Overview

overview

6

Static

static

1

BraveBrows...10.exe

windows10-2004-x64

6

BraveBrows...10.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    102s
  • max time network
    101s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 17:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BraveBrowserSetup-BRV010.exe
  • Size 1.2MB
  • Sample260804-vv729stscx
  • SHA256 5592d75e8e40f8379c598db99f402a6ebef26f5dd9b8659826852de1f67bd113
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 55 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe
    "C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\SystemTemp\GUM5DB7.tmp\BraveUpdate.exe
      C:\Windows\SystemTemp\GUM5DB7.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4476
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4052
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3696
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4956
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGNkM4NDNEQy00NUNCLTQwRDYtOEE5Ni0zOUY4RDkyMzcxQ0F9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7OTYyMkQ0RUUtNzdGMy00MkE4LTgwNzMtQjY1MzVERjA5QjVFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTExNCIvPjwvYXBwPjwvcmVxdWVzdD4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2692
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{F6C843DC-45CB-40D6-8A96-39F8D92371CA}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3400
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:5384
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:1380
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:3148
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\guiC878.tmp"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\guiC878.tmp" --brave-referral-code="BRV010"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff761ef3368,0x7ff761ef3378,0x7ff761ef3388
          4⤵
          • Executes dropped EXE
          PID:5056
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\guiC878.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{9FECC0EF-C641-44A5-A462-FB409656DB56}\CR_E8136.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff761ef3368,0x7ff761ef3378,0x7ff761ef3388
            5⤵
            • Executes dropped EXE
            PID:2492
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGNkM4NDNEQy00NUNCLTQwRDYtOEE5Ni0zOUY4RDkyMzcxQ0F9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QTVEM0U0MjItMTkwRC00MjAwLTg4M0UtQ0Y1NDcxNEQ5OEE2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjEuOTMuMTI5IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNTEuMS45My4xMjkveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNTYxMDYzMjAiIHRvdGFsPSIxNTYxMDYzMjAiIGRvd25sb2FkX3RpbWVfbXM9IjE1MDkzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MTUiIGRvd25sb2FkX3RpbWVfbXM9IjE3NDYxIiBkb3dubG9hZGVkPSIxNTYxMDYzMjAiIHRvdGFsPSIxNTYxMDYzMjAiIGluc3RhbGxfdGltZV9tcz0iNDc3MTkiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4508
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1712
  • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
    "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5624
      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80575da00,0x7ff80575da10,0x7ff80575da20
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2116
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1664,i,251504963676758189,17788801640272634372,262144 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1892 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1436
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2024,i,11832062278045803372,9338748119436909005,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:5648
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2488,i,13056159046370906999,16430439681252776531,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2632 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5604
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3376,i,15156939225027623480,7976944248570559610,2097152 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3392 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3080
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3440,i,12705267414587099172,6848431989804033450,2097152 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3428 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2540
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4788,i,17144117585297615177,7398288540917178280,2097152 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4808 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5416
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,13628293714063840890,15450118200344531867,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5716 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4132
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,8665378623619112228,5159475375217293151,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5832 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3452
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,1698110383648242144,15894548737072705418,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5988 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3784
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff790963368,0x7ff790963378,0x7ff790963388
            5⤵
            • Executes dropped EXE
            PID:1160
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff790963368,0x7ff790963378,0x7ff790963388
              6⤵
              • Drops file in Windows directory
              • Executes dropped EXE
              PID:5380
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,1256448124967889148,5144850655507837081,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6084 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3952
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,12330280218213796406,18213854200835902921,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6012 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2944
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,11012965830818186578,10203461163800699396,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6060 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3616
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,9822230551899354935,15063378373375789539,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6284 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1176
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,17360010332521949341,4800003701388402647,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6516 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4620
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6612,i,1384040816815358460,15586185667555522790,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6592 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4336
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,8651636009327821669,14319822388371560741,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6072 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2660
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,9644073110588166908,12545510482518972997,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6096 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2748
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,16046091157391039007,16113248462139882537,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5852 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3284
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,8530467764436646319,13043560704523389403,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6396 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4336
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,15629387255709024314,18090896438060389557,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6392 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3936
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,14140745556027817843,6439453434790270565,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6600 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3916
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,4009768660624174743,7792274962365063533,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5924 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5012
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,8425022379360983820,14341385378628042339,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5840 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3448
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6768,i,5539681684241947687,9559483385324015185,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=5992 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:1916
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,8677188468392158586,9090818588502544773,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6392 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6132
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,574178967718787666,4419872606322243150,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6128 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:2916
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,2111715570548265932,12013253753943709690,524288 --field-trial-handle=1896,i,14470765566211417094,16828949413153341075,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1900,i,578128459101765000,2146421995909525271,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=5116 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4964
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2044
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:1100
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:1876

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          messages.json
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1388_55342508\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\sr\messages.json
          • Size 9KB
          • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9cac2b9a-1b77-4b8f-9d44-ca775a6f3866.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\9cac2b9a-1b77-4b8f-9d44-ca775a6f3866.tmp
          • Size 10KB
          • SHA256 48ef30b34ec8373a68baa2dbed3084fe05ae949ad4d7f68d1a4045fcad09b049
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0928b4fb-ddf7-455e-a009-5efa39be2d22.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\0928b4fb-ddf7-455e-a009-5efa39be2d22.tmp
          • Size 165KB
          • SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
          • Size 19KB
          • SHA256 23852cb7830ac3a13cb6e9e617359f9689903a4db631f1feea04ad12171da22f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
          • Size 19KB
          • SHA256 98f1965cf81d875a26b370e6da0df9ac8ac27bcfb149fd785a8c444fe7f47042
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          da231ba1-b821-48ff-8751-c61f22f99254.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Service Worker\ScriptCache\index-dir\da231ba1-b821-48ff-8751-c61f22f99254.tmp
          • Size 72B
          • SHA256 b390eec4df42ff4ed0b95b6779417f75b57e176b4c2a0c5784c7356848f26ba0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 72B
          • SHA256 eaf5f06f00e1b344786c90a948137725f3ee3226867766659294bfa50459e168
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Sync Data\LevelDB\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          c8f23239-cc3e-4bf2-b375-9786e8de8849.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\c8f23239-cc3e-4bf2-b375-9786e8de8849.tmp
          • Size 3KB
          • SHA256 99cafd2407c0641002d60824614852f8782aa4e40a76520e809f9d87429c78f1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 53KB
          • SHA256 8fb4d709701d11c7a1ffabe5f4e1efaafe6e644e00b2a08ff0e2dcd31f31067b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Size 11KB
          • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
          • Size 3KB
          • SHA256 2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
          • Size 16.9MB
          • SHA256 33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          69c82bc03ad463df73f0adf15796a08b918b23d3a52e49199b654c2db9050df4
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\69c82bc03ad463df73f0adf15796a08b918b23d3a52e49199b654c2db9050df4
          • Size 12KB
          • SHA256 69c82bc03ad463df73f0adf15796a08b918b23d3a52e49199b654c2db9050df4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          6d7a4a96e2b56ce8f264b28b2d5027e4afd565f798cce03571545ba60fe600f7
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\6d7a4a96e2b56ce8f264b28b2d5027e4afd565f798cce03571545ba60fe600f7
          • Size 1.5MB
          • SHA256 6d7a4a96e2b56ce8f264b28b2d5027e4afd565f798cce03571545ba60fe600f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
          • Size 264KB
          • SHA256 72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          752d722a65dbd61ed2dbc07703f6c5b0b565ec7b5d333a59b78191406941a41a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\752d722a65dbd61ed2dbc07703f6c5b0b565ec7b5d333a59b78191406941a41a
          • Size 3.0MB
          • SHA256 752d722a65dbd61ed2dbc07703f6c5b0b565ec7b5d333a59b78191406941a41a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Size 7KB
          • SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8500527438f6697cff37f283193ae137b837c9b360d52bc7ea64d97abc88f605
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\8500527438f6697cff37f283193ae137b837c9b360d52bc7ea64d97abc88f605
          • Size 5KB
          • SHA256 8500527438f6697cff37f283193ae137b837c9b360d52bc7ea64d97abc88f605
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8f59578c49022c4d9b1fc9355a5c81edc3d3f322cf30bdfedf7a7b015e19952a
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\8f59578c49022c4d9b1fc9355a5c81edc3d3f322cf30bdfedf7a7b015e19952a
          • Size 1.6MB
          • SHA256 8f59578c49022c4d9b1fc9355a5c81edc3d3f322cf30bdfedf7a7b015e19952a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
          • Size 3KB
          • SHA256 925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
          • Size 88KB
          • SHA256 99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          acb05be22407fc4915b7412e4b9648f156e47b57203cd5ebc5deb7a2d65ef8ef
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acb05be22407fc4915b7412e4b9648f156e47b57203cd5ebc5deb7a2d65ef8ef
          • Size 479KB
          • SHA256 acb05be22407fc4915b7412e4b9648f156e47b57203cd5ebc5deb7a2d65ef8ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Size 14KB
          • SHA256 acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          b1b4e6bb531f8ce0361278384c8e36ea03e406cedeb8b953634d12327f68102d
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\b1b4e6bb531f8ce0361278384c8e36ea03e406cedeb8b953634d12327f68102d
          • Size 2.7MB
          • SHA256 b1b4e6bb531f8ce0361278384c8e36ea03e406cedeb8b953634d12327f68102d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
          • Size 19KB
          • SHA256 c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
          • Size 48KB
          • SHA256 ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Size 3KB
          • SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          d46e72f41c776ea81b3c8a6a97aba96ac7681036779774b13717a4b186f90202
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\d46e72f41c776ea81b3c8a6a97aba96ac7681036779774b13717a4b186f90202
          • Size 475KB
          • SHA256 d46e72f41c776ea81b3c8a6a97aba96ac7681036779774b13717a4b186f90202
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e706b03a-8549-48c2-8da0-1b0b3c6f461a.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\e706b03a-8549-48c2-8da0-1b0b3c6f461a.tmp
          • Size 1KB
          • SHA256 f8fb558b9248c19c9e7e85a10bae1791d00cd1f6f59f3342551945a63394b3d8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          fc608a02fc210508263947d934bfaf33f46cda7373e96fa0ce2fd8b83dc95ffc
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\fc608a02fc210508263947d934bfaf33f46cda7373e96fa0ce2fd8b83dc95ffc
          • Size 3KB
          • SHA256 fc608a02fc210508263947d934bfaf33f46cda7373e96fa0ce2fd8b83dc95ffc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
          • Size 2KB
          • SHA256 8db7a376f8d391b0a1dc3785d28b22d95a9a8010a3332778c435e27a5b9b5769
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cd51bf18-1293-49c8-b17f-2ae61bff4664.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\4ba7cac3-3a7f-4634-b868-ca6da5683dca\cd51bf18-1293-49c8-b17f-2ae61bff4664.png
          • Size 41KB
          • SHA256 93ea996e94f18cff0b61ea0314e7ea9b006fd15cd08b4092b1610eed484f4970
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
          • Size 341KB
          • SHA256 2a54364257349b6c145fa4dd7ec41d3e0b8ab3144205b6f0cd58578aa370e671
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ask-brave-icon-DdJTJrmV.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\ask-brave-icon-DdJTJrmV.webp
          • Size 2KB
          • SHA256 3788d823c7714a2e36547bd5fe86c834b86cb6c182858e047789aee196f1f598
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          de-de-warum-haben-schnecken-ein-spiralformiges-haus.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-warum-haben-schnecken-ein-spiralformiges-haus.webp
          • Size 89KB
          • SHA256 e0b0cfe5973b946bb2919d87d875a34e2b525171f1bfa475c0deec0e2a044736
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp
          • Size 84KB
          • SHA256 3bb3d5f492e71d4ad79872906108125d4f01c2005ab27552eb3d5f52f428abda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de-de-wird-die-sonnenfinsternis-am-12-august-in-deutschland-zu-sehen-sein.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wird-die-sonnenfinsternis-am-12-august-in-deutschland-zu-sehen-sein.webp
          • Size 66KB
          • SHA256 e1930e71d842ad513c6c4faac354aad6a6cb80339633f89156034ac51bc673ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-ca-whats-the-tallest-free-standing-structure-in-canada.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-whats-the-tallest-free-standing-structure-in-canada.webp
          • Size 64KB
          • SHA256 83a011a9a26d8c47ee8e55d4c6af92e80f64a104166bac91f508615aa4c25716
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-ca-wheres-the-best-place-to-watch-the-perseid-meteor-shower.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-wheres-the-best-place-to-watch-the-perseid-meteor-shower.webp
          • Size 63KB
          • SHA256 7cd1aaa11e5ecdb89c3b1756f4d201d5fb4defa34a737a671c70f4ce39e16512
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-ca-why-do-loons-make-that-eerie-call-at-night.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-why-do-loons-make-that-eerie-call-at-night.webp
          • Size 61KB
          • SHA256 b4a4149a5d5820df9d290ae2b82138a5a86db000393feb74acfa0db0b65ad920
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-gb-whats-the-loudest-sound-ever-recorded.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-whats-the-loudest-sound-ever-recorded.webp
          • Size 113KB
          • SHA256 fa4536790374bde58f92fa2015544b893437c528ea2bc1e6935a419a3a7cc053
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-gb-why-do-robins-sing-through-the-night-in-cities.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-why-do-robins-sing-through-the-night-in-cities.webp
          • Size 65KB
          • SHA256 159ead72d2a82344869b7b2635e18188178b8550c94ae5dc1d426bb53f7f031b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-gb-will-the-uk-see-the-total-solar-eclipse-on-12-august.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-will-the-uk-see-the-total-solar-eclipse-on-12-august.webp
          • Size 60KB
          • SHA256 ec3633708525f629e39466e84946b74ace63b66fb36ba6fbdbe0a513e2c175ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-us-what-does-space-actually-smell-like.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-what-does-space-actually-smell-like.webp
          • Size 80KB
          • SHA256 0c40d0a8cbdb67b6fdb20aa4d0a01bec08f862fcda6058a759a2e479cfe736c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-us-when-is-the-next-total-solar-eclipse.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-when-is-the-next-total-solar-eclipse.webp
          • Size 67KB
          • SHA256 c14968bc2fac58ef7e825fb48e4df2031de1ac753058e923221d8c99a4f88da4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-us-why-do-flamingos-stand-on-one-leg.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-why-do-flamingos-stand-on-one-leg.webp
          • Size 97KB
          • SHA256 e6900ccbc3cfd91c5c8dd14ae66dfd46687c4b028b62b0c1c26a726ba8b380c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-us-donde-se-puede-ver-mejor-la-lluvia-de-meteoros-de-las-perseidas.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-donde-se-puede-ver-mejor-la-lluvia-de-meteoros-de-las-perseidas.webp
          • Size 80KB
          • SHA256 59d78c615a13235834d28ca4aefeffb5805bd06ff6553058f84094fbb86b5acb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-us-por-que-los-delfines-duermen-con-un-ojo-abierto.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-delfines-duermen-con-un-ojo-abierto.webp
          • Size 66KB
          • SHA256 7bdfc33b83981fe9ea30a7025b80e8526314d1d6c67f98cbfa02e892fd4ce8a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-us-por-que-los-pulpos-tienen-tres-corazones.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-pulpos-tienen-tres-corazones.webp
          • Size 74KB
          • SHA256 98c8de5527043a62670cf1608d99ee8356392c68e049c1bcc2172f5c2a2a0151
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-ca-a-quelle-distance-un-orignal-peut-il-vraiment-nager.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-a-quelle-distance-un-orignal-peut-il-vraiment-nager.webp
          • Size 69KB
          • SHA256 9f638f93fd61639a580d62c7fd9e5cc878cf625f6f0b5cf894b6d00ee4339483
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-ca-pourquoi-le-castor-est-il-devenu-le-symbole-du-canada.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-le-castor-est-il-devenu-le-symbole-du-canada.webp
          • Size 79KB
          • SHA256 276dfce7d00b7446a0846a5729089335abc606c0a3c955b6a855833a10a8bd58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-ca-pourquoi-les-aurores-boreales-sont-elles-si-frequentes-en-ce-moment.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-les-aurores-boreales-sont-elles-si-frequentes-en-ce-moment.webp
          • Size 73KB
          • SHA256 23f18315f7453efdffda5e41e1f273f00c41a2d7956472efc52cfe52c7ede866
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-fr-leclipse-solaire-totale-du-12-aout-sera-t-elle-visible-en-france.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-leclipse-solaire-totale-du-12-aout-sera-t-elle-visible-en-france.webp
          • Size 72KB
          • SHA256 0360522c1179aba33cb0e6b379d4014a8ed3d36afc31d3cc2cc789b29e85cea2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-fr-pourquoi-les-chats-ronronnent-ils-vraiment.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-les-chats-ronronnent-ils-vraiment.webp
          • Size 76KB
          • SHA256 973af3bf072efde4b78d525386c860b54aa8059a340634e714fbbbc519ecb96b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-fr-pourquoi-y-a-t-il-autant-de-boulangeries-a-paris.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-y-a-t-il-autant-de-boulangeries-a-paris.webp
          • Size 81KB
          • SHA256 23d5cbd6f35e51b7a6e140c588dc700fc603c4184260bebcdf90b99145cabcb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index-1ilobi2k.js
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-1ilobi2k.js
          • Size 179KB
          • SHA256 7481ea913dbba3b04d178b8e3757cf38c9e03f0a2cf4993d644fa4d6f83089a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index-C8g22OGQ.css
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-C8g22OGQ.css
          • Size 30KB
          • SHA256 19b099627396007cfcf21d64ed208361dce53926523439f3102fb7ee96323ad4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index.html
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index.html
          • Size 4KB
          • SHA256 e64e0da634bbd8b22e6c8762f323bd8a556384523987e45488d8c05d6c65b162
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\logo.webp
          • Size 6KB
          • SHA256 fbe1831f3abb9be1d5b81785055bac244f70553e51a25556f558c31cb2ac6e37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mouse-pointer-DSDsXotA.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\mouse-pointer-DSDsXotA.webp
          • Size 136B
          • SHA256 c53bc691edd32cbc245bdd461b5fc36ef21afc3d8e4304f0df49119204e0b0ff
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          search-icon-BD6Rfjhr.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-icon-BD6Rfjhr.webp
          • Size 1KB
          • SHA256 02f34d12e8f5f7a2838bde1be407fe1f9815dae8678cd6c77c7c031a6f41d8df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          search-logo.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-logo.webp
          • Size 5KB
          • SHA256 3a1dec651528a4b789020b9bc240f7c7a1ffef36cc3024095cc6c6c73da7ec85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wallpaper.webp
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\ebec0987-c5ed-4874-8fbf-032c1cc6da91\wallpaper.webp
          • Size 38B
          • SHA256 2f9a4c22931833a8fc296bf89b86d94eec618752a62a1add43b753a77c80852b
          • MD5 SHA1 SHA512
          Submit Download

          photo.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\photo.json
          • Size 50B
          • SHA256 c9b5c6de15d08254da3d561470114637abdf1715f2b24b4747152fd774d81bac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tiles.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2072_260031346\tiles.json
          • Size 30B
          • SHA256 c79b6e5f6124ce0dc47ed10b897778a67b06bdc8d3db1b5d37ae119460df8fe0
          • MD5 SHA1 SHA512
          Submit Download

          BraveCrashHandler.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveCrashHandler.exe
          • Size 270KB
          • SHA256 ea698af883bd96f1e4fb29b85785997420def8ec42e7f91fbbaf43f3db493582
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandler64.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveCrashHandler64.exe
          • Size 355KB
          • SHA256 681d60a96bfb704c5a0d905c26f364f4869326c040319d3e9c706f3801e58963
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandlerArm64.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveCrashHandlerArm64.exe
          • Size 353KB
          • SHA256 04d32a0f30fd2e685289814c709c15ba03096175f4638d1a4a3c49cb57748b1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdate.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveUpdate.exe
          • Size 163KB
          • SHA256 cef8c0af5f698a7665631844af423c8a09f63310520a4d3bebed4e4341fe1b6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShell64.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveUpdateComRegisterShell64.exe
          • Size 170KB
          • SHA256 1dd463192561e8953b0625618119d21f80bf1923828b3bdc97c3d70adaa39846
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShellArm64.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveUpdateComRegisterShellArm64.exe
          • Size 154KB
          • SHA256 14e5f7d08369626c62a37f2d9920a9057653a007bf24d642d8c4c77cc4b1b00a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateCore.exe
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\BraveUpdateCore.exe
          • Size 195KB
          • SHA256 d9ad02b89918d77763f133417f56b02349ee0b0f0f7d4f6e2409fbfaaefb167b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdate.dll
          • Size 1.0MB
          • SHA256 775f7d667acc1b117474d6dacce7ed83aa49ae2f7a92c5e50c11583cb88c2ac3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_am.dll
          • Size 42KB
          • SHA256 e785d7058810a73e484ad0f7d5fcf55162d35180b79d8f3c06aadb75d80d56ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ar.dll
          • Size 41KB
          • SHA256 fe55a1546621d7f9405b0e4a29dbe7261599e6f94cd57fc310037fc43087e9b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_bg.dll
          • Size 44KB
          • SHA256 46696c9da4526e22838e049d2e445f4ef47e5e755207c1113a595db28d1bb60e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_bn.dll
          • Size 44KB
          • SHA256 224ab75018f1a3744ca3b64e9ac031c8b628afbc5b767c94a8a7efbd2b8857f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ca.dll
          • Size 44KB
          • SHA256 e32bcf68448a40489f035c2dbdc5dd817554143e5900795e42dee85fb86287fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_cs.dll
          • Size 43KB
          • SHA256 7562edd2b97b8033eb89c14020d479d7ab092d3c487fcbab9b4b58663024d36d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_da.dll
          • Size 43KB
          • SHA256 b8426493d7aed6d308f4ae5b93c0991784ee0a299cfd93d928bc8a96c2da3490
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_de.dll
          • Size 45KB
          • SHA256 9765c1efac552441deaf5bb6fef329e9e67ed65f540bb17cb1767718bd0c2349
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_el.dll
          • Size 44KB
          • SHA256 e752f141dc7051b7d732c341d4879977a8be2c7e028fc8d745fa54cb7de5e61d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_en-GB.dll
          • Size 42KB
          • SHA256 f044b3a896cd6b97093c50608f52cd9d15a23038b1c878bc64a85a83c41dd635
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_en.dll
          • Size 42KB
          • SHA256 43c7383c2b5463bb5e343268639aff19e676cf492e17ffc7633600a7de0ffb65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_es-419.dll
          • Size 43KB
          • SHA256 43360612616b2cc9690447812d6b9d024a9231c4723e7042711e544aa951e1a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_es.dll
          • Size 45KB
          • SHA256 766c440504bd67564c1fe2acab7407393e5825af868590fe46280a5d35b7d520
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_et.dll
          • Size 42KB
          • SHA256 0422309e1e82005b5ba9788caf01595f575f712c774a76654fc2437ce63d282c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_fa.dll
          • Size 42KB
          • SHA256 edd8c539f7ae7dce62f812f6f702929f07675eb5dfb06c0b932dedcba7bad212
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_fi.dll
          • Size 43KB
          • SHA256 32a2b19eb8b2d64b379a412021cd387940be07db4ad449d9ef4d92208c6bd8b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_fil.dll
          • Size 44KB
          • SHA256 4ffdb92e9a53207df3dd8c4a2c335e80d676a8969e6851d5708c912577a801e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_fr.dll
          • Size 44KB
          • SHA256 8466d6fb5c8c40dfe9bf1c042b66b86e0bc0ab6f713d7a22a43db18707d2ac46
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_gu.dll
          • Size 44KB
          • SHA256 398b7f7bebd8aa48f6fe3a6754a2dc4f08c4bc46d12fbab2ec9e41c6ecc66cd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_hi.dll
          • Size 43KB
          • SHA256 9826dcfcbfbaf6af4d05aa1080bef8b7107d2c694d26a1ea49367155936f5e12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_hr.dll
          • Size 43KB
          • SHA256 59495d4298b764115706f4521f150e77fe0fe9e3faddaa4506e171c360337d7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_hu.dll
          • Size 43KB
          • SHA256 9d8bb1be91832138417138e003e56ac61f3e0a1be6993753085335d5b6e1f97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_id.dll
          • Size 42KB
          • SHA256 1effc734b01c7180ed875a62ba258acd338f5c613123a1050ef0796224a5be84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_is.dll
          • Size 42KB
          • SHA256 c451d333bae1a3c1d2447894f8e3a3bf6b4ceed57b51a934e8462b00e793f7e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_it.dll
          • Size 44KB
          • SHA256 fb92a3d4bf1fa5cda03447b3583e8770a0a8c47099b3eac7af595776404926e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_iw.dll
          • Size 40KB
          • SHA256 284d5960d302d20a8e7037d44bbf260d911ecba73919126aa50b6a3ad1765087
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ja.dll
          • Size 39KB
          • SHA256 f0451c7486530b549fe3fe5de9c74372511021c82e0a6216bcdce96382ca3d27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_kn.dll
          • Size 44KB
          • SHA256 9d7e1b34d7b2dd20559ce9ecd55a0a8200d9d477c27a49502d4de191921990fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ko.dll
          • Size 39KB
          • SHA256 f70f67f28a4e11e343b4782768f2899e9c28451ed4038c65cf45fc5181c41588
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_lt.dll
          • Size 42KB
          • SHA256 19e071fe3d9174c82cbefa3bca6bc2b48f29d3efb70a6c3dd196e2fc58296ba7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_lv.dll
          • Size 43KB
          • SHA256 ced0da6882cdf05604e5f23b5a4f57ace6c4ee5ce8be4bded42b3cac75463c4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ml.dll
          • Size 46KB
          • SHA256 cc3925d5c900e3be8f6fcf84dd0b325bcc3680abd1f64bc1a2c6f1b9fc3c3d68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_mr.dll
          • Size 44KB
          • SHA256 fa3efe2998fbb476b083e4b5dd0db8c07b4c8a341918e188e875252b0aab4b0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ms.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ms.dll
          • Size 42KB
          • SHA256 ac4096f8ebfc348d21dd721f07e43794f76459039b95ceb58efb6310dc8e8c98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_nl.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_nl.dll
          • Size 44KB
          • SHA256 d31b89d3f05c60f6621d5dc320284b946f91f0a3519512f4f40008892c05ac02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_no.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_no.dll
          • Size 43KB
          • SHA256 c138bc33de535bc4c4084a6297a92ea4f8dcb477839b19f117ddf30c48e87e49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pl.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_pl.dll
          • Size 43KB
          • SHA256 bdab9de34742748234dbd7edb07d30290835d88fefb3d5efec07c3a3fa2c1145
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-BR.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_pt-BR.dll
          • Size 43KB
          • SHA256 bc0200cf2aa39daf3f17def9f88d070875738a35f9c92a5147037ba4afaa51f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-PT.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_pt-PT.dll
          • Size 43KB
          • SHA256 11a9211b04f7b8f7b213c957d8c8af9543d60063b761f2c02392a8c872781a7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ro.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ro.dll
          • Size 43KB
          • SHA256 03aa2cfb87e018ffb00d43f02af28806b7230ce20375d7fc8722dc51446408b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ru.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ru.dll
          • Size 42KB
          • SHA256 86fbf734046ef4676f19fab3be40555de193b5604d2954ea59e2ce0c086fb92c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sk.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_sk.dll
          • Size 43KB
          • SHA256 b2943158a333968a6058748e187c376060a0b287e185db6bc9583e2322db8268
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sl.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_sl.dll
          • Size 43KB
          • SHA256 8a89f32bd23cf216bf8bf17f46b62af096d17d71f3105803b7897b982c1d66c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sr.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_sr.dll
          • Size 43KB
          • SHA256 a7e61f272b12d806a3c62591658a84bc100d79c8bb24d85445b879d7e8e1134b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sv.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_sv.dll
          • Size 43KB
          • SHA256 5c3c4807aa80e4e6bc24a3e72d2a05de1e705450d3ea9418d7ee57e742336afc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sw.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_sw.dll
          • Size 44KB
          • SHA256 27d25b3687e9734dae0525e9d719fe8ec798e1bd55bf8bc7aec153fae0f87f42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ta.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ta.dll
          • Size 45KB
          • SHA256 0a701a4b7d31f0701c337ed4e78f2149918c529b25b97b7ed9f2c646dd54af3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_te.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_te.dll
          • Size 44KB
          • SHA256 ce030efe866b7db36a75c04a078552429d7cf6d6e6b4bcd23402934d70638779
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_th.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_th.dll
          • Size 42KB
          • SHA256 d6d780cc1649824c936eb3fa17c788b4024fcebc4a1080c909fb147b92e83066
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_tr.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_tr.dll
          • Size 43KB
          • SHA256 813a15466aecf8bbb992e21f506a202d5d0be3cfe14e4208f80844a7ed6d1f92
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_uk.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_uk.dll
          • Size 43KB
          • SHA256 859b5c812028204282af314af0fe481939053d9a76f33502e7ee40e258f4003b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ur.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_ur.dll
          • Size 42KB
          • SHA256 7501b46601b16989def51a3bec5a6f275323d00d93e4b6f692abe00447c7ca73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_vi.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_vi.dll
          • Size 42KB
          • SHA256 f403f637ced922caf83e7cf64ff78a110d3efe4af712427ad7965f2e223eec7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_zh-CN.dll
          • Path C:\Windows\SystemTemp\GUM5DB7.tmp\goopdateres_zh-CN.dll
          • Size 37KB
          • SHA256 1562c8f7734834f5895cd18ec8d9a315632d0cd559e22a51395f20dc82461940
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download