Overview

overview

8

Static

static

1

BraveOriginSetup.exe

windows10-2004-x64

8

BraveOriginSetup.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    900s
  • max time network
    527s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 02:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BraveOriginSetup.exe
  • Size 1.2MB
  • Sample260820-csfk5adn2y
  • SHA256 10d3765ad1ea932bf8bfc9a5313ddc701b8d048d24102a07f09a4c930a701ed2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BraveOriginSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\BraveOriginSetup.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SystemTemp\GUM3782.tmp\BraveUpdate.exe
      C:\Windows\SystemTemp\GUM3782.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={F1EF32DE-F987-4289-81D2-6C4780027F9B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1432
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3164
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3248
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3212
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:2652
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InszMDRDRkQyQi05REMzLTQ4QUMtQjlGOC1DQzUzMUQzRjJCODR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NjZBOTY4NEUtRkVCMy00NjcwLUI3NDctMzAzNURFQTM1NjE3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTI3NyIvPjwvYXBwPjwvcmVxdWVzdD4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1232
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={F1EF32DE-F987-4289-81D2-6C4780027F9B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{304CFD2B-9DC3-48AC-B9F8-CC531D3F2B84}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3776
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:2820
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2420
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:1940
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\brave_origin_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\brave_origin_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\gui199.tmp"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\gui199.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 "--annotation=prod=Brave Origin" --annotation=ver=151.1.93.137 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff7c1bd81a8,0x7ff7c1bd81b8,0x7ff7c1bd81c8
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:3624
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\gui199.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{96F5D18B-9A79-4E45-9334-1457D156CD2B}\CR_7FCA9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 "--annotation=prod=Brave Origin" --annotation=ver=151.1.93.137 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7c1bd81a8,0x7ff7c1bd81b8,0x7ff7c1bd81c8
            5⤵
            • Executes dropped EXE
            PID:4600
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InszMDRDRkQyQi05REMzLTQ4QUMtQjlGOC1DQzUzMUQzRjJCODR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7M0VGRDE1MTMtRTNDQi00RTI1LTgyNTEtREFGQ0U0RjYxNUI2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjFFRjMyREUtRjk4Ny00Mjg5LTgxRDItNkM0NzgwMDI3RjlCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjEuOTMuMTM3IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtT3JpZ2luLVJlbGVhc2UvcmVsZWFzZS93aW4vMTUxLjEuOTMuMTM3L3g2NC9icmF2ZV9vcmlnaW5faW5zdGFsbGVyLXg2NC5leGUiIGRvd25sb2FkZWQ9IjEzNjkyMjcwNCIgdG90YWw9IjEzNjkyMjcwNCIgZG93bmxvYWRfdGltZV9tcz0iNDA5NTQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQ1NiIgZG93bmxvYWRfdGltZV9tcz0iNDIyMDAiIGRvd25sb2FkZWQ9IjEzNjkyMjcwNCIgdG90YWw9IjEzNjkyMjcwNCIgaW5zdGFsbF90aW1lX21zPSIzNzA1NCIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5400
  • C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2012
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4816
    • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5756
        • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --from-installer
          3⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1572
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 "--annotation=prod=Brave Origin" --annotation=ver=151.1.93.137 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffe9c08ea00,0x7ffe9c08ea10,0x7ffe9c08ea20
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3536
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1712,i,11050180758239918028,17003468440969735595,262144 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1888 /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1992
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2008,i,9651834239081375092,12240913203007078829,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2052 /prefetch:11
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:3108
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2484,i,15817842168818093524,10964404841498676478,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2636 /prefetch:13
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2072
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,17771425664242546228,12997115233521277932,2097152 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3140 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1584
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,8663793491002211363,4042553714596065200,2097152 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3636 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4952
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,13135078202879072790,15432994212445102647,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5232 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4948
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,6028068810911853329,13741363109154990873,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5360 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4508
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,15849952992988080654,2040758364786171455,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5416 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3344
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,10825837376011676941,6693223556501768563,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5656 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3868
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3388
            • C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 "--annotation=prod=Brave Origin" --annotation=ver=151.1.93.137 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6cd9681a8,0x7ff6cd9681b8,0x7ff6cd9681c8
              5⤵
              • Executes dropped EXE
              PID:5072
            • C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Origin\Application\initial_preferences" --create-shortcuts=1 --install-level=0
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2372
              • C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe
                "C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 "--annotation=prod=Brave Origin" --annotation=ver=151.1.93.137 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6cd9681a8,0x7ff6cd9681b8,0x7ff6cd9681c8
                6⤵
                • Executes dropped EXE
                PID:1512
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,12003620359747021651,3130761465040088246,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5236 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4876
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,17121902079171566459,203097814674499018,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5916 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6020
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,1322949973885403511,4900209100452878424,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5924 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5488
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,15377248524494873467,2171392987965953989,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5992 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2124
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,8911475544466286577,5356205968364084070,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5372 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5380
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,3934793002996271627,16721145604445450053,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5468 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1204
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,13212636846381324235,1393486140324896517,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6120 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3192
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,7076095815549914290,4571876072350003282,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5920 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1104
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,8151401357902408652,14115708015653871742,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6004 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2672
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,5959271850880044004,5309147308146242523,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6128 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5976
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,9568515820208402518,6588683295102540198,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5520 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:788
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,4997370522428240636,4439672398159912505,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5912 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4924
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,124840502883866415,1353957691542833857,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5732 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:1304
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,12688758440189107770,8116938496793245756,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5708 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4508
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,1462179337227280655,15299640626875533331,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6004 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:3228
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,14517014557552171856,12376303883300132817,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5384 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:1028
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,9997456923834513469,3256073167393431965,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=5488 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5420
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,15479710112935682741,14768587389541341813,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=5912 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4004
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,9255996502839177001,10222317435669079080,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=5964 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4948
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,17731196394139258326,7724045427445781271,524288 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=5780 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:360
          • C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Origin\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=5736,i,3408391236252101905,5918865368219941533,262144 --field-trial-handle=1892,i,11144293874063565923,16687276159786120036,262144 --variations-seed-version=main@ae2d63b2fbefbf3e6d1b6a51f43560116ab0b7ae --pseudonymization-salt-handle=1896,i,14677423278788680460,7090530638160740054,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=5520 /prefetch:10
            4⤵
            • Network Service Discovery
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3264
    • C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\elevation_service.exe
      "C:\Program Files\BraveSoftware\Brave-Origin\Application\151.1.93.137\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:200
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:4912
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:4964
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2504
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4328
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"
          2⤵
          • Executes dropped EXE
          PID:6100
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3496
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3996
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4660
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:4608

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Active Setup

              1
              T1547.014

              Event Triggered Execution

              2
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Image File Execution Options Injection

              1
              T1546.012

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Active Setup

              1
              T1547.014

              Event Triggered Execution

              2
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Image File Execution Options Injection

              1
              T1546.012

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Network Service Discovery

              1
              T1046

              Query Registry

              3
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              System Time Discovery

              1
              T1124

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              messages.json
              • Path C:\Program Files\BraveSoftware\Brave-Origin\Temp\source4676_11048116\Chrome-bin\151.1.93.137\resources\brave_extension\_locales\sr\messages.json
              • Size 9KB
              • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3c26e251-a5a7-4840-9ff1-6aacae83b294.tmp
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\3c26e251-a5a7-4840-9ff1-6aacae83b294.tmp
              • Size 3KB
              • SHA256 8579f1f91253567d61fb850044b330430a661652771dde602f0181a8a91b7358
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Network Persistent State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Network\Network Persistent State
              • Size 301B
              • SHA256 e9793cc52a2ef055ea3eb0ef6ff61e4a4c6ecc0bd7ea79ba9de564583240917e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              SCT Auditing Pending Reports
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Network\SCT Auditing Pending Reports
              • Size 2B
              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
              • MD5 SHA1 SHA512
              Submit Download

              d3fe251b-dd20-4c40-8217-6eb9588252d4.tmp
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Network\d3fe251b-dd20-4c40-8217-6eb9588252d4.tmp
              • Size 59B
              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Preferences
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Preferences
              • Size 13KB
              • SHA256 fa842747a77626b79e4a9db40640c4674ecdf57cf347a92dd3cc3febe7198516
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Preferences
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Preferences
              • Size 13KB
              • SHA256 c044c97b2c36b77fd087e41a4965eec541d07f6dd2fe597374a2d9dc285b2083
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Shared Dictionary\cache\index
              • Size 24B
              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
              • MD5 SHA1 SHA512
              Submit Download

              CURRENT
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Sync Data\LevelDB\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              MANIFEST-000001
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512
              Submit Download

              d83d30f1-9881-4623-b78d-6c84684c9609.tmp
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Default\d83d30f1-9881-4623-b78d-6c84684c9609.tmp
              • Size 181KB
              • SHA256 4ef93b727b703600f9ed557abfeef3916835db74def8835767a656dc5f3706fe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data_0
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\GrShaderCache\data_0
              • Size 8KB
              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_1
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\GrShaderCache\data_1
              • Size 264KB
              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_2
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\GrShaderCache\data_2
              • Size 8KB
              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_3
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\GrShaderCache\data_3
              • Size 8KB
              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 16KB
              • SHA256 890cdb395417f0af51ebc294518b0bd620d5de55609b10c936454f065a71ab5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 17KB
              • SHA256 2abd9974297013ac7d1cdd5af8c8290d9e9bc0169c4f37573a7f4b5e70090b4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 17KB
              • SHA256 74188325c1265df98dda65abcd2b440921b5ac368aa9cb731073d538ed792f07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 17KB
              • SHA256 3770755502d403a36f9705f128c1d2e231425c2c6eb21b059ee97a8aff046685
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 10KB
              • SHA256 7c74e6004a12ca8e877bf91237c5c7225860810b531628b40690e603c50dfb2c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 15KB
              • SHA256 5176cb1cb1b2821a7dfde0631d144268cd639faf0095d135253b0791a62b98cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\Local State
              • Size 16KB
              • SHA256 151973c0b54840c7bf4e76d8588e6ff2fdd901e2681b30e354d8cb6677eacd92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index
              • Size 48B
              • SHA256 45bf79b1e686af0ccaebd8ecb12b5b1231cdb1707798380905abb4fdc69e6063
              • MD5 SHA1 SHA512
              Submit Download

              0f00f599331407c475b724e344180f211a4f9e70a78226d976d9cf0fb94dc023
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\0f00f599331407c475b724e344180f211a4f9e70a78226d976d9cf0fb94dc023
              • Size 278KB
              • SHA256 0f00f599331407c475b724e344180f211a4f9e70a78226d976d9cf0fb94dc023
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
              • Size 7.6MB
              • SHA256 23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
              • Size 11KB
              • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
              • Size 3KB
              • SHA256 2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
              • Size 16.9MB
              • SHA256 33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              34246064b280b968e1634fddfe8da60e5b69558eb66bc80df7e46955ee9de882
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\34246064b280b968e1634fddfe8da60e5b69558eb66bc80df7e46955ee9de882
              • Size 1.4MB
              • SHA256 34246064b280b968e1634fddfe8da60e5b69558eb66bc80df7e46955ee9de882
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              35bcd42cec530dcb09017cee95973bdcfb7cd91ee6dd9fdb2aa3d27f7024718b
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\35bcd42cec530dcb09017cee95973bdcfb7cd91ee6dd9fdb2aa3d27f7024718b
              • Size 3KB
              • SHA256 35bcd42cec530dcb09017cee95973bdcfb7cd91ee6dd9fdb2aa3d27f7024718b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
              • Size 5KB
              • SHA256 3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              4ea4a28ef822337c9c8ba94f5183202f105b4ce93eb59a8c70c18d7e861c2b53
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\4ea4a28ef822337c9c8ba94f5183202f105b4ce93eb59a8c70c18d7e861c2b53
              • Size 88KB
              • SHA256 4ea4a28ef822337c9c8ba94f5183202f105b4ce93eb59a8c70c18d7e861c2b53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
              • Size 857KB
              • SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              55dcf0d9-11cc-4ece-a483-5331e5a4e6cf.tmp
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\55dcf0d9-11cc-4ece-a483-5331e5a4e6cf.tmp
              • Size 908B
              • SHA256 5a1bd5c474b73d19f54ddbd0d85098dae7017532b98d8d56f5643b7f7f5d1a2f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              57d139ba6ba3160287788817c3bf3228d44720b80144f66d583d4de0730a5d27
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\57d139ba6ba3160287788817c3bf3228d44720b80144f66d583d4de0730a5d27
              • Size 416KB
              • SHA256 57d139ba6ba3160287788817c3bf3228d44720b80144f66d583d4de0730a5d27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              6f59d9483e2785f7696f2483c40bfffbfc0feea72fbf608e71e7063187315f2a
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\6f59d9483e2785f7696f2483c40bfffbfc0feea72fbf608e71e7063187315f2a
              • Size 1.5MB
              • SHA256 6f59d9483e2785f7696f2483c40bfffbfc0feea72fbf608e71e7063187315f2a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
              • Size 12KB
              • SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
              • Size 3KB
              • SHA256 925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
              • Size 184KB
              • SHA256 9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              a3dd39d863537ae8c8871f4e92e5a93fa0b4a07d121048ed8ab7291baac4d698
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\a3dd39d863537ae8c8871f4e92e5a93fa0b4a07d121048ed8ab7291baac4d698
              • Size 265KB
              • SHA256 a3dd39d863537ae8c8871f4e92e5a93fa0b4a07d121048ed8ab7291baac4d698
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
              • Size 1.1MB
              • SHA256 c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e3d6f43ac10a79e2306ad0bced12893ae5d904b416c55379fdccb194be1ec06d
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\e3d6f43ac10a79e2306ad0bced12893ae5d904b416c55379fdccb194be1ec06d
              • Size 5KB
              • SHA256 e3d6f43ac10a79e2306ad0bced12893ae5d904b416c55379fdccb194be1ec06d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e9f035418f41a22ef415867004d5214c9c5fdb398be02ac753d1313a7fcfdc8b
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\e9f035418f41a22ef415867004d5214c9c5fdb398be02ac753d1313a7fcfdc8b
              • Size 12KB
              • SHA256 e9f035418f41a22ef415867004d5214c9c5fdb398be02ac753d1313a7fcfdc8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ed21bdf5a66371ea19f04f0193e695eec26b2ef963b78703a3a3d151ecb1ce40
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\ed21bdf5a66371ea19f04f0193e695eec26b2ef963b78703a3a3d151ecb1ce40
              • Size 48KB
              • SHA256 ed21bdf5a66371ea19f04f0193e695eec26b2ef963b78703a3a3d151ecb1ce40
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f143e4477756998c99a238fbcc87a68775f2249227efd7f8a6897f72fa2b4274
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\f143e4477756998c99a238fbcc87a68775f2249227efd7f8a6897f72fa2b4274
              • Size 20KB
              • SHA256 f143e4477756998c99a238fbcc87a68775f2249227efd7f8a6897f72fa2b4274
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f85b0ef4f524415600780c7183e25b005f6e36b861f336eb9d5742daa7051290
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\f85b0ef4f524415600780c7183e25b005f6e36b861f336eb9d5742daa7051290
              • Size 477KB
              • SHA256 f85b0ef4f524415600780c7183e25b005f6e36b861f336eb9d5742daa7051290
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f9f6694ade92d23f4585b90326e0a24f6d2007eed5b0bb8618747d72cf4d8784
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\f9f6694ade92d23f4585b90326e0a24f6d2007eed5b0bb8618747d72cf4d8784
              • Size 481KB
              • SHA256 f9f6694ade92d23f4585b90326e0a24f6d2007eed5b0bb8618747d72cf4d8784
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              metadata.json
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\metadata.json
              • Size 2KB
              • SHA256 724c430489340e58c09693dc0f0b50948b436dfd8728d200f7396c28d203c35a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata.json
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\metadata.json
              • Size 2KB
              • SHA256 429b6a8fc3fc23962eb41b89b65f83bc129029eb9852ced34e83160241667b40
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata.json
              • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Origin\User Data\component_crx_cache\metadata.json
              • Size 1KB
              • SHA256 6d5f5d8909b774ad4f26cb2f81784a6532971b691c106e13b7d4384a6e12b639
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              hyph-bn.hyb
              • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1572_39786178\hyph-bn.hyb
              • Size 703B
              • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              hyph-mr.hyb
              • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1572_39786178\hyph-mr.hyb
              • Size 687B
              • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              hyph-nn.hyb
              • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping1572_39786178\hyph-nn.hyb
              • Size 141KB
              • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveCrashHandler.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveCrashHandler.exe
              • Size 270KB
              • SHA256 57394f3dc5778c4d88aa99c5bef9464f21d42114a15a482ef0e28636eea4a504
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveCrashHandler64.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveCrashHandler64.exe
              • Size 355KB
              • SHA256 283e9ab3a5b4184b59b4464190c526e0037ef1c56b739ad16552faffb74bee12
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveCrashHandlerArm64.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveCrashHandlerArm64.exe
              • Size 353KB
              • SHA256 aa274402979b65146f38d6aef4b475ffe5238d210b1d0ad555082a9203d887f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveUpdate.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveUpdate.exe
              • Size 163KB
              • SHA256 f9a5b5f6a660cb9f04c0735f5c3bf1e74776293d25132bc137d6a34b4aa63b7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveUpdateComRegisterShell64.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveUpdateComRegisterShell64.exe
              • Size 170KB
              • SHA256 6c2e8fd3a7b6c3e27d2ceb347080ada84d1c231ecd6b25a9f7c97b9a31d9c79f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveUpdateComRegisterShellArm64.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveUpdateComRegisterShellArm64.exe
              • Size 154KB
              • SHA256 157b35b2d4d1da77e9df478f661ad45c27e3bac0ee212f70618e0a45f0d43e0a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BraveUpdateCore.exe
              • Path C:\Windows\SystemTemp\GUM3782.tmp\BraveUpdateCore.exe
              • Size 195KB
              • SHA256 73edc8a3c4312d739d289485692d5e4e30939bbfb1a5f337b89168e3d987e092
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdate.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdate.dll
              • Size 1.0MB
              • SHA256 7aae4e381308d8a90b522ddd2878c4a4a54c6750d9c60deb87092ca94e33f641
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_am.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_am.dll
              • Size 42KB
              • SHA256 af7487311e0fc5014b6f2b0b7746800acc206ab17503bd9e92444100c81e9122
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ar.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ar.dll
              • Size 41KB
              • SHA256 00edb65175c77822504e6e44ed7e7e437cc9b51c142665d27eb5d6fab93bfa31
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_bg.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_bg.dll
              • Size 44KB
              • SHA256 a9fb8efdae4497e104306978e7c2043c98d5ec763ffdee1cd672f38e49078c0d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_bn.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_bn.dll
              • Size 44KB
              • SHA256 72f18efb0d382f9b9d0cf4b9c916045850030676a53a6a7e7a8c5b16dd78a447
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ca.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ca.dll
              • Size 44KB
              • SHA256 bc45ba571ca46ed6f63832f920abad26e4d8022a38ae7fba7f3b4a93a077917c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_cs.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_cs.dll
              • Size 43KB
              • SHA256 d49335992a3f80484c987341e1abfac4f7b9768a7e7fb9e5d5e582eb64d02cea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_da.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_da.dll
              • Size 43KB
              • SHA256 6fc1429dda2e08ca764a8e7686244a3e516f1f0da3522f6a77aeddfb1abe2e25
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_de.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_de.dll
              • Size 45KB
              • SHA256 b82d3cb8793455b9695697501b000369d40250b9655635b90bf082d79a4e5c6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_el.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_el.dll
              • Size 44KB
              • SHA256 0838a8a61294ea4b2a61ccae199b230bf6089512b6010078080edfa4adf4d86e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_en-GB.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_en-GB.dll
              • Size 42KB
              • SHA256 c0701e6f7171ec87d0a63e7bafae9243024858a7f3978eb902e74405373e428c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_en.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_en.dll
              • Size 42KB
              • SHA256 8736ff073854f5ab98936d2646700b267ed2c5e9b814559b0f69000c8c7e126e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_es-419.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_es-419.dll
              • Size 43KB
              • SHA256 f9292eb23e1f17824e50cdb49315080f718fb49283e25962afdd19668b4cde02
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_es.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_es.dll
              • Size 45KB
              • SHA256 e4191d912824044ada3b151a4c30ff7dde62193294558c2413390a5f8026a143
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_et.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_et.dll
              • Size 42KB
              • SHA256 0dbfaff412078939e6a84e9f880d2a9d2f12adb3358022beac6f3995f4053304
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_fa.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_fa.dll
              • Size 42KB
              • SHA256 6936037ade85d04d2ed58387ecc74ecea152978b1cf2d41d4fc7bbf6d5394710
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_fi.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_fi.dll
              • Size 43KB
              • SHA256 451e8fd48fe09844e33d9f2b0ea30395056a9bae6e14c0a164e9fdbb819d5a2d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_fil.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_fil.dll
              • Size 44KB
              • SHA256 3ee16839cac68eda188cda149fef0b558dffe284414cab96c6a5f42ec235163f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_fr.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_fr.dll
              • Size 44KB
              • SHA256 de5db85dda0195210e0c9a4d8a70799faed02272d4593b921caff873536abd66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_gu.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_gu.dll
              • Size 44KB
              • SHA256 e64de5f0243e9f7a82df2bcb9c578d7217e96d3eb5f610255ce06b4a56c5cf29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_hi.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_hi.dll
              • Size 43KB
              • SHA256 34bb215d1b9b7e69478b22581c6b34a4f85d03804dcffab3f10a4e60e636ebdb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_hr.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_hr.dll
              • Size 43KB
              • SHA256 9ab1ed827886c1f3bc7713aa0bb7ca5416025b56cbf7a07d1de1f9dd9feb7f24
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_hu.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_hu.dll
              • Size 43KB
              • SHA256 8b77a76b7fd2bb0a7555da2367683d516476219b451ad19336ad5f9ba8938fd6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_id.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_id.dll
              • Size 42KB
              • SHA256 e61c3e11e933fa1692dbb49853718a120e722c39100d12a56c3ec9c7b5e43a3a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_is.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_is.dll
              • Size 42KB
              • SHA256 770a41c727fb2c6764b2968d2d1fa1418e0633d1e846f3e84010334d84112b83
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_it.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_it.dll
              • Size 44KB
              • SHA256 0341bb6fb70a5347bcb927eea2d3ea9d20c415940bd03f53960bb3dff027d26c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_iw.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_iw.dll
              • Size 40KB
              • SHA256 ab428fd705d1634080ac87f49c196ebaf04caf203351cdb321250b8b4b12b307
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ja.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ja.dll
              • Size 39KB
              • SHA256 c12d8a3f0003b2ea4c9bc66bae5f64d494c77dfacb92b6f73a5a7ba4f36e167f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_kn.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_kn.dll
              • Size 44KB
              • SHA256 768630ac6cf2fc6ac173a3a71034de5ce7f74a8a357449a4f88cf443917e9663
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ko.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ko.dll
              • Size 39KB
              • SHA256 e55d73014d680f31a231ae1baed2399e8234214ccba54ce601d68afc305a5c1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_lt.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_lt.dll
              • Size 42KB
              • SHA256 74227e04db325e88e7b0ae4ed13653cc3b1c4ac75b7f16335d9501a46db6642f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_lv.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_lv.dll
              • Size 43KB
              • SHA256 ab7feb1a24a192e91947e2554f76970c2d7840ddfc2086e9904307f26100cb51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ml.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ml.dll
              • Size 46KB
              • SHA256 41dcdfdf17b6bfbbe4f9ac7d41e909e4b98b71432d169f4ed94e1a8e0389906c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_mr.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_mr.dll
              • Size 44KB
              • SHA256 b68912b050473889cae75e41450b69f8a9ce6f048943ada18228107211f11c6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ms.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ms.dll
              • Size 42KB
              • SHA256 db39c9144170ecd4f60254fa4ee21a833f0a0a8cca300dabe14a08e2cf72b1a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_nl.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_nl.dll
              • Size 44KB
              • SHA256 be739b81e1037cdc15cc4af374d6680659433101e08af00960f5a0d5f3b8f686
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_no.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_no.dll
              • Size 43KB
              • SHA256 0e95adfd0d16c4fad872abf165f5fb8d97de8a09e38e831170d563191e86338a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_pl.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_pl.dll
              • Size 43KB
              • SHA256 0de77a268a5822c6fb8c8a293ec594cad0189641bc905fe9f93984fe28a7bb05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_pt-BR.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_pt-BR.dll
              • Size 43KB
              • SHA256 40851228c75262c07a6249518c63c45dedeadbe7ac8f6d8c15fc8c10887ca556
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_pt-PT.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_pt-PT.dll
              • Size 43KB
              • SHA256 e8c6eb7d332775cf79d792fc3cae8d1987ae4a36c52f14ae2641f5aa68b1829a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ro.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ro.dll
              • Size 43KB
              • SHA256 ec6f279ff5cd9443aa07e6f1df9e1eceb38081a6993a840ab827330346e0f0cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ru.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ru.dll
              • Size 42KB
              • SHA256 053e57773059e11c31591ab56e62abed689b488cb3db31458116e3ecee5daa63
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_sk.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_sk.dll
              • Size 43KB
              • SHA256 a487cc53c3e93c735839f38dc97a96de6a431a30ae60abfee1b611fac916967c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_sl.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_sl.dll
              • Size 43KB
              • SHA256 cce9ab3f85e402de58546b0d915488faf084c02ff2e33c8cd54e611c88738062
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_sr.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_sr.dll
              • Size 43KB
              • SHA256 bca05dcd65ae6c383f3e178620001dca4d7b6870693454bbcc35bf9d98e5dcf6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_sv.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_sv.dll
              • Size 43KB
              • SHA256 04ac2d922afd9298f9c6411fbadd3d8f3ab40058f73b4f5422549fc98b991e64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_sw.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_sw.dll
              • Size 44KB
              • SHA256 732b24e2a657c8efa73abe70d5d08914560d62a398c1d47681729834916cf40e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ta.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ta.dll
              • Size 45KB
              • SHA256 951fc679d819188272996f84120ead1db4b7258d7465de52dda74a16b2bc4c6f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_te.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_te.dll
              • Size 44KB
              • SHA256 671af89d7b0519740df4cc6ab09e55432a2be2ea51d869e4e6ceb3ae30d805e8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_th.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_th.dll
              • Size 42KB
              • SHA256 3b840851531e64dfbbad086c5943b3c2c707cba1347ee24c0f71d18711edb94f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_tr.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_tr.dll
              • Size 43KB
              • SHA256 32453023dd1e19aed7a8395347d5b503139b40945670877989cb86acf6e7f1f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_uk.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_uk.dll
              • Size 43KB
              • SHA256 6a3446bd01b638f51814a52d58f2a42d23d6e0329d0edc5cb346a0ede38b9915
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_ur.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_ur.dll
              • Size 42KB
              • SHA256 b3c1a253282a17bf2480cb9083afbd3beb75f7938f029777bc3ef598d0b8cece
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_vi.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_vi.dll
              • Size 42KB
              • SHA256 94db7c9fed28e74cb14252d1f91d9299850c783ba8570a31453ea126acad48be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              goopdateres_zh-CN.dll
              • Path C:\Windows\SystemTemp\GUM3782.tmp\goopdateres_zh-CN.dll
              • Size 37KB
              • SHA256 8bb7e9bd6090eee3a8057d2c2818580d855baa51f06516962188420e421291af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1992-1505-0x00000133C5920000-0x00000133C59D2000-memory.dmp
              Download

              memory/1992-967-0x00000133C5920000-0x00000133C59D2000-memory.dmp
              Download

              memory/1992-547-0x00007FFEBE1F0000-0x00007FFEBE1F1000-memory.dmp
              Download

              memory/3264-1493-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1501-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1500-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1502-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1499-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1497-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1498-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3264-1491-0x0000023FBF430000-0x0000023FBF431000-memory.dmp
              Download

              memory/3624-1553-0x00007FF7C1660000-0x00007FF7C1C69000-memory.dmp
              Download

              memory/4600-1555-0x00007FF7C1660000-0x00007FF7C1C69000-memory.dmp
              Download