Overview

overview

10

Static

static

3

2026-08-02...yn.exe

windows10-2004-x64

10

2026-08-02...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 13:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe
  • Size 1.3MB
  • Sample260802-qtft6stene
  • SHA256 1030db0a17aa388d5e4c9ec8d8c53f119d17367dc8a7213ec4fc587aaf4e348e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 60 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2716
    • \??\c:\users\admin\appdata\local\temp\2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\SystemTemp\GUM2B5D.tmp\BraveUpdate.exe
        C:\Windows\SystemTemp\GUM2B5D.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5172
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5588
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4368
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4840
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4968
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsxNjlGRDE2QS1EMkZDLTQ1N0YtODc0OS1DN0JCRTRCQkZENTB9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RjEwQjM4OTEtOEZERC00MjVDLUI5QTktRkFFQjE1OTQzMTA3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTE5NyIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1888
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{169FD16A-D2FC-457F-8749-C7BBE4BBFD50}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5628
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:836
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4216
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1276
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5876
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1272
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\gui45D6.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5868
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\gui45D6.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2bc,0x2c0,0x2c4,0x298,0x2c8,0x7ff621053368,0x7ff621053378,0x7ff621053388
          4⤵
          • Executes dropped EXE
          PID:1344
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\gui45D6.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:864
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{98D7422B-EFC0-4231-8B21-8020CDB0590D}\CR_53148.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff621053368,0x7ff621053378,0x7ff621053388
            5⤵
            • Executes dropped EXE
            PID:1808
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsxNjlGRDE2QS1EMkZDLTQ1N0YtODc0OS1DN0JCRTRCQkZENTB9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QjU3NzU5QUQtNkYzQy00RDg0LTg3MTUtMEQ0RDc3NDVDRDNBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjEuOTMuMTI5IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNTEuMS45My4xMjkveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNTYxMDYzMjAiIHRvdGFsPSIxNTYxMDYzMjAiIGRvd25sb2FkX3RpbWVfbXM9IjE3NjkwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MjUwNSIgZG93bmxvYWRfdGltZV9tcz0iMjAxMjgiIGRvd25sb2FkZWQ9IjE1NjEwNjMyMCIgdG90YWw9IjE1NjEwNjMyMCIgaW5zdGFsbF90aW1lX21zPSI0NjAzOCIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4176
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:3916
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1008
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:800
    • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe
      "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5732
    • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffc7e77da00,0x7ffc7e77da10,0x7ffc7e77da20
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:996
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1668,i,9498422874707913883,14647181903013463545,262144 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1924 /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5900
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2020,i,14574009176954355487,7540731185872840793,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2120 /prefetch:11
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:3104
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2516,i,14199300722282716885,9119755279499239673,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2524 /prefetch:13
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3560
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3404,i,18045627176124875279,4845599162029766141,2097152 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3412 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:720
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3428,i,4285909208650528744,3687398268284052402,2097152 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3464 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3512
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,11499089708893256058,9285366907234453335,2097152 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4716 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5072
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,8486054473384486791,13495455996264506976,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5712 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5564
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,2537335909752200513,3109746904707302213,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5828 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2612
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,1483780036826502753,11643861855054887808,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=6000 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3432
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6184182127930081237,8799874789643219652,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5816 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5804
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,9639070037976786585,6918431378001628073,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6272 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4256
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,9401864978646010844,8530369251274065253,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6304 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3904
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,1884642909355326357,8329454362998738649,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6368 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3416
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,8812956857896515613,15575128640329192613,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4988 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2828
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,3722826417724907843,2941556961118772076,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6344 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5396
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4604
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff69beb3368,0x7ff69beb3378,0x7ff69beb3388
              5⤵
              • Executes dropped EXE
              PID:2556
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:4348
              • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
                "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff69beb3368,0x7ff69beb3378,0x7ff69beb3388
                6⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:2116
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,5959812509349583923,11602221905141224615,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6724 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2664
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,7635788205645078536,1177677848398862526,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6740 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3312
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6760,i,8947090534827137388,145017774322207888,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6676 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3368
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,14502375662026401781,4956092339564144876,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6740 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4824
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,11433877498709905999,5150444086967502799,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6588 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1372
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,4216732776681794584,18429317546335301399,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6568 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:1888
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,9763510902786120710,12386685946727340732,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6592 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5960
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,5014496769765777610,3546717783338476160,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6724 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:2772
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,3007104818758164478,15742041593574953369,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6576 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5836
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,14888233785935084154,9982454685379384042,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6520 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:3684
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,9928293837116122158,17933567512977423216,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6132 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:2424
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,1901555453035616135,8400483784988607542,524288 --field-trial-handle=1928,i,1782149605380365520,12878593125247209402,262144 --variations-seed-version=main@a455cb3305d6bba670f024ab364ec62ba08d2d31 --pseudonymization-salt-handle=1932,i,6170214648168151011,7460519889500089126,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6580 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4496
    • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe
      "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3836
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:4076
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:5368

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Modify Registry

            3
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            messages.json
            • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4252_31404868\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\sr\messages.json
            • Size 9KB
            • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7adb1d8e-8011-446b-8a79-574d40e6194f.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\7adb1d8e-8011-446b-8a79-574d40e6194f.tmp
            • Size 10KB
            • SHA256 1bf257b71d76458868139aa02c610097dd249206d96c7d6dff54df6b82912ba4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extension Rules\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
            • Size 19KB
            • SHA256 30bd89e8a0cdc0304f85722d54b71b5003b7ee27e9c269fd5d59c00fb0d6e3dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
            • Size 19KB
            • SHA256 5784670c82a1f0c863a2e12139de974f22e319f611f83e8392258f57ee7512f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            489456fe-588c-4c62-a2e8-9c102290a061.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Service Worker\ScriptCache\index-dir\489456fe-588c-4c62-a2e8-9c102290a061.tmp
            • Size 72B
            • SHA256 21e6e8ba257ebe715cb896f5635d3df0a1b59b8bc5b75edc6bfbc8a9dad33890
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 72B
            • SHA256 fe10fe33d833f40ed46c82014f313d4a524092e32fcef6c606217b77f6f819db
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            ad4c3dba-5192-4105-a149-26412b38019e.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\ad4c3dba-5192-4105-a149-26412b38019e.tmp
            • Size 3KB
            • SHA256 99cafd2407c0641002d60824614852f8782aa4e40a76520e809f9d87429c78f1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ef01d668-9b00-476a-bbfd-d6cf85205615.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\ef01d668-9b00-476a-bbfd-d6cf85205615.tmp
            • Size 165KB
            • SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
            • Size 43KB
            • SHA256 6394efd119d7c1011c24e48c862088a8e27a3087b70e1b48e34c87b0347e5693
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VariationsSafeSeedV2
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSafeSeedV2
            • Size 7KB
            • SHA256 2516abd1f2e85a959e780b2d114e445dff130cace11f1d9eceda189fb96e4cd3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VariationsSeedV2
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSeedV2
            • Size 171B
            • SHA256 b5a81a1cfc9ecfbbb37fb22f3f72861874b47264dacae6ef6ee259b63597b7f1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0d07e08b35066f5fbeb2d8135adb195d2ed53f061a3a666a31c574cc7bca59bd
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\0d07e08b35066f5fbeb2d8135adb195d2ed53f061a3a666a31c574cc7bca59bd
            • Size 1.0MB
            • SHA256 0d07e08b35066f5fbeb2d8135adb195d2ed53f061a3a666a31c574cc7bca59bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            118146358f03c2cb8618d20dc148f8210ad46dac206f90562e5fca778d78e720
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\118146358f03c2cb8618d20dc148f8210ad46dac206f90562e5fca778d78e720
            • Size 3KB
            • SHA256 118146358f03c2cb8618d20dc148f8210ad46dac206f90562e5fca778d78e720
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            247de0784e4c97f98cf95307a063d1c5107be2d489f9102c67825a0a23a82e1a
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\247de0784e4c97f98cf95307a063d1c5107be2d489f9102c67825a0a23a82e1a
            • Size 5KB
            • SHA256 247de0784e4c97f98cf95307a063d1c5107be2d489f9102c67825a0a23a82e1a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
            • Size 11KB
            • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
            • Size 3KB
            • SHA256 2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
            • Size 16.9MB
            • SHA256 33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            4d414c1aa6993a17a1bef5adf155d747d0c772f3b04416c9be23ddc63d8bd16c
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\4d414c1aa6993a17a1bef5adf155d747d0c772f3b04416c9be23ddc63d8bd16c
            • Size 1.0MB
            • SHA256 4d414c1aa6993a17a1bef5adf155d747d0c772f3b04416c9be23ddc63d8bd16c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
            • Size 264KB
            • SHA256 72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            786cf5e06ace8e32c63b99da06a745d378e51686ae67902623278a57d321434e
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\786cf5e06ace8e32c63b99da06a745d378e51686ae67902623278a57d321434e
            • Size 1.6MB
            • SHA256 786cf5e06ace8e32c63b99da06a745d378e51686ae67902623278a57d321434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7bc5f43a10216fe5f1b0792af5472755ecb51ba9ad486db21664d31668be7846
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7bc5f43a10216fe5f1b0792af5472755ecb51ba9ad486db21664d31668be7846
            • Size 1.5MB
            • SHA256 7bc5f43a10216fe5f1b0792af5472755ecb51ba9ad486db21664d31668be7846
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
            • Size 7KB
            • SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            875a255d74e58375ef9c1cd1eb8c7880b7dc5bc5a088fea104b39fd2459e5c42
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\875a255d74e58375ef9c1cd1eb8c7880b7dc5bc5a088fea104b39fd2459e5c42
            • Size 12KB
            • SHA256 875a255d74e58375ef9c1cd1eb8c7880b7dc5bc5a088fea104b39fd2459e5c42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
            • Size 3KB
            • SHA256 925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
            • Size 88KB
            • SHA256 99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            acaba925-b314-46d3-8d33-ca132b13d7ef.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acaba925-b314-46d3-8d33-ca132b13d7ef.tmp
            • Size 1KB
            • SHA256 805436d46fbfec588c386dee6314262e842d266ba806db5f07a0dc8f740b29fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
            • Size 14KB
            • SHA256 acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bcc54fedaf86b32b48d2d551925b797df81fb02bf635aae17264f10d29bcf3b5
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\bcc54fedaf86b32b48d2d551925b797df81fb02bf635aae17264f10d29bcf3b5
            • Size 479KB
            • SHA256 bcc54fedaf86b32b48d2d551925b797df81fb02bf635aae17264f10d29bcf3b5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
            • Size 19KB
            • SHA256 c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
            • Size 48KB
            • SHA256 ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
            • Size 3KB
            • SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            d1205cce72a76b3f7ee4b1b304244228345f2d4ec0a9a93487fac08479fd9c4b
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\d1205cce72a76b3f7ee4b1b304244228345f2d4ec0a9a93487fac08479fd9c4b
            • Size 475KB
            • SHA256 d1205cce72a76b3f7ee4b1b304244228345f2d4ec0a9a93487fac08479fd9c4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata.json
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
            • Size 2KB
            • SHA256 9a15185482e20eabca75f6fb89af310d2be57bb448584c022b266a0e539b4ab6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dc3e4787-effa-413f-abbe-86a3e9a59692.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\dc3e4787-effa-413f-abbe-86a3e9a59692.tmp
            • Size 7KB
            • SHA256 3a5e2265cd2c8a5612eefd9438151e5dbb751f2909d00c0a318ade046ac6cfc8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5545f61-a731-4c19-a3db-4d802d84b493.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\e5545f61-a731-4c19-a3db-4d802d84b493.tmp
            • Size 19B
            • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
            • MD5 SHA1 SHA512
            Submit Download

            2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_dbfd5c6b168494fcf953aa24c45b983e_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
            • Size 1.2MB
            • SHA256 4f3931e9ba1e1c53a34a56d85e67f195175c53a536423764d30cceda1d7e016a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            explorer.exe
            • Path C:\Windows\Resources\Themes\explorer.exe
            • Size 135KB
            • SHA256 70fa4f4174e475056f3c3e9e7f9c45bdc37ec214edd1e2be2e65757a0366a691
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f2a8ed42-f919-43a0-b851-58a9b9e04e4c.jpg
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1203387163\2d3d0993-fc4a-48da-8d0b-5f3eb50bb82c\f2a8ed42-f919-43a0-b851-58a9b9e04e4c.jpg
            • Size 340KB
            • SHA256 f7256eca1a524c95eb4fc2055281c3863101c4d51decc364eaa6f8b5d5e482ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            36c6de45-6688-48e3-a9f5-be15c252eabc.jpg
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1203387163\311a386a-68d4-4c9f-a82a-2f0961a44dbf\36c6de45-6688-48e3-a9f5-be15c252eabc.jpg
            • Size 446KB
            • SHA256 cd67c2cc4d96a3591cea55b1c761e351c74fd4bf6362fcb29ebd6c307a409de4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            0df175d8-451e-4424-a77e-b2586cf69197.jpg
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1203387163\bdca68a3-37d2-4b54-8ae2-668551cc103f\0df175d8-451e-4424-a77e-b2586cf69197.jpg
            • Size 193KB
            • SHA256 ac82e9b0ab99e708fd04eba142881e87661ae707f81ad923607619e09adae320
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            campaigns.json
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1203387163\campaigns.json
            • Size 2KB
            • SHA256 0fc5fb76672d9f5e844a6ff505ca83dab701e8474dbdae7c36303f86c4e2dc23
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            photo.json
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1203387163\photo.json
            • Size 50B
            • SHA256 c9b5c6de15d08254da3d561470114637abdf1715f2b24b4747152fd774d81bac
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tiles.json
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1203387163\tiles.json
            • Size 30B
            • SHA256 c79b6e5f6124ce0dc47ed10b897778a67b06bdc8d3db1b5d37ae119460df8fe0
            • MD5 SHA1 SHA512
            Submit Download

            2297758d-3212-4024-83a0-daa8e037403b.png
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2240_1804582558\bdca68a3-37d2-4b54-8ae2-668551cc103f\2297758d-3212-4024-83a0-daa8e037403b.png
            • Size 26KB
            • SHA256 791f7346c4046712e0dc30e2a63f36dc205c9dc7a56f6edf030a4894374e4936
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveCrashHandler.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveCrashHandler.exe
            • Size 270KB
            • SHA256 320e46cfb7abdc0fede4e702ae6e018edcb42b48c144be0b82221b10b86b8d9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveCrashHandler64.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveCrashHandler64.exe
            • Size 355KB
            • SHA256 f7b32468dc47bf6e99bd3dd3a0ab6dd1cbfb94d71f43f882f6ba3a2d3bbffbe2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveCrashHandlerArm64.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveCrashHandlerArm64.exe
            • Size 353KB
            • SHA256 282914e3c3bdd3313b27394c93eb6dd68c672d662a8f5f68365b2ee45f0b7b29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdate.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveUpdate.exe
            • Size 163KB
            • SHA256 e815d0bf80f13ad4aca0d25d3634e95f6906671558a2fbfa71237542181ec0d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdateComRegisterShell64.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveUpdateComRegisterShell64.exe
            • Size 170KB
            • SHA256 dcfd2d1cca9fc14206ab54d12d0f1f4865b86ca205ffae83e0687757251d5f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdateComRegisterShellArm64.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveUpdateComRegisterShellArm64.exe
            • Size 154KB
            • SHA256 d1b32e8ac39958749283906fb29ee6a87a77d101f705284927955f08f45f3f39
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdateCore.exe
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\BraveUpdateCore.exe
            • Size 195KB
            • SHA256 c28e1ddb30f1b958e3ec526e4dc1749de5b9880c01cf8f51a2301b380937f242
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdate.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdate.dll
            • Size 1.0MB
            • SHA256 0b94afd45fa47e936b87c1403c7a45ffafc063f4f3c079d6e961c5dea6fbbc44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_am.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_am.dll
            • Size 42KB
            • SHA256 a1a045c2f8b86536449c86dc1d0ca85471e270f603168b277a5e0bf424b6d0a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ar.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ar.dll
            • Size 41KB
            • SHA256 7efda1c2aef28b69dbb7826032737f642a3af33a43f8a249c5ed845a50de4618
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bg.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_bg.dll
            • Size 44KB
            • SHA256 6571cb39c767f37d96e54cf93c498a7f4815ea6c510addef0d2d82ba3e226d65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bn.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_bn.dll
            • Size 44KB
            • SHA256 265b949820cbd800cf10347b74e91fc8b18aed4a1b6ded6f5ba9fd546332562c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ca.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ca.dll
            • Size 44KB
            • SHA256 3e837d83d3586802938e84abe159c878e923c6a88313e124f7be45b892577663
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_cs.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_cs.dll
            • Size 43KB
            • SHA256 e5b34a557c75faa4808d823027f21fdbee3c29b14744b743c3fb535b8f2ba9e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_da.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_da.dll
            • Size 43KB
            • SHA256 0f53ffafae4cafbf5dc9a24de3a9238719ae325689fd153969fdf073d83c87e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_de.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_de.dll
            • Size 45KB
            • SHA256 c12998e00bf9a127801d585f7bb0368cb2bf12e4af9c1ba1ee5005d4917275f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_el.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_el.dll
            • Size 44KB
            • SHA256 270b44247659eac4ad19a1c325dae2139016326f33ccf6205a9a73689824f192
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en-GB.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_en-GB.dll
            • Size 42KB
            • SHA256 95871da9a8bd914286844c1273fedb34da4b94fd947d87419133ab19752a220d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_en.dll
            • Size 42KB
            • SHA256 552b282ca7b3a1d27003dc3a35d5501f65e4693913744fe5a57489143622257a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es-419.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_es-419.dll
            • Size 43KB
            • SHA256 7bcfa71f78437acfd8ccc5c92f119c3f163fe02d7b29ed33e05e0199db7f7c62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_es.dll
            • Size 45KB
            • SHA256 b65901c81137817f3db451ca9ef450dd8a5660f0dd50ee9b5bfd5e425ad35cd3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_et.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_et.dll
            • Size 42KB
            • SHA256 7271ddfd917beb7a45b7ba3b0d68a2e5f25b153e4db4704a15a51c5e89951ae1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fa.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_fa.dll
            • Size 42KB
            • SHA256 947d2f99600f1a6f8d7d35abc00cdc0d006c423ce7f230edbac70e0bf07fc7fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fi.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_fi.dll
            • Size 43KB
            • SHA256 aad440a632ba4ba25acad3299ea44083841e6ec5e779ae607f2863be9098463a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fil.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_fil.dll
            • Size 44KB
            • SHA256 553d9b42ec5ac83202f188f85f3082904ba59f1b848c213e410ebd23e155e8f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fr.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_fr.dll
            • Size 44KB
            • SHA256 e42d07cc5a9f7f6c392463612e758a6c38cd5db79d7f6775975bbc177fff4a5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_gu.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_gu.dll
            • Size 44KB
            • SHA256 18a2a3a9e77b187420722de7325ee9361b8af48c8e82e39739dced1ed1f3cd91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hi.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_hi.dll
            • Size 43KB
            • SHA256 7bbefbf11430c767c140cf3437fa1af702577969bfe60b1b90d1e031827b69a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hr.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_hr.dll
            • Size 43KB
            • SHA256 4450b6cc210d532e6ca90eae1ffdc69b170ba8443c21a3486fdf596955266798
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hu.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_hu.dll
            • Size 43KB
            • SHA256 0dbb85f8f7ccc3bb7c139ff6ed0d3cdc211494ff8900d9f789d2c168430a71df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_id.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_id.dll
            • Size 42KB
            • SHA256 2263aa92b5873ede7abed95489723e161bf90eb4ee224dec09700cfe1af3f6a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_is.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_is.dll
            • Size 42KB
            • SHA256 090372d2fc9e4a7cb79456c259e4c2f9a3479022b2e3e3d7ab0753426894a2bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_it.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_it.dll
            • Size 44KB
            • SHA256 4f2b108c8a046d5e197af2f490b453869b6191e7d2c96b08d1aeea3da67d1806
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_iw.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_iw.dll
            • Size 40KB
            • SHA256 c56d41e1c9347e29cc16f45227fb56049952ee7da311af0bb2579dcb48fc0b4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ja.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ja.dll
            • Size 39KB
            • SHA256 f07cb69684caccf618a36e9cb1dc442efaafc4ec85c81994c01fc63da1c40e96
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_kn.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_kn.dll
            • Size 44KB
            • SHA256 66f094238550de25686cc750d98c47830ccf0559d8dcb29fe7ee6b9c25945596
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ko.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ko.dll
            • Size 39KB
            • SHA256 3683d51ac7cc8cd777eafbab2f5675595acf505ea9b605bf93047d5a97b74df8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lt.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_lt.dll
            • Size 42KB
            • SHA256 902a3fb679e913cac822520aa2e00be362dd540a7bb7a5c6dc9783460f9b957a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lv.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_lv.dll
            • Size 43KB
            • SHA256 e6d74044f255c8703e99e51f8c45c3ee0b8212a25b55fcba45708caab987f6c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ml.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ml.dll
            • Size 46KB
            • SHA256 b084a44eb505c18e36019c8c4e2c31f04e6e685cc6e9406d5aa455379effbc32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_mr.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_mr.dll
            • Size 44KB
            • SHA256 c33a9edfce5f940c6a6203df87d3c227434e97bbe4b29f55a57021c1b6a90e96
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ms.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ms.dll
            • Size 42KB
            • SHA256 6aee44c92fcd6838211ad0eb0c965a66640d2182b1e244708103e286c70f9837
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_nl.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_nl.dll
            • Size 44KB
            • SHA256 23c5cae801f6d2b17036152718ef08ed43c2ed91eb993467236bbba54c76139e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_no.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_no.dll
            • Size 43KB
            • SHA256 4ccd4b64761c87d4ab2abf406c05582c0a300b60d18886dc0bf7bbe936e418a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pl.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_pl.dll
            • Size 43KB
            • SHA256 9f5d9a290dd951af64fa8e209bc669bdc41c0c12edcafb25cf59c08315da86e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-BR.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_pt-BR.dll
            • Size 43KB
            • SHA256 2850fa9e32a609b0940373ecc24b5955e30218dee02623204003d3360c697e3f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-PT.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_pt-PT.dll
            • Size 43KB
            • SHA256 49d5f867b4776c0f8d31e60049483a8f9f46b729971f7b3611e84a8f77b6ea7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ro.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ro.dll
            • Size 43KB
            • SHA256 a2a7ec0bdc5d3acd40f71f34c7989c4e76c90ee4bc2de113f530e064c27cb654
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ru.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ru.dll
            • Size 42KB
            • SHA256 72369ef0fd5ed0fc5ea0980a6ff7c001bcb86eee9ff2e0b4489949156c075128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sk.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_sk.dll
            • Size 43KB
            • SHA256 f8976149b65cf64ec86270b0b41a747713460486f2400a6bc0af6b5b390ffb86
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sl.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_sl.dll
            • Size 43KB
            • SHA256 c05008652c1ea0f818c6cf2554db4c518881dcc317fd051eb9d1ec2267ffcd14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sr.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_sr.dll
            • Size 43KB
            • SHA256 9e89dda0d70012bdf6037513f624908aa204f6cf883fdcf18499a88849b47f72
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sv.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_sv.dll
            • Size 43KB
            • SHA256 05ee6d95fae01a35c7b12747eff2f5434521d000fbb4f0d5c184d76a9699d811
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sw.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_sw.dll
            • Size 44KB
            • SHA256 9d7de676a56af9b4357484c307d4086a6c16f1764bd1d8d1c858f2bc31d183c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ta.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ta.dll
            • Size 45KB
            • SHA256 66f41d75158bb768852c555c84cfd8cf8dca9e9813f11b91a177da2ca81d9fb9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_te.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_te.dll
            • Size 44KB
            • SHA256 776d71990d06563739410d1e6035144cd1680e05ee97d395fb48afca658caa99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_th.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_th.dll
            • Size 42KB
            • SHA256 e7de853055a5f887b7da1b90de58193fbcae8435c0e6ed418b4b394ecd9c0b53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_tr.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_tr.dll
            • Size 43KB
            • SHA256 93e724613680aa3bdbe8fe8407f35a4601a0d7d160807bc572eeaa3edf63cfa7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_uk.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_uk.dll
            • Size 43KB
            • SHA256 2e5121c919b0625f486409baea4115abd268712b271212fb3f110fac4dad9585
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ur.dll
            • Path C:\Windows\SystemTemp\GUM2B5D.tmp\goopdateres_ur.dll
            • Size 42KB
            • SHA256 c433aea78884d2d780f3c75bd7ace1ccc00aa8077416757ea9eb64f5bb106396
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/836-183-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/1272-182-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/1276-181-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/2716-184-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/2716-0-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4216-578-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/5876-579-0x0000000000400000-0x000000000041F000-memory.dmp
            Download