Overview

overview

10

Static

static

3

2026-08-24...yn.exe

windows10-2004-x64

10

2026-08-24...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe
  • Size 1.4MB
  • Sample260825-ple28ssblc
  • SHA256 83738e36df501b87bd3f3cdbe735a9fea33ece9686132c25d82a0f711d146ce9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 60 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3824
    • \??\c:\users\admin\appdata\local\temp\2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Windows\SystemTemp\GUM34D3.tmp\BraveUpdate.exe
        C:\Windows\SystemTemp\GUM34D3.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4976
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2688
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1796
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1340
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:2140
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1744
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntCNjk0RjU0RC0zOEQyLTQwQTEtOEYxQS03QjZDNEE1NkQ3NTJ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NUQ0OTEwMTQtMjUxRS00QzAyLTg3MUQtODgzNjM5RTFFRTE5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTUzNyIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1484
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{B694F54D-38D2-40A1-8F1A-7B6C4A56D752}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2860
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3600
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4376
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5620
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1868
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4076
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:5352
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:3532
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5816
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\guiE78A.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4284
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\guiE78A.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5888
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.138 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff6ee1a5368,0x7ff6ee1a5378,0x7ff6ee1a5388
          4⤵
          • Executes dropped EXE
          PID:1092
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\guiE78A.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:2872
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{B63DE8F7-AE18-4126-8B37-E3AB988D9BDD}\CR_EFAB3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.138 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff6ee1a5368,0x7ff6ee1a5378,0x7ff6ee1a5388
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4064
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntCNjk0RjU0RC0zOEQyLTQwQTEtOEYxQS03QjZDNEE1NkQ3NTJ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NzU4NjYxOEEtMTNENS00NERDLUIzOTQtRDA1REJCRjk2RjdDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjEuOTMuMTM4IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNTEuMS45My4xMzgveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNTYyNzI3MjAiIHRvdGFsPSIxNTYyNzI3MjAiIGRvd25sb2FkX3RpbWVfbXM9IjM0NTY5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0NjUiIGRvd25sb2FkX3RpbWVfbXM9IjM2MDM4IiBkb3dubG9hZGVkPSIxNTYyNzI3MjAiIHRvdGFsPSIxNTYyNzI3MjAiIGluc3RhbGxfdGltZV9tcz0iNDQyMjciLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3372
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:5648
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2816
    • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\elevation_service.exe
      "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4736
    • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5284
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.138 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc6874fa00,0x7ffc6874fa10,0x7ffc6874fa20
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1196
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1952,i,331881724945868276,5757371714513177401,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2116 /prefetch:11
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:3456
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1668,i,132119467296242073,16083051782777758966,262144 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1972 /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3384
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2500,i,2769606785022088065,17904507137859191342,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2656 /prefetch:13
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1252
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3412,i,12206885797812428065,14317558504000309172,2097152 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3420 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4492
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3548,i,6502723858433379312,16088494649330798861,2097152 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3580 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3272
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,4048768669239146010,17934544115895809260,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5556 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1872
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,16480674940547715883,7984083930217359069,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5664 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3396
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,7868348242555483115,4636268507571466112,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5588 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2228
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,8705200024046158992,384364052742864121,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5944 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:608
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,12737994544095099877,914229414614447925,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5992 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2584
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,14335957852456281769,290197066880131853,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6032 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2112
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:6016
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.138 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff6f7135368,0x7ff6f7135378,0x7ff6f7135388
              5⤵
              • Executes dropped EXE
              PID:3312
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:520
              • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe
                "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.138 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x220,0x2b8,0x7ff6f7135368,0x7ff6f7135378,0x7ff6f7135388
                6⤵
                • Executes dropped EXE
                PID:4432
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,5812241866770580635,15368443383025203523,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6036 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2368
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,16756163987113147545,12110395116682893277,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5648 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5988
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,8723079770850482755,10629933491126321174,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6360 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3808
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,911072601029408326,7146544635462248952,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5556 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2396
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,5177817185243431651,12848648616608868076,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=3992 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1340
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,139872062249886248,14665515792013603429,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5540 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5616
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,2043921622387038492,14170709248328501561,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5760 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5892
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,5847857794573248390,12730956062127964160,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5568 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:252
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,1724113713424748929,13503654098903821914,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5556 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4132
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,17274459030665458886,1689729311349760268,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6160 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:2592
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,15408325032554167399,206695987146795021,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5660 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4104
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,17424242714909576468,1148929178612674190,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5568 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:2148
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,17542810509798170065,12734665393035035994,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6012 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5980
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,4496913090490771385,11702590152388676198,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5724 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:3468
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,11373648683463603620,8970600784329909088,524288 --field-trial-handle=1976,i,6799295947394586852,10283670970653543634,262144 --variations-seed-version=main@d657b418d4931e3b85fcdf73a2cc116666b02d9e --pseudonymization-salt-handle=1980,i,12832154535395187664,10840714171320759572,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6088 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:2768
    • C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\elevation_service.exe
      "C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.138\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3024
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:4636
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:5652

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Modify Registry

            3
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            messages.json
            • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source5888_1637157995\Chrome-bin\151.1.93.138\resources\brave_extension\_locales\sr\messages.json
            • Size 9KB
            • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            6fc6d198-9ca2-417d-81a0-78d38f1e664f.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\6fc6d198-9ca2-417d-81a0-78d38f1e664f.tmp
            • Size 10KB
            • SHA256 1ebe68a27a26d16742f7fa67b02408d7541832c87bae7a3e2f875cddf2b3c59d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            073195a7-4bd2-4ec3-9b6a-9eca4c9add6e.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\073195a7-4bd2-4ec3-9b6a-9eca4c9add6e.tmp
            • Size 165KB
            • SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            878c7b5b-207f-4403-a7c3-82819c370ac4.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\878c7b5b-207f-4403-a7c3-82819c370ac4.tmp
            • Size 3KB
            • SHA256 73363b58816ba81b172e957b8c86e96b7c4a055a841f2dd56372247f6e144c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_0
            • Size 44KB
            • SHA256 0c2fb7953bbf591ee7bd5b7ca3dad4d692930ee5b93d6d9bf883894e275f17ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            000001.dbtmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extension Rules\000001.dbtmp
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extension Rules\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
            • Size 19KB
            • SHA256 c1016d2b575714333629cb1f2002335fb40629bb4b4d3d803c05b5358e282148
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
            • Size 19KB
            • SHA256 7f269b9f76bf6b59b28abe652a2f2ab7d6844312599513fd5fe0095d45cd09b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
            • Size 55KB
            • SHA256 df669698a20912d55d3aec68def845252cd0f046bed1a1b9ebdfbb4dff899315
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
            • Size 53KB
            • SHA256 4735ce2ecd5eab09762eae3ff149cef33fb32cb3a131ba20339d7e21bb2dd354
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            002f96e6-4b99-4522-a968-fad002add20d.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\002f96e6-4b99-4522-a968-fad002add20d.tmp
            • Size 2KB
            • SHA256 d64b7b0a7bf26ff7a6dea0c73bead778b1bd8ce488d81d5ad8097d9fac0fae11
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            14b43b70bf4ce777aebf9bcc92b29b2b8feb0f33235839cc73f70c90bb36c7ec
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\14b43b70bf4ce777aebf9bcc92b29b2b8feb0f33235839cc73f70c90bb36c7ec
            • Size 478KB
            • SHA256 14b43b70bf4ce777aebf9bcc92b29b2b8feb0f33235839cc73f70c90bb36c7ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            1927b3696842fd1dee161b31374fa22bac370312bdabc83b53e502ea4902808c
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\1927b3696842fd1dee161b31374fa22bac370312bdabc83b53e502ea4902808c
            • Size 12KB
            • SHA256 1927b3696842fd1dee161b31374fa22bac370312bdabc83b53e502ea4902808c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
            • Size 11KB
            • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            282752e4bde1120bcd4a03125daad940022069bc72cec411f73ab25abf41702b
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\282752e4bde1120bcd4a03125daad940022069bc72cec411f73ab25abf41702b
            • Size 1.5MB
            • SHA256 282752e4bde1120bcd4a03125daad940022069bc72cec411f73ab25abf41702b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
            • Size 3KB
            • SHA256 2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
            • Size 16.9MB
            • SHA256 33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            47970490d46b56e884c4a20fcbe3418f647dfc58f543edf378c5331502998c07
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\47970490d46b56e884c4a20fcbe3418f647dfc58f543edf378c5331502998c07
            • Size 5KB
            • SHA256 47970490d46b56e884c4a20fcbe3418f647dfc58f543edf378c5331502998c07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            4a63df55bace51a9af029b0654f530dfc9ffa3b3773e22d566a75b3e284c9fac
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\4a63df55bace51a9af029b0654f530dfc9ffa3b3773e22d566a75b3e284c9fac
            • Size 2.4MB
            • SHA256 4a63df55bace51a9af029b0654f530dfc9ffa3b3773e22d566a75b3e284c9fac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            6fa394cc-1b4c-43f6-82e8-ecd1af9e706c.tmp
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\6fa394cc-1b4c-43f6-82e8-ecd1af9e706c.tmp
            • Size 1KB
            • SHA256 fc2b2838f82791f8da7bfe22e3a4f6dd8faece920782ec473db9346e4e979336
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7ab6c956c843242e9c6adaca06b1edb06f22bdb07a4f8ac52583fbe5f31d84b0
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7ab6c956c843242e9c6adaca06b1edb06f22bdb07a4f8ac52583fbe5f31d84b0
            • Size 3KB
            • SHA256 7ab6c956c843242e9c6adaca06b1edb06f22bdb07a4f8ac52583fbe5f31d84b0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
            • Size 7KB
            • SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
            • Size 3KB
            • SHA256 925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            a0ab37c7182aa9b3c9ce720209bccb2e9769f906cee7bbde5d28c59010cde39b
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\a0ab37c7182aa9b3c9ce720209bccb2e9769f906cee7bbde5d28c59010cde39b
            • Size 88KB
            • SHA256 a0ab37c7182aa9b3c9ce720209bccb2e9769f906cee7bbde5d28c59010cde39b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            a3dd39d863537ae8c8871f4e92e5a93fa0b4a07d121048ed8ab7291baac4d698
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\a3dd39d863537ae8c8871f4e92e5a93fa0b4a07d121048ed8ab7291baac4d698
            • Size 265KB
            • SHA256 a3dd39d863537ae8c8871f4e92e5a93fa0b4a07d121048ed8ab7291baac4d698
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
            • Size 14KB
            • SHA256 acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            c3e0981747a623f016fb41b1f3827f62701913e45141639f5415bc4f63a59cf6
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c3e0981747a623f016fb41b1f3827f62701913e45141639f5415bc4f63a59cf6
            • Size 1.4MB
            • SHA256 c3e0981747a623f016fb41b1f3827f62701913e45141639f5415bc4f63a59cf6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
            • Size 3KB
            • SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ce1a40913ab4cb0bc6014e86be4a5b360095a468c086e4c1628f1c0a03eb4b31
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ce1a40913ab4cb0bc6014e86be4a5b360095a468c086e4c1628f1c0a03eb4b31
            • Size 2.8MB
            • SHA256 ce1a40913ab4cb0bc6014e86be4a5b360095a468c086e4c1628f1c0a03eb4b31
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ea7abc319274ce433440306c747b2acd07172b6104803422f95b09581c4499ec
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ea7abc319274ce433440306c747b2acd07172b6104803422f95b09581c4499ec
            • Size 483KB
            • SHA256 ea7abc319274ce433440306c747b2acd07172b6104803422f95b09581c4499ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ed21bdf5a66371ea19f04f0193e695eec26b2ef963b78703a3a3d151ecb1ce40
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ed21bdf5a66371ea19f04f0193e695eec26b2ef963b78703a3a3d151ecb1ce40
            • Size 48KB
            • SHA256 ed21bdf5a66371ea19f04f0193e695eec26b2ef963b78703a3a3d151ecb1ce40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f143e4477756998c99a238fbcc87a68775f2249227efd7f8a6897f72fa2b4274
            • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\f143e4477756998c99a238fbcc87a68775f2249227efd7f8a6897f72fa2b4274
            • Size 20KB
            • SHA256 f143e4477756998c99a238fbcc87a68775f2249227efd7f8a6897f72fa2b4274
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-24_5df460b6bd37fdbc713c543d94a450c4_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
            • Size 1.2MB
            • SHA256 68296736f0e8667fe45bde54ffdd887e34b2e49913ded8b0840dff015607e56c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            explorer.exe
            • Path C:\Windows\Resources\Themes\explorer.exe
            • Size 135KB
            • SHA256 9163b028dcb3b3807408cece3f37b99449dc8425da0b87c50482465a054b6e0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            07b7dd41-6e94-47a5-a958-206287b150bc.png
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\58d19c86-4dc8-496a-b929-4efd6d8b1757\07b7dd41-6e94-47a5-a958-206287b150bc.png
            • Size 24KB
            • SHA256 a0619fb189008b59edbb7d7cdeb5261c9e0c1b84666ad2ad97a1df1bc1b9d780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
            • Size 341KB
            • SHA256 2a54364257349b6c145fa4dd7ec41d3e0b8ab3144205b6f0cd58578aa370e671
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ask-brave-icon-DdJTJrmV.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\ask-brave-icon-DdJTJrmV.webp
            • Size 2KB
            • SHA256 3788d823c7714a2e36547bd5fe86c834b86cb6c182858e047789aee196f1f598
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            de-de-wann-startet-die-bundesliga-dieses-jahr.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wann-startet-die-bundesliga-dieses-jahr.webp
            • Size 48KB
            • SHA256 cda94e244df2fac6d5d65e3a5ecbaf6eb60be39a77db3179b6cd39dd271566c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            de-de-warum-haben-schnecken-ein-spiralformiges-haus.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-warum-haben-schnecken-ein-spiralformiges-haus.webp
            • Size 84KB
            • SHA256 a5dc0627f12d46d649a5a8645de289817219d33decb63ccd90c62606816dbad8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp
            • Size 89KB
            • SHA256 c929631f010d399d51ca89bc740083c0a137935911aedf02e0a4008524b70859
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-ca-whats-the-tallest-free-standing-structure-in-canada.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-whats-the-tallest-free-standing-structure-in-canada.webp
            • Size 72KB
            • SHA256 6a7de6c8edbb772af058258f6e3adce84fe92d61567195b8de0cb4f50e95b01a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-ca-when-does-the-toronto-international-film-festival-start-this-year.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-when-does-the-toronto-international-film-festival-start-this-year.webp
            • Size 43KB
            • SHA256 4f4a6804c7bc3955f7292d46ba0ed66898aaf7758006e819a92625940f0003ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-ca-why-do-loons-make-that-eerie-call-at-night.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-why-do-loons-make-that-eerie-call-at-night.webp
            • Size 61KB
            • SHA256 a8e25647b61e0d1114b4fb6af9e468075a135f5bdccbdfe11868ac722f846319
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-gb-whats-the-loudest-sound-ever-recorded.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-whats-the-loudest-sound-ever-recorded.webp
            • Size 76KB
            • SHA256 41bad4cfeaabaf76016cf6eb5797e5a085528481d327835107d622f820ff75cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-gb-when-does-the-premier-league-season-start-this-year.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-when-does-the-premier-league-season-start-this-year.webp
            • Size 49KB
            • SHA256 3b08523ba0d43e17880a1b20133facd1cc0cd51c8d614cd46b81b04038eee255
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-gb-why-do-robins-sing-through-the-night-in-cities.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-why-do-robins-sing-through-the-night-in-cities.webp
            • Size 57KB
            • SHA256 a518f23e09d722969d7169865d88583c162bd27b726bae6da10789e8568ad00e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-us-what-does-space-actually-smell-like.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-what-does-space-actually-smell-like.webp
            • Size 71KB
            • SHA256 db8aa465e313251ee5774a64a120f2fd4f37737c7145a9e9962d6875e6fb92be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-us-when-does-the-world-series-start.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-when-does-the-world-series-start.webp
            • Size 64KB
            • SHA256 5d51df389ccc9882926ef2060e7472accc0308a491e85e7772778b0d0743dec2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-us-why-do-flamingos-stand-on-one-leg.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-why-do-flamingos-stand-on-one-leg.webp
            • Size 76KB
            • SHA256 27580a0fe4670481c120515e93b083330dd6ea8b95189021ef8888e9f2832fbe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es-us-cuando-empieza-la-temporada-de-la-nfl-este-ano.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-cuando-empieza-la-temporada-de-la-nfl-este-ano.webp
            • Size 50KB
            • SHA256 86564282d966f425c6c1cb138ec06a0a6b23cc1ef50053dcc5de970781a88e8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es-us-por-que-los-delfines-duermen-con-un-ojo-abierto.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-delfines-duermen-con-un-ojo-abierto.webp
            • Size 65KB
            • SHA256 c1e4336c7bd35f10ecd87ff4c7b93dd05a866536b0b2d6e04387a279db548d25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es-us-por-que-los-pulpos-tienen-tres-corazones.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-pulpos-tienen-tres-corazones.webp
            • Size 68KB
            • SHA256 57a6b0e5b96f37d383a1fedc0434ef44392f516f6cb49e1821323e99a1b4136a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr-ca-a-quelle-distance-un-orignal-peut-il-vraiment-nager.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-a-quelle-distance-un-orignal-peut-il-vraiment-nager.webp
            • Size 61KB
            • SHA256 d21c0d6b137229fec110165f5887229afb9427710f40e705f41f51d2719f66d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr-ca-pourquoi-le-castor-est-il-devenu-le-symbole-du-canada.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-le-castor-est-il-devenu-le-symbole-du-canada.webp
            • Size 78KB
            • SHA256 8c79aad3d4e78c6599119763ec629d5b7ed89271fe8d9b2d98590daa54b6c2f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr-ca-quand-commence-la-saison-de-hockey.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-quand-commence-la-saison-de-hockey.webp
            • Size 49KB
            • SHA256 70d3ed0689d86c3684421b3a1232ad153e58415a0984e08c59eb18b93b92646a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr-fr-pourquoi-les-chats-ronronnent-ils-vraiment.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-les-chats-ronronnent-ils-vraiment.webp
            • Size 58KB
            • SHA256 ffe3046976cf996fd44a01cdb7a91a4b8d1f87e2b80ff26bf94577134c854773
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr-fr-pourquoi-y-a-t-il-autant-de-boulangeries-a-paris.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-y-a-t-il-autant-de-boulangeries-a-paris.webp
            • Size 66KB
            • SHA256 3aa7c11dd44ed5011bbc8e907812771bb0b6712c645d63ae3e1b7d57a5cac134
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fr-fr-quand-a-lieu-la-rentree-scolaire-en-france-cette-annee.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-quand-a-lieu-la-rentree-scolaire-en-france-cette-annee.webp
            • Size 65KB
            • SHA256 223399d3acf101a7ee4fcce09c1d34d5903553674339b7b16cfbaeeea97932d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index-1ilobi2k.js
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-1ilobi2k.js
            • Size 179KB
            • SHA256 7481ea913dbba3b04d178b8e3757cf38c9e03f0a2cf4993d644fa4d6f83089a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index-C8g22OGQ.css
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-C8g22OGQ.css
            • Size 30KB
            • SHA256 19b099627396007cfcf21d64ed208361dce53926523439f3102fb7ee96323ad4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index.html
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index.html
            • Size 4KB
            • SHA256 6b0152b6ab8cdda4593d98177f23e29a0b9079206648d883e91e387d40744e23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\logo.webp
            • Size 6KB
            • SHA256 fbe1831f3abb9be1d5b81785055bac244f70553e51a25556f558c31cb2ac6e37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mouse-pointer-DSDsXotA.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\mouse-pointer-DSDsXotA.webp
            • Size 136B
            • SHA256 c53bc691edd32cbc245bdd461b5fc36ef21afc3d8e4304f0df49119204e0b0ff
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            search-icon-BD6Rfjhr.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-icon-BD6Rfjhr.webp
            • Size 1KB
            • SHA256 02f34d12e8f5f7a2838bde1be407fe1f9815dae8678cd6c77c7c031a6f41d8df
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            search-logo.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-logo.webp
            • Size 5KB
            • SHA256 3a1dec651528a4b789020b9bc240f7c7a1ffef36cc3024095cc6c6c73da7ec85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wallpaper.webp
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\ebec0987-c5ed-4874-8fbf-032c1cc6da91\wallpaper.webp
            • Size 38B
            • SHA256 2f9a4c22931833a8fc296bf89b86d94eec618752a62a1add43b753a77c80852b
            • MD5 SHA1 SHA512
            Submit Download

            photo.json
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\photo.json
            • Size 50B
            • SHA256 c9b5c6de15d08254da3d561470114637abdf1715f2b24b4747152fd774d81bac
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tiles.json
            • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping2084_201598341\tiles.json
            • Size 30B
            • SHA256 c79b6e5f6124ce0dc47ed10b897778a67b06bdc8d3db1b5d37ae119460df8fe0
            • MD5 SHA1 SHA512
            Submit Download

            BraveCrashHandler.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveCrashHandler.exe
            • Size 270KB
            • SHA256 6e85741fea991a7ea51d7d495c3f2b182102e9fccf39e7753b14e27379fb716d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveCrashHandler64.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveCrashHandler64.exe
            • Size 355KB
            • SHA256 253105961cc7bc72888d4d3d7b23c9fc13792bf13e8e432c9b525e3763d8df91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveCrashHandlerArm64.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveCrashHandlerArm64.exe
            • Size 353KB
            • SHA256 ff32c5a83781d8de0845ac19c18c2f2ec6aafdd1a7196ad57fb58fb04cb22cd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdate.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveUpdate.exe
            • Size 163KB
            • SHA256 6fefa7b4213251765e680d31f1571dd663572e3d89135b93c7e0c1fa993d78cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdateComRegisterShell64.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveUpdateComRegisterShell64.exe
            • Size 170KB
            • SHA256 8cf146038b3e54e59e48edd7a904e0fc40d9bf06485aed5216e94b6e2438fb5b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdateComRegisterShellArm64.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveUpdateComRegisterShellArm64.exe
            • Size 154KB
            • SHA256 ffb72f23968f78cf41ed9c8904d9d4ae557e0645c265c9cd6eab019cfa20f05b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BraveUpdateCore.exe
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\BraveUpdateCore.exe
            • Size 195KB
            • SHA256 2c2c66c37620bd7fbc96a1b9b94cb7ee12082f7bce8d9b85ea763c866afbf4f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdate.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdate.dll
            • Size 1.0MB
            • SHA256 7b90d5d5cc66d1cea04f7b1ee9bfe0783c1b2c57b79f501ceb62ec214161e640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_am.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_am.dll
            • Size 42KB
            • SHA256 dc309fcd71f4f6a4dadbca1614399c0c96fb89fd0a756844bb80960376c922cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ar.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ar.dll
            • Size 41KB
            • SHA256 bb6429d879c0b9d1bf5e87cd1ab8e0f6cf170dfec39b03b1e86423b27f54aab6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bg.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_bg.dll
            • Size 44KB
            • SHA256 8b9a2a8a47c77f906274a9f29426a0e22bf829c0ce601a6ddd2d76b140b8fe99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bn.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_bn.dll
            • Size 44KB
            • SHA256 dc8b7352d425c2d84f76ce0476d76f8b122c003386884b8c48115e31567dea99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ca.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ca.dll
            • Size 44KB
            • SHA256 d866e72f43510c0676ae6f6817d6333cc9d8ad61283d3aada0c02119f7ad3d8f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_cs.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_cs.dll
            • Size 43KB
            • SHA256 a230ac67cff71fe0dfb2cc5bb574e4ba84d9a1f2412f974d1be7d72337f3c70f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_da.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_da.dll
            • Size 43KB
            • SHA256 26031911a7600d8ca32cb37b6df03bfe157102a3ef6af037a5b64705e8520849
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_de.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_de.dll
            • Size 45KB
            • SHA256 78800662e96f49a981e7fb181df9889efc09882129ee0cb4763be11c468b78a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_el.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_el.dll
            • Size 44KB
            • SHA256 c412d10c3dea992664cbbd1a0b416a4721226ba8815c68582633776a3619327d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en-GB.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_en-GB.dll
            • Size 42KB
            • SHA256 49ca05468d3bc00adcd5f351da4e6e00d8b8ee8e42109ba0ffae646c94e4130b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_en.dll
            • Size 42KB
            • SHA256 456b5f890eebb017ff230ffba5f455305a4f36783e0921a4a7186ae1771215fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es-419.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_es-419.dll
            • Size 43KB
            • SHA256 a73ef7b56115a714225553248e76498984bfbed209dcd26ed91c80a098a7e8ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_es.dll
            • Size 45KB
            • SHA256 4763aac796395e0c1aee96c6fba60ef884bcefbdb20f4c0a64e411fe65e91db8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_et.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_et.dll
            • Size 42KB
            • SHA256 92a7d0ccd38c065fdf9f0f164159e2d56604e771522b3daada5f370aede1bbc4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fa.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_fa.dll
            • Size 42KB
            • SHA256 51c1be89416838bc7bfec8c02ba4f717457d8b43f1673e55d6f07a76f948c1ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fi.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_fi.dll
            • Size 43KB
            • SHA256 1e051675bf55593d9b4cc2b0d3c87233d361e06e8c6d219af3956d9974389558
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fil.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_fil.dll
            • Size 44KB
            • SHA256 c4b0ac24dd91456e536231b0e344db3a0bd7193b51169b5262148f498b3598e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fr.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_fr.dll
            • Size 44KB
            • SHA256 1babb4e9cbf26110fa334ada66a5a2d7b62b406b4025cbf007fbc5ad92d46833
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_gu.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_gu.dll
            • Size 44KB
            • SHA256 1bcafddfef5cf61f8bca4e56f59f2ff140e72969058aa2e0c461719c5431304e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hi.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_hi.dll
            • Size 43KB
            • SHA256 f36fe09341fc31e58bb3e233184c054417e862d346cba6196cc868f77e682e8f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hr.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_hr.dll
            • Size 43KB
            • SHA256 d3e8b12b74a2ac43e6846ce69756dc779d8a86d2c68803511192468583e75096
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hu.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_hu.dll
            • Size 43KB
            • SHA256 5de781890232cc84642d10b2668a9a5ec0e59f02db69e9bfe86e4fe869d85556
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_id.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_id.dll
            • Size 42KB
            • SHA256 d3f06413ef502b572a1de8ead6cd6e42b34bde08ac043a115819cf92ad591047
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_is.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_is.dll
            • Size 42KB
            • SHA256 2f59b0021ff2bc3642edd7d9dc2a9263bad75e7411fdc3000d1c768bbcc352e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_it.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_it.dll
            • Size 44KB
            • SHA256 17d5018627bd9ee7ad457fc5212c19acaaa788c72bb4ab9b865b6397f5550a17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_iw.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_iw.dll
            • Size 40KB
            • SHA256 70bf026fb377c0bd5631e794adb0ba7083b9fd3e460a1fbe36a009343d0631e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ja.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ja.dll
            • Size 39KB
            • SHA256 84096719154c4e23101304ce59fddbd5bc5226a2b3ccb4e6669292e6a922494b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_kn.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_kn.dll
            • Size 44KB
            • SHA256 eacd559373a3c18da743ce1258f97e7621870a150011bc9479e27a73104a2213
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ko.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ko.dll
            • Size 39KB
            • SHA256 908a12eb82bf345d9a08c179028626cdbbfb3f68e0083e160e9ddc146976aa51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lt.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_lt.dll
            • Size 42KB
            • SHA256 fcc37043b590dc8729a1d837077a90a409fbc6b7435bb38338045d0c4ef64166
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lv.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_lv.dll
            • Size 43KB
            • SHA256 d6a8c35cfd895a7e3b99f362fbed46bec4592f7091cbf7952df80624c8fba891
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ml.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ml.dll
            • Size 46KB
            • SHA256 4c3f55afd4b4310449fdfbea900848c6fd4449bc6db493eb3233b634da10f474
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_mr.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_mr.dll
            • Size 44KB
            • SHA256 4713d09c942ca8ef110ae67b0f4dced1e4ff3536627b04881a4127f3d172c788
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ms.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ms.dll
            • Size 42KB
            • SHA256 27001e89c892f00decb88985a43a43de49fcdb49d23472826abef6409701b062
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_nl.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_nl.dll
            • Size 44KB
            • SHA256 f98d1c8fe43ad8f5a7ad3105f672053744082624c0b5dd92da9402d477fa7907
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_no.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_no.dll
            • Size 43KB
            • SHA256 888adccf00c0f08260a6114d2dce6385c2614afd565385c58728c9679e157706
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pl.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_pl.dll
            • Size 43KB
            • SHA256 f144d0f2463e93d82f31550c13d99814ad665172aa12ac385727332d6cd34d55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-BR.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_pt-BR.dll
            • Size 43KB
            • SHA256 7bc3871b472d145f8990a99ea3c4b24c52be03ec5d802b6e3d384ab1b66937a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-PT.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_pt-PT.dll
            • Size 43KB
            • SHA256 66c380621747d86a204c16dc2ed20242686b40389caac43bed07c895a9753782
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ro.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ro.dll
            • Size 43KB
            • SHA256 97a94fe0e266485a627407d20a0adc96ab84ff48a31bf98190b34800d71bd3e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ru.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ru.dll
            • Size 42KB
            • SHA256 980a172b404b962811e3dc99fcf64fc30d0026afcfb60120a9ccbd234d7b1526
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sk.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_sk.dll
            • Size 43KB
            • SHA256 deab99b66dff7fb0df4c13d1abf9aa668fe8ecb60824ca026cdeaa82ad5f6ad0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sl.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_sl.dll
            • Size 43KB
            • SHA256 6f3ccdd906a2ef178cea13810dd26f1c3b0b937f8233fc98f6b43896ece2be55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sr.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_sr.dll
            • Size 43KB
            • SHA256 411681de9ff08688eca277444b4f3361db897faa7d59995667b8c6f87cd46691
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sv.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_sv.dll
            • Size 43KB
            • SHA256 6b287347b0957a37f67de72014e7d0ae3ccafb1f632dcbc74dc623f9b31fde24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sw.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_sw.dll
            • Size 44KB
            • SHA256 90493aef083c84b04494f759ba904106a93a4a66766f0390998bb62e43ed255c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ta.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ta.dll
            • Size 45KB
            • SHA256 253610308cccba1c246c57f1251d0d54c5d4f303a7fe98ffa8bdd01679aa5e95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_te.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_te.dll
            • Size 44KB
            • SHA256 d8a69319e89fa794c94d49815d772bea840d76c1e7ef1274ca932a24c2f3b946
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_th.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_th.dll
            • Size 42KB
            • SHA256 304876c7e0730a3fcf7f99808a234d775d98bfe12a01295c00178f96078cf2d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_tr.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_tr.dll
            • Size 43KB
            • SHA256 81d39862f6869190928ed23e4cefecf1375f5f3560fc84b99942e082941af722
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_uk.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_uk.dll
            • Size 43KB
            • SHA256 9a5260caa3aa34ecf58a6457b361606cd70ff39799857f14f5a0fba7f88b7a24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ur.dll
            • Path C:\Windows\SystemTemp\GUM34D3.tmp\goopdateres_ur.dll
            • Size 42KB
            • SHA256 70c41f1d900c59b0af91d04a3fa21ba12dfec2ce2be98d257b0ba4cc904e6146
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1868-988-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3384-598-0x00007FFC89D40000-0x00007FFC89D41000-memory.dmp
            Download

            memory/3384-1069-0x000001A459470000-0x000001A459633000-memory.dmp
            Download

            memory/3600-186-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3824-0-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3824-187-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4076-184-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4376-784-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/5620-185-0x0000000000400000-0x000000000041F000-memory.dmp
            Download