Overview

overview

6

Static

static

1

BraveBrows...10.exe

windows10-2004-x64

6

BraveBrows...10.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 19:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BraveBrowserSetup-BRV010.exe
  • Size 1.2MB
  • Sample260626-xt97caes51
  • SHA256 10426a4a09b6767185ce9da9d04e4a96157b354fc8f861d8aa9a407b6685bd0c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 58 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe
    "C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5900
    • C:\Windows\SystemTemp\GUM6175.tmp\BraveUpdate.exe
      C:\Windows\SystemTemp\GUM6175.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1312
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5548
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:6360
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:6512
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:1992
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins0Rjg2RDFFNS0wMDU1LTRGNjUtOEQyRC02NTNFQUQ3NkVFMDJ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MEU1OURCQUQtQ0QyNy00MTE4LUIwRTQtQkE1OTdEQUMxODREfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTMwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2636
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{4F86D1E5-0055-4F65-8D2D-653EAD76EE02}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:624
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\gui9FE7.tmp"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\gui9FE7.tmp" --brave-referral-code="BRV010"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.180 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x290,0x2bc,0x7ff7bf412aa8,0x7ff7bf412ab4,0x7ff7bf412ac0
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:6824
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\gui9FE7.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6728
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{A0E93CFA-08D3-4BDD-94B2-E0168246AC40}\CR_4BD55.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.180 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff7bf412aa8,0x7ff7bf412ab4,0x7ff7bf412ac0
            5⤵
            • Executes dropped EXE
            PID:1612
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins0Rjg2RDFFNS0wMDU1LTRGNjUtOEQyRC02NTNFQUQ3NkVFMDJ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NTJEMzU0NEYtMEIxQy00RTdCLTlEQzgtNkMxMkNFN0EwMENBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTQ5LjEuOTEuMTgwIiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNDkuMS45MS4xODAveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNDgzODQ4NDgiIHRvdGFsPSIxNDgzODQ4NDgiIGRvd25sb2FkX3RpbWVfbXM9IjcxOTAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM2MiIgZG93bmxvYWRfdGltZV9tcz0iODMyNyIgZG93bmxvYWRlZD0iMTQ4Mzg0ODQ4IiB0b3RhbD0iMTQ4Mzg0ODQ4IiBpbnN0YWxsX3RpbWVfbXM9IjM0MzcwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:976
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:6240
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:976
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:6020
  • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
    "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6080
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6188
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.180 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe1beeda60,0x7ffe1beeda6c,0x7ffe1beeda78
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4492
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,7837194638087568856,11937975848985585587,262144 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:472
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2056,i,13879544191548067103,890595677563593714,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2112 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:1888
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3316,i,16124217885954240558,9073606689800181019,2097152 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3320 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3496
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3376,i,12805176411509820029,3199195710701493731,2097152 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3340 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2988
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,11417544873977720646,8527917355494570951,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2668 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3616
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,209010365635775253,8441146217369871740,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5548 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2832
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,397714831209890005,4842871036886188446,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5652 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:460
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,13562309824674287005,17505162554586569267,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6132
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,8697794395379576451,9132480866286881996,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5956 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5780
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,9262861021305877822,2751519437869527697,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6104 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2788
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,14078495270619294036,6292538033116181352,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6096 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1652
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,13791672352806797683,9100467472329307791,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6312 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6168
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,14683664116594453473,10482915613818472981,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6412 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5292
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,4626587273993553317,17445279978577938413,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6316 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2796
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,16894838870089313887,11017275016673262109,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6216 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5556
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.180 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff66bf52aa8,0x7ff66bf52ab4,0x7ff66bf52ac0
            5⤵
            • Executes dropped EXE
            PID:5176
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:6304
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=149.1.91.180 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff66bf52aa8,0x7ff66bf52ab4,0x7ff66bf52ac0
              6⤵
              • Drops file in Windows directory
              • Executes dropped EXE
              PID:1828
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,16261906860302161286,1151065233793275495,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6096 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2992
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,1974060954154189040,7167828156322036058,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5960 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3960
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,905121039749521212,4931906621399323051,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6548 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:7152
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,13332570448176958727,13704418387484572690,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6156 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6008
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,3043658984660574772,1048530589115772915,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6036 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5780
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,1973693829741321414,14462772965266792339,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5896 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6128
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,11532600325557114997,711700464820463998,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5824 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4688
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,12507791943347035044,14728822551531065939,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=4944 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5592
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6880,i,8865849444096687641,363747650625922952,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6896 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:576
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6860,i,13421493740769366770,9568507090335072064,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6592 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6652
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6868,i,2523106485844248173,17772861847218618699,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6984 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:2740
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,16516515960769765244,14022169053084374052,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6564 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4984
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,17129079076180095601,12009900452080308824,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6928 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6968
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6908,i,350822056708030201,11278365949368943278,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=6876 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5292
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,2069193721760661109,2178519397024754041,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=6096 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6808
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,10108756946535302657,13649720611956753985,524288 --field-trial-handle=1888,i,14458808125380921938,9293212926099631788,262144 --variations-seed-version=main@aa5ecb1acee9aab1b82b5f4c1dbd7f2e611ff996 --pseudonymization-salt-handle=1892,i,7517595586370248492,3523954874127229929,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=6632 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6892
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\149.1.91.180\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:6976
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:4968
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:2956

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          messages.json
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source3288_68314088\Chrome-bin\149.1.91.180\resources\brave_extension\_locales\sr\messages.json
          • Size 9KB
          • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          92b094db-f581-4e2e-843a-95d628775b63.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\92b094db-f581-4e2e-843a-95d628775b63.tmp
          • Size 10KB
          • SHA256 b2282bccde5d70893bb035e4cf47394cc097b5a1da5ffbd3a0de741cff20bfe6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2486d797-5080-4e57-bc96-34cbda3d77bf.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\2486d797-5080-4e57-bc96-34cbda3d77bf.tmp
          • Size 165KB
          • SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          57de635d-806e-4d4e-ad8d-59f94d142b7f.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\57de635d-806e-4d4e-ad8d-59f94d142b7f.tmp
          • Size 19KB
          • SHA256 395f685b88f30344b6928d8f3a3a1e8e8511228d2399ab969fd13c0d784989d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          6ce51036-9243-4e48-99ba-eb86f0e36ef7.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\6ce51036-9243-4e48-99ba-eb86f0e36ef7.tmp
          • Size 3KB
          • SHA256 3161ef7d2ae5c4b609c89bc79cdf6f879b3cd9314a9f57ecbe07a8874881b212
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extension Rules\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          5748a6b7-c9b3-4acb-847d-037586071876.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\5748a6b7-c9b3-4acb-847d-037586071876.tmp
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
          • Size 301B
          • SHA256 d105112ad83e80aa6feb49ef7ca5b69a6e69c57c63bbabb9bc840286b5292974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Sync Data\LevelDB\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 62KB
          • SHA256 97520c828cc1836a582ab05eb60eb50d3907b66f49ef1dc3de6ef79662dc5913
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 53KB
          • SHA256 24c417690189a91a19f75e61ef8a7c04b18efda473f7321608664f7adbf651b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 65KB
          • SHA256 28f7e1350fdf0081d8b1a96f92eb12e04b48737bae1cc1b69d9679aaa3f19e63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
          • Size 17.8MB
          • SHA256 00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0e5fc1f56031853aba99041e7b069b7ee904aa0e24cb35edfab077bb45b5f688
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\0e5fc1f56031853aba99041e7b069b7ee904aa0e24cb35edfab077bb45b5f688
          • Size 3.1MB
          • SHA256 0e5fc1f56031853aba99041e7b069b7ee904aa0e24cb35edfab077bb45b5f688
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2034e021e230b1f652d907225c60eaba71ffbcd1ee35af9aafa0de9db7b5b392
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\2034e021e230b1f652d907225c60eaba71ffbcd1ee35af9aafa0de9db7b5b392
          • Size 1.5MB
          • SHA256 2034e021e230b1f652d907225c60eaba71ffbcd1ee35af9aafa0de9db7b5b392
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
          • Size 7.6MB
          • SHA256 23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Size 11KB
          • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          388f5f0cbcfd2a79656c2d94c13e390516c3245aa51d72901c763040f1472ade
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\388f5f0cbcfd2a79656c2d94c13e390516c3245aa51d72901c763040f1472ade
          • Size 258KB
          • SHA256 388f5f0cbcfd2a79656c2d94c13e390516c3245aa51d72901c763040f1472ade
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
          • Size 5KB
          • SHA256 3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          4177f241669e7cbad3aa65c099a472344d752fb7ea3db59d8f076411cc6c746d
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\4177f241669e7cbad3aa65c099a472344d752fb7ea3db59d8f076411cc6c746d
          • Size 12KB
          • SHA256 4177f241669e7cbad3aa65c099a472344d752fb7ea3db59d8f076411cc6c746d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          46650acd4fb716e0c805161e0b306331d235648b74fb77dd2d71db6ee7693223
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\46650acd4fb716e0c805161e0b306331d235648b74fb77dd2d71db6ee7693223
          • Size 256KB
          • SHA256 46650acd4fb716e0c805161e0b306331d235648b74fb77dd2d71db6ee7693223
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          471db834a172655370b304d015105f16a29025bdefede39e4463d22795986a69
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\471db834a172655370b304d015105f16a29025bdefede39e4463d22795986a69
          • Size 3.2MB
          • SHA256 471db834a172655370b304d015105f16a29025bdefede39e4463d22795986a69
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
          • Size 857KB
          • SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          581def8e7fa8c15c89aad94a7c40edd81b73e0a341e19f5517125a338526c01c
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\581def8e7fa8c15c89aad94a7c40edd81b73e0a341e19f5517125a338526c01c
          • Size 88KB
          • SHA256 581def8e7fa8c15c89aad94a7c40edd81b73e0a341e19f5517125a338526c01c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          63f3b9ef-ba67-4f38-8ddc-baef6c00e60c.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\63f3b9ef-ba67-4f38-8ddc-baef6c00e60c.tmp
          • Size 1KB
          • SHA256 f9b27bc65117dfac6fae2103f8ed2ddaf9ff9ba397baf4efdf3dc33a6eff6e9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          64549235e1b32c71456241b3e99d5d01e0e97216aa2b7c0d9121933f9fb474d5
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\64549235e1b32c71456241b3e99d5d01e0e97216aa2b7c0d9121933f9fb474d5
          • Size 5KB
          • SHA256 64549235e1b32c71456241b3e99d5d01e0e97216aa2b7c0d9121933f9fb474d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
          • Size 12KB
          • SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Size 7KB
          • SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          96e99b96554e99ffe0d9f6a1e5f2ee48ab18245469fa56a5e3a90f140e6e7078
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\96e99b96554e99ffe0d9f6a1e5f2ee48ab18245469fa56a5e3a90f140e6e7078
          • Size 19KB
          • SHA256 96e99b96554e99ffe0d9f6a1e5f2ee48ab18245469fa56a5e3a90f140e6e7078
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
          • Size 184KB
          • SHA256 9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Size 14KB
          • SHA256 acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
          • Size 1.1MB
          • SHA256 c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Size 3KB
          • SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          d242da70b5bfd56d740b44a72c1bb1884b05be94fa2a8822049f60e3f7c49e83
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\d242da70b5bfd56d740b44a72c1bb1884b05be94fa2a8822049f60e3f7c49e83
          • Size 48KB
          • SHA256 d242da70b5bfd56d740b44a72c1bb1884b05be94fa2a8822049f60e3f7c49e83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          d53653ac96548649f8b6e345d005e4dbd30858fdad0150585f97363f690df18c
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\d53653ac96548649f8b6e345d005e4dbd30858fdad0150585f97363f690df18c
          • Size 475KB
          • SHA256 d53653ac96548649f8b6e345d005e4dbd30858fdad0150585f97363f690df18c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e768e274f06c67ffe5332af2e34aa50688cc12f0595ec4e6081e12ec8845d01b
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\e768e274f06c67ffe5332af2e34aa50688cc12f0595ec4e6081e12ec8845d01b
          • Size 473KB
          • SHA256 e768e274f06c67ffe5332af2e34aa50688cc12f0595ec4e6081e12ec8845d01b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f71cbfe89ddfb813412f3a2d50635751f9630ec9511e3133284bfde6fde397bd
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\f71cbfe89ddfb813412f3a2d50635751f9630ec9511e3133284bfde6fde397bd
          • Size 1.5MB
          • SHA256 f71cbfe89ddfb813412f3a2d50635751f9630ec9511e3133284bfde6fde397bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ff38c13090eda73d7c21da4bb541b55b6a83bf63ec34691769834036817efc03
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ff38c13090eda73d7c21da4bb541b55b6a83bf63ec34691769834036817efc03
          • Size 372KB
          • SHA256 ff38c13090eda73d7c21da4bb541b55b6a83bf63ec34691769834036817efc03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
          • Size 2KB
          • SHA256 8ec6ac6dadd4fb7538fae1ebf39e9ec7cc160cc9ff3c0bffef2317c964f74614
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
          • Size 1KB
          • SHA256 f13b6c6ecc6acc01af1840d1434d8c7d154ee35ea76b1e4571c8c509b49dc14c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hyph-bn.hyb
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping6188_1281249015\hyph-bn.hyb
          • Size 703B
          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hyph-mr.hyb
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping6188_1281249015\hyph-mr.hyb
          • Size 687B
          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hyph-nn.hyb
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping6188_1281249015\hyph-nn.hyb
          • Size 141KB
          • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index-DIxXAQ8B.js
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping6188_1806019276\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-DIxXAQ8B.js
          • Size 204KB
          • SHA256 3bb1e09dd8d40b0285093802c9d5af3387dfa4c2a378bacdc7d36fb774329dad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8a87d261-a24f-4010-8c81-67ec26799dde.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping6188_1806019276\fc34ad62-fa60-40d1-8f46-b2409cc7777f\8a87d261-a24f-4010-8c81-67ec26799dde.png
          • Size 41KB
          • SHA256 0492c361e65ed5d08833d4e6cb0e8d3341a7e797d130921b556e513e56c8a1c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandler.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveCrashHandler.exe
          • Size 270KB
          • SHA256 3797cfc1904f5aa250c5934a541192633d9abfb9928a03298ee3749654bfccda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandler64.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveCrashHandler64.exe
          • Size 355KB
          • SHA256 a8e5b397c61c142ff2331ddf5826ea33ae75f1b2f58fd0e92c2abbcefff71949
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandlerArm64.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveCrashHandlerArm64.exe
          • Size 353KB
          • SHA256 9ce0461e5fe10b6f5d63881756d76a15a54dada9fe290b5c85514a28badb4561
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdate.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveUpdate.exe
          • Size 163KB
          • SHA256 02ae1a4d013376c9661934b8967549e15e61574a1599e6307ec39f2f9cb6b36b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShell64.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveUpdateComRegisterShell64.exe
          • Size 170KB
          • SHA256 9167e2f4b300c07247146f02e341bfc8153387c2ca90d19fae5d8b6b14454ec7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShellArm64.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveUpdateComRegisterShellArm64.exe
          • Size 154KB
          • SHA256 086986ea94f5a93ec04fcf0b665d185cd48098210df6600ed833dd44b3cfcd7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateCore.exe
          • Path C:\Windows\SystemTemp\GUM6175.tmp\BraveUpdateCore.exe
          • Size 195KB
          • SHA256 c4eaed4a5044821c1d11da5431add422aa29a58a19ac8698aeb11730877f2ed7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdate.dll
          • Size 1.0MB
          • SHA256 3df6971254b2a89e0424efc87904e7f47434b5ae6693a957376d391f05745425
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_am.dll
          • Size 42KB
          • SHA256 34087a9adea2f2dc94695e22480d33c0c75029037fe8aa45d3530b44bc3c0bc1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ar.dll
          • Size 41KB
          • SHA256 a72600ada42d5767e64117c234a281ed4042adcf21d9ed6ddaf379012a8d231b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_bg.dll
          • Size 44KB
          • SHA256 69ddf809dc5c963642588dd4a46f957dcd39cf935ef644be7eb60fdfd72f07ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_bn.dll
          • Size 44KB
          • SHA256 c4a54a1b7802a2fc0e0c0348ca969fad90bb1378179e5fbfa532e35309b3924a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ca.dll
          • Size 44KB
          • SHA256 46ff8d7b8f8c7a5c675e3b4b27d0047b0f656ac4ccddbd88ca27dd48101f8384
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_cs.dll
          • Size 43KB
          • SHA256 f5d159ba5174df269e7cb213c4a7d3c1a726e157ac0a0c3d21096d29599bc55b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_da.dll
          • Size 43KB
          • SHA256 0fe3b6a655c9fbfbc972a9744c2dd770ad2e887f67636bf559230b0073796a5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_de.dll
          • Size 45KB
          • SHA256 2cb205d1e85b42502706eda894159be979f8aa99fd6251d258d7764a56e8b4f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_el.dll
          • Size 44KB
          • SHA256 09f23d583a62a4466b818561e82ee00697240133fce7a581446d311b7de03bc1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_en-GB.dll
          • Size 42KB
          • SHA256 e23e51a7bb4879a19398153122638d76b84b5f98c92602f18ad68e500ff2cf01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_en.dll
          • Size 42KB
          • SHA256 3fb270c280f89fef9ad2382ed3af3592b4b4f561f76393befe91b1917855efdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_es-419.dll
          • Size 43KB
          • SHA256 3dd26af922a67583025198bb82ead4b3294c239a9c8ef113a6551233abe3a0b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_es.dll
          • Size 45KB
          • SHA256 1d02f8af1b573893581f203ba60a355eadeb793063ae30f2eb974acdc613f985
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_et.dll
          • Size 42KB
          • SHA256 194993d600136fdd62806e6d8aecd25ae02480498319f220e8807b241b244489
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_fa.dll
          • Size 42KB
          • SHA256 34e4cdcad95f665abeb62cdf5b398ffc80752bd39b8a7316bf6279f3a3dded88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_fi.dll
          • Size 43KB
          • SHA256 8857e60c50de4ee501262d15914bb79139a8260cd35ab717caa17f99f3f43c59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_fil.dll
          • Size 44KB
          • SHA256 6c40eb0d800506421fc2df207c3dc007d725d3bbb1f2c3ac71b2adefedb45750
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_fr.dll
          • Size 44KB
          • SHA256 6ecb97e50edf5cb1f2aed887112df4a1c8e311101cfab84d9d960ffca0f0f5f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_gu.dll
          • Size 44KB
          • SHA256 adae7f94d0dd9fa63d826e85c60f724c2e2be3586aa1744013e76a35528736e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_hi.dll
          • Size 43KB
          • SHA256 0e1cc373b9331e4534a4499785e97a199692e2f853d07cab0d315e4fc8f51392
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_hr.dll
          • Size 43KB
          • SHA256 5ebce926ad44aa73aec9b692ef70ff0c260eb0c44b14eaab5adf631fad30b653
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_hu.dll
          • Size 43KB
          • SHA256 076b76fd333a4dd5961140af44a401c22ac9a6331759f3db3112bec8a961ea1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_id.dll
          • Size 42KB
          • SHA256 4d30cf6f8e6a3d521e92d2f6a2368099b66328e4ad7a9447a1d3e211ffd18529
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_is.dll
          • Size 42KB
          • SHA256 f105097f1576f4cb660ecab9cb79be91836623cd9ee37b5421a0da4cc30b733b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_it.dll
          • Size 44KB
          • SHA256 e3cfbf62d54f2a658d37bfc8d09b2c11fbfe819e6745fac4b097ac7b37e3eeb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_iw.dll
          • Size 40KB
          • SHA256 447175e5e31680bb6c7a187f6fa77303c57be524ff75111a3c0989d253ca7a27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ja.dll
          • Size 39KB
          • SHA256 f1183239242b7402c881cc948a3d47e5764a0a32a3566c5e3f43c108befba3ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_kn.dll
          • Size 44KB
          • SHA256 49f05067d66446d612c662ea6b9324c4870dd8c3a7b7905793627b6832bfedd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ko.dll
          • Size 39KB
          • SHA256 2a36e7e38033c50aa51ed69163e4fe530c78fa179d21cb757d076954ac63aa7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_lt.dll
          • Size 42KB
          • SHA256 816972bb54b88e0fa50e05b5283f7e85b770fa0fb86a5110dc6e822b332b3c76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_lv.dll
          • Size 43KB
          • SHA256 f0024e563f097a295bb0cc449bcbb5b36fee08fa1e42d6f1e91d378c052c0263
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ml.dll
          • Size 46KB
          • SHA256 91af83d2ed740f2f1332c9bddfb749f11a97684c6ea9c562d7b99d5fd78c9196
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_mr.dll
          • Size 44KB
          • SHA256 9441bafa356f93745076a669f8c6f444fdd0719e9d65424f534825ad6b70d7c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ms.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ms.dll
          • Size 42KB
          • SHA256 433b1c23a3fdb2183b307ec49196af833b3fe3c304aa776c8d6645e4ce59e87e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_nl.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_nl.dll
          • Size 44KB
          • SHA256 9b7a3c0327cca74e990905788b9af44810c9d823bb7da85d78cef0538fda5978
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_no.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_no.dll
          • Size 43KB
          • SHA256 65be4e00f8fefc777e7d5434ff25ba2ad533c9d26f9b6b595a1520639c0658de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pl.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_pl.dll
          • Size 43KB
          • SHA256 26262f420b8a3eb867a74f1b91ff72012bb58c0dda3ee2c0189a23b1a3468416
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-BR.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_pt-BR.dll
          • Size 43KB
          • SHA256 22949d56e2fd6731f8c9bc1cd4974a60d28813cccf6026c9aa2b74fd7ec39113
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-PT.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_pt-PT.dll
          • Size 43KB
          • SHA256 66dd9f25458aeb23b87bd6d93393971ff5df323d0f939baf9687b2718ea15e51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ro.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ro.dll
          • Size 43KB
          • SHA256 e85c89068d46b1c54f710de9d07e9f9f293544ab6183e1f858dd9bf4d5853305
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ru.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ru.dll
          • Size 42KB
          • SHA256 ce3abfd4d209d7307319cf3647cde8d07dff02a36fd8d9f6ddacfd1b7f897625
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sk.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_sk.dll
          • Size 43KB
          • SHA256 f2958cf0231aa13172700d354fd7968b8faa626c996dfb1bf117714ef67b123e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sl.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_sl.dll
          • Size 43KB
          • SHA256 ba637b87e034fd532111fb804f248049d1d3d65fb27882df2299e5efec5d5b22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sr.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_sr.dll
          • Size 43KB
          • SHA256 13ff20998c5af1d8776ac9985da8f767f045df607eebab4a732189132cbc842a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sv.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_sv.dll
          • Size 43KB
          • SHA256 903e42430020b3163532076293c7906e23583d3a0e70e5f375c71dbd161eeb2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sw.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_sw.dll
          • Size 44KB
          • SHA256 d210f9c04920c6b3e48e248f4d92de5cf2847c9b920ca2c9a9ed5f98b25e8cee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ta.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ta.dll
          • Size 45KB
          • SHA256 cf13c8068a65ee3a76ed4fc30d9ea1db2a01e9aa2de7e6cf39acbef41abb892f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_te.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_te.dll
          • Size 44KB
          • SHA256 347007a0fdf4e14bc578e31e08c4abf20f0c3899a00f95abdcd59ceaa7625b4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_th.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_th.dll
          • Size 42KB
          • SHA256 9eef8e8eaa70308b5773742e147990aa38c6941b83ebe601e9f0a617675f58b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_tr.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_tr.dll
          • Size 43KB
          • SHA256 17ac1a1c9ef02efc2e8f93e3e01abf9c8c0e35833fdc8b3f40244ddc4dd53fd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_uk.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_uk.dll
          • Size 43KB
          • SHA256 636907d05bfa0a381e77455af06fd62934d5a4a2ccf4050217959d83cd88b7b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ur.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_ur.dll
          • Size 42KB
          • SHA256 1df3baaacf16c98f98feacb42f28089b53d5c3289cb5af4d1a557a75c0ba176d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_vi.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_vi.dll
          • Size 42KB
          • SHA256 cfceb0eb7fbc231c0ff0ee3549b20facce6f07afc697beff61efdd8b3ba8496b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_zh-CN.dll
          • Path C:\Windows\SystemTemp\GUM6175.tmp\goopdateres_zh-CN.dll
          • Size 37KB
          • SHA256 854a5ea22468a8b2cf1b16e53070214e3f401994e478a68209fbd88509d52f25
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download