e80d58ef9f25164a0f6c56f79c730d2700a51ccfbb9ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_th.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_th.dll
          • Size 42KB
          • SHA256 2103536ac31f4cd3bb36d1712e0ee5d3198b20ff7708f338186c5ea4bc1abc60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_tr.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_tr.dll
          • Size 43KB
          • SHA256 358b81a2feddd19cfdc82b762a80ffcb1ae9a45c1057368c6db517f1a7c51e3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_uk.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_uk.dll
          • Size 43KB
          • SHA256 bcb69c9164ba2aba5726760bb29b8b32e0bcf12c1cf77f7f92f5da7457d9247e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ur.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_ur.dll
          • Size 42KB
          • SHA256 b09f34d8f19d808fa378f847787b657b1e9d07debe52dc4e06bd1f818cdcd980
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_vi.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_vi.dll
          • Size 42KB
          • SHA256 8338d02598877c2112633a96fc9ee116c2e4160e34e8609b92c9be3d28a3905a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_zh-CN.dll
          • Path C:\Windows\SystemTemp\GUM36.tmp\goopdateres_zh-CN.dll
          • Size 37KB
          • SHA256 e26160e89a1f8569f57da532e90a4977be3c13afcd89b51adbdd37176ab10b36
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download