Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 11:20
General
- Target 2026-07-04_f28a847eada70927f05bdf14c0a5501e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
- Size 2.0MB
- Sample260704-nfqfcaew61
- SHA256 7cffd8a2fa681e2af098f32a383255556f0b768601878d308bef4dac28cce373
Score
10/10
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Family: Xred
Xred is backdoor written in Delphi.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 63 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 55 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_f28a847eada70927f05bdf14c0a5501e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_f28a847eada70927f05bdf14c0a5501e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-04_f28a847eada70927f05bdf14c0a5501e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-04_f28a847eada70927f05bdf14c0a5501e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemTemp\GUMDABC.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUMDABC.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsxRjdENkExOS05OUMzLTQwQzgtQkU4NC0wN0UwRUQ5QzFFQjZ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RjM1OTEzNUMtNDU2RS00NzUxLTg4QjEtMTk3QzZENjA1QjlBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjA5NSIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{1F7D6A19-99C3-40C8-BE84-07E0ED9C1EB6}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\gui5200.tmp"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\gui5200.tmp"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff7f8e4cae8,0x7ff7f8e4caf4,0x7ff7f8e4cb004⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\gui5200.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{8C3AA196-9020-408D-8738-85CDD2A2FF4B}\CR_61AA5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff7f8e4cae8,0x7ff7f8e4caf4,0x7ff7f8e4cb005⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsxRjdENkExOS05OUMzLTQwQzgtQkU4NC0wN0UwRUQ5QzFFQjZ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7OUUyNzVBNTQtMjUxMC00RThBLThDRUEtQ0E4NTFDNEE3QjJBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUwLjEuOTIuMTM0IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNTAuMS45Mi4xMzQveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNTAxMTI4NDgiIHRvdGFsPSIxNTAxMTI4NDgiIGRvd25sb2FkX3RpbWVfbXM9IjE4NjIxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNzciIGRvd25sb2FkX3RpbWVfbXM9IjIwMTU5IiBkb3dubG9hZGVkPSIxNTAxMTI4NDgiIHRvdGFsPSIxNTAxMTI4NDgiIGluc3RhbGxfdGltZV9tcz0iMzc0NzAiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8fd30ca90,0x7ff8fd30ca9c,0x7ff8fd30caa84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1684,i,5195821323341775177,7591811796968256342,262144 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2060,i,4121962445333782415,16502530945585369844,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2000 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2520,i,13800017194718306822,3484011954360515224,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2692 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3408,i,10565125690091809760,8575545710260790823,2097152 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3420 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3448,i,11752439976879403616,6143148996421919570,2097152 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3476 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,789218115760023827,10146904946491349789,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5576 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,6535387554309522186,4015683277146381930,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5680 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,16237983154412283129,16193253996396679000,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5692 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,6745177467083352270,9211005029725772311,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5980 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,7717673518223599693,7111200815815171359,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6124 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,7423021014422005362,6344231512173164338,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6216 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,14822056478397207167,11691054296742547303,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6268 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,11861902844314153886,12598365806764756461,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6416 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff73ba5cae8,0x7ff73ba5caf4,0x7ff73ba5cb005⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=150.1.92.134 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff73ba5cae8,0x7ff73ba5caf4,0x7ff73ba5cb006⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,13639930463171437589,10925993528150567943,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5596 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,13062254249180438281,2842883704318523605,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4920 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6872,i,8316283297895121787,2176713470743296523,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5780 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,6589171275376362328,1530830217845605650,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6892 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,10733312934243008167,3602799304699933093,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5656 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,13456260923987708865,6029952320955119562,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5808 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,4625634269389754942,3536425330147693290,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6880 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,13867892392686164185,8254178989348099961,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6612 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,6310037881088537917,11534226056809821879,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6596 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6704,i,10079045195885459454,9326834765632990297,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6876 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6912,i,18155113807937164596,10151573621946884587,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6916 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,407302344724524408,2153427585205063823,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5736 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,16809802289091227190,8083011540903969902,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=5724 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,1279519645161014185,3708507309278268072,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=256 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=776,i,8918428000860576787,2779359233802522436,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=5736 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,16047364199069151662,12573244824039653030,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=256 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,2489376668896136682,5434941038774754862,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=5720 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,11329561886614235389,4757870772727963819,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=6908 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6924,i,577251436036534813,13474828020770500170,524288 --field-trial-handle=1888,i,8557524707273451087,6650026582293745226,262144 --variations-seed-version=main@83855c8ebb0eff781306c3f7f736068e5eb885bd --pseudonymization-salt-handle=1900,i,7809563822681042262,17447841069245652263,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=5576 /prefetch:144⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\150.1.92.134\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
messages.json
Synaptics.exe
36c379b2-c4d4-4c9a-bca3-2f597763ddbe.tmp
58f83b36-ffc6-4276-8941-5033f4c63878.tmp
54c777ed-cae2-4053-885c-3dd34251c634.tmp
6c9b41a0-c308-4398-a8b4-c965cd182d65.tmp
data_1
CURRENT
MANIFEST-000001
Network Persistent State
SCT Auditing Pending Reports
f84fd320-e3f8-44de-840c-e503ebf19645.tmp
Preferences
data_0
data_2
data_3
Local State
Local State
00d7a18d208288fa35492c89179938f4bf973748c937693346d641bfb01619d7
1951b83f54debc5677ce21828e3d12b2b4172303c80ed1294cb5f6ebed2f7283
23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
2a20a68db7d8243ab6f01b7a853ec9d0ba51a88168d67d16db9f57cac57aff31
30faa931-22e9-4add-99b5-f80413be21cd.tmp
35daf3b683050608c73ff42fc971a729ff5e7ca308059056cc9fdf7dc563e178
3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
47d5caa36fa23db21b3e98171cf496faad13562c0afef3599188ebcf7744d269
4885c756edb1dd2a4f6a5ecc872c899d4a16c5beee95666eebb446a70e6054a0
4aafbd9931c0f14097b5e4bd9965b59c2b1aaf00033334d46d3b4adc42b056a4
545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
58b44a2910d06a842e760cc52d03a6a8e311f71d4f4b5eed096ae01ea409c52e
73cc152819fd605debef0939d68a9b3eea3e29e2ef08d40ed62b4aaa78a464bb
7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
8ec06868e36c3d6721c6cee7c08ef9a93232b2236863c677af18e400c73c7aed
9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
a98fd02aeb333a5220755bf794a161adba255d6bede7c836fb134e2a2f3d2f5a
acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
ae36e3ef6f6314584a2c2a6fd9190c25434cafcfae9ae9a36d5be9ec10e9311f
c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
d242da70b5bfd56d740b44a72c1bb1884b05be94fa2a8822049f60e3f7c49e83
d3464bcb5cf6f8fce1c3cc3d73903007679451e9dec97a58c609be9495d86b06
d6fddee2ba45c6d54e5c03d636e24985dc5c230ba4577ad931240bc898c9703b
e9ac5b858d7f448e6509a3f72dddf25a7f92fa264aa52d00b170942afa56670e
metadata.json
metadata.json
._cache_2026-07-04_f28a847eada70927f05bdf14c0a5501e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
89E85E00
f2a8ed42-f919-43a0-b851-58a9b9e04e4c.jpg
36c6de45-6688-48e3-a9f5-be15c252eabc.jpg
0df175d8-451e-4424-a77e-b2586cf69197.jpg
verified_contents.json
campaigns.json
Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
ask-brave-icon-DdJTJrmV.webp
de-de-wie-oft-hat-deutschland-die-fifa-weltmeisterschaft-gewonnen.webp
de-de-wie-schlaft-ein-bar-im-winterschlaf.webp
de-de-wie-viele-burgen-und-schlosser-gibt-es-in-deutschland.webp
en-ca-which-canadian-players-are-ones-to-watch-at-the-2026-fifa-world-cup.webp
en-ca-why-do-geese-fly-in-a-v-formation.webp
en-ca-why-does-canada-have-so-many-lakes.webp
en-gb-why-does-the-uk-get-so-much-more-rain-than-the-rest-of-europe.webp
en-gb-why-is-dizzy-from-codemasters-an-egg.webp
en-gb-why-is-england-considered-the-home-of-modern-football.webp
en-us-how-many-bones-do-sharks-have.webp
en-us-which-usmnt-players-are-ones-to-watch-at-the-2026-fifa-world-cup.webp
en-us-why-do-tornadoes-form-in-tornado-alley.webp
es-us-cuales-son-las-estrellas-latinoamericanas-del-mundial-fifa-2026.webp
es-us-cuantos-hispanohablantes-hay-en-estados-unidos.webp
es-us-por-que-los-tacos-se-hicieron-tan-populares-en-todo-el-mundo.webp
fr-ca-combien-de-matchs-de-la-coupe-du-monde-fifa-2026-se-joueront-au-canada.webp
fr-ca-pourquoi-le-castor-est-il-le-symbole-du-canada.webp
fr-ca-pourquoi-les-aurores-boreales-sont-elles-visibles-au-canada.webp
fr-fr-combien-de-buts-kylian-mbappe-a-t-il-marques-en-coupe-du-monde-fifa.webp
fr-fr-pourquoi-la-tour-eiffel-retrecit-elle-en-hiver.webp
fr-fr-pourquoi-mange-t-on-des-escargots-en-france.webp
index-C8g22OGQ.css
index-DIxXAQ8B.js
index.html
logo.webp
mouse-pointer-DSDsXotA.webp
search-icon-BD6Rfjhr.webp
search-logo.webp
wallpaper.webp
photo.json
tiles.json
2297758d-3212-4024-83a0-daa8e037403b.png
hyph-bn.hyb
hyph-mr.hyb
hyph-nn.hyb
BraveCrashHandler.exe
BraveCrashHandler64.exe
BraveCrashHandlerArm64.exe
BraveUpdate.exe
BraveUpdateComRegisterShell64.exe
BraveUpdateComRegisterShellArm64.exe
BraveUpdateCore.exe
goopdate.dll
goopdateres_am.dll
goopdateres_ar.dll
goopdateres_bg.dll
goopdateres_bn.dll
goopdateres_ca.dll
goopdateres_cs.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_el.dll
goopdateres_en-GB.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_et.dll
goopdateres_fa.dll
goopdateres_fi.dll
goopdateres_fil.dll
goopdateres_fr.dll
goopdateres_gu.dll
goopdateres_hi.dll
goopdateres_hr.dll
goopdateres_hu.dll
goopdateres_id.dll
goopdateres_is.dll
goopdateres_it.dll
goopdateres_iw.dll
goopdateres_ja.dll
goopdateres_kn.dll
goopdateres_ko.dll
goopdateres_lt.dll
goopdateres_lv.dll
goopdateres_ml.dll
goopdateres_mr.dll
goopdateres_ms.dll
goopdateres_nl.dll
goopdateres_no.dll
goopdateres_pl.dll
goopdateres_pt-BR.dll
goopdateres_pt-PT.dll
goopdateres_ro.dll
goopdateres_ru.dll
goopdateres_sk.dll
goopdateres_sl.dll
goopdateres_sr.dll
goopdateres_sv.dll
goopdateres_sw.dll
goopdateres_ta.dll
goopdateres_te.dll
goopdateres_th.dll
goopdateres_tr.dll
memory/620-260-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/3496-730-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/3496-307-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/4616-0-0x0000000002610000-0x0000000002611000-memory.dmp
memory/4616-190-0x0000000000400000-0x00000000005FA000-memory.dmp
memory/4616-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/5732-254-0x00007FF8EB3A0000-0x00007FF8EB3B0000-memory.dmp
memory/5732-253-0x00007FF8EB3A0000-0x00007FF8EB3B0000-memory.dmp
memory/5732-255-0x00007FF8EB3A0000-0x00007FF8EB3B0000-memory.dmp
memory/5732-258-0x00007FF8E8B00000-0x00007FF8E8B10000-memory.dmp
memory/5732-259-0x00007FF8E8B00000-0x00007FF8E8B10000-memory.dmp
memory/5732-256-0x00007FF8EB3A0000-0x00007FF8EB3B0000-memory.dmp
memory/5732-257-0x00007FF8EB3A0000-0x00007FF8EB3B0000-memory.dmp