Resubmissions
05/09/2026, 01:41
260905-b4ebrs1xft805/09/2026, 01:40
260905-b3nh2sdj2w805/09/2026, 01:21
260905-bqpkks1wds805/09/2026, 01:17
260905-bnpska1wav8Analysis
- user interaction
yes - max time kernel
899s - max time network
896s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/09/2026, 01:41
General
- Target bloxflareV8/auth-spoof.js
- Size 7KB
- Sample260905-b4ebrs1xft
- SHA256 ac8c4f521c4b4e1ac5620c11480511c79b5bb5019089d4c7d5b3d53a0c6723ea
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 44 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\bloxflareV8\auth-spoof.js1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8868c728,0x7ffd8868c734,0x7ffd8868c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,14687672179925840703,13148367874879395726,262144 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,1032355444202125183,5825930198457128541,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,3729548440273448231,1944284856379113683,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,5105000217793536461,10137900089813233116,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,7726637977761071190,2260973479467910255,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,4141145927109244325,7625502366491000455,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,6352311759661050988,5904972813338732613,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5276 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5748,i,10871016845312071729,12074719277288501797,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3384,i,11416114480948763967,5591128662685719250,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,630187670453021295,17232399201709019852,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,774005766098884197,6371206937481868279,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3400,i,15617934763334530353,4507113134639224717,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,16531663715824953858,1138207259523678246,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6068,i,17478294569056761451,5489918475884584845,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6220,i,3450281907190571459,8143969325732161679,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6376,i,5733751933639154531,3468358193824664507,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6460,i,13531291869429368808,2237420949619774161,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6700,i,2255293903933267415,15198654103805773294,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6268,i,16464248157806638282,7360438203330592709,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6700,i,11700694554138315319,8755270096427985291,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,11205051324637941191,7447453390464630743,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6808 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe"C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Temp\GUM93A.tmp\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Temp\GUM93A.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBRjMwN0QwMS0zMjlGLTQzRTYtODExMC1BOEIzMzEwNzZGN0V9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MDEyODM4QTQtMEMxQi00QUM4LTk0NjYtODZCNDczNTU4RkI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTIxOCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{AF307D01-329F-43E6-8110-A8B331076F7E}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6168,i,15948319588021290268,17898006305038405839,262144 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,16802525891536775330,9262071530341661175,524288 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6628 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=864,i,11110643700281101572,8158410404893991947,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6904,i,5813947087498790852,15819261946854591281,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7144,i,9491323729073530062,9253938582709961040,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=868,i,1261831666227160095,6341333760917166739,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6788 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7132,i,9595198626965697596,5518367026252319309,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5848,i,12000712868790693101,26618579289466906,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7300,i,16470648915658110738,2476661536668434334,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6768,i,10326880627785951709,4635968689859385952,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6540,i,2392069398444913131,3010604270577896149,2097152 --field-trial-handle=1932,i,5183979979918046056,7881486627509290023,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\bloxflareV8 (1) (1)\" -ad -an -ai#7zMap6879:100:7zEvent266561⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\gui6E1F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\gui6E1F.tmp" --brave-referral-code="BRV010"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.121 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff606f97688,0x7ff606f97698,0x7ff606f976a84⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\gui6E1F.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{9E20657D-3C61-49FF-B509-C0AFEEB993C1}\CR_4A18B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.121 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff606f97688,0x7ff606f97698,0x7ff606f976a85⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBRjMwN0QwMS0zMjlGLTQzRTYtODExMC1BOEIzMzEwNzZGN0V9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkRGRThGMEUtRjI1My00MkNBLUFDMUMtNjc2MDQ0NUMxNEEzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUyLjEuOTQuMTIxIiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNTIuMS45NC4xMjEveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNjAxNDAzNjgiIHRvdGFsPSIxNjAxNDAzNjgiIGRvd25sb2FkX3RpbWVfbXM9IjE1Nzk3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MDYiIGRvd25sb2FkX3RpbWVfbXM9IjE3MTA5IiBkb3dubG9hZGVkPSIxNjAxNDAzNjgiIHRvdGFsPSIxNjAxNDAzNjgiIGluc3RhbGxfdGltZV9tcz0iMzQ1NjUiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.121 --initial-client-data=0x84,0xf8,0xfc,0xd4,0x100,0x7ffd82559ea0,0x7ffd82559eb0,0x7ffd82559ec04⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1944,i,18021210490185667050,2278738443198013274,262144 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1940 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2272,i,5856601905782890949,16956601829890053951,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2280 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,14430184121442727919,6560426941263996654,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2608 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3568,i,14845903567408574813,16718291957371715390,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3572 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3696,i,6150757476871759019,12779546024980966303,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3708 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,2823370140963422732,1648741285920314272,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5464 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14188212076754266954,14066228073189839268,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5544 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3856,i,6251357136055146826,14780917147579700165,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5720 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,15554517371338441111,15420209941313018879,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5740 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3824,i,16017199398565049504,9585063742659467857,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6028 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,13957465636581417095,6619784130621258792,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6048 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,12191169830831524895,10929565805979247748,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3884 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.121 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff716377688,0x7ff716377698,0x7ff7163776a85⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.121 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff716377688,0x7ff716377698,0x7ff7163776a86⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,16148344472924544025,6619351454312495117,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6456 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,5826687069192544824,6373252212843403441,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6656 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,9310069240295745825,3821380834231594443,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6032 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,6356878842739439022,14421177057977359408,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6920 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6916,i,13072576403848073914,3672648766532662634,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=7120 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6916,i,618143099482278224,2684851313941355943,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7144 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7020,i,9904296437150342388,12198634142142936952,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7136 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7148,i,2025097338624689114,537617911121647791,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7036 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7012,i,11033281733571886345,4774133735320216559,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7128 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7024,i,3473570790745512801,14002913323042163611,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7132 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7020,i,1920913389403734260,9136016167252123276,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6880 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7004,i,14035118134222966977,1195241027086199291,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6404 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,379114848953381537,2544939263071831692,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=3512 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,2234970807862516200,17747740451417191851,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=3780 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,8011552361448881604,6958073723836676406,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6368 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6336,i,9298798854793862941,5545091907049418578,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7000 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5336,i,10872287188000417071,12937077657346343935,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=3640 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,14720938556233393399,6198766629755532244,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=3512 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6760,i,13713878705687241483,2805853618048594422,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=3884 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,2282952888778717519,11285146075693283358,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=6428 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,5520505050394891330,6650099917612326538,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=6752 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3884,i,3783546635691431392,14992135792426534254,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=6780 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,9347157709187177936,6525364692355328405,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=3864 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6744,i,3648400635303877013,11811821582947107967,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=6404 /prefetch:84⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3816,i,801383099188796245,3067139516238290101,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=6356 /prefetch:84⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=3600,i,2560297489469093030,14109156894461410082,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=6364 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6056,i,11845091990994864256,15425779946178355384,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=6800 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3688,i,17620581405056601830,10043238518585633471,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=6776 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6744,i,11178314808509471586,14160655593940476659,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=6644 /prefetch:84⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=6644,i,12175885012076345784,13297386777038427791,262144 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=6768 /prefetch:84⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3812,i,11329004125203119,4355597335663761292,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=1660 /prefetch:84⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,6268368437345320552,15672965174328536592,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=3712 /prefetch:84⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6476,i,12439112334732849035,3277113432163615205,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=5560 /prefetch:24⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5656,i,8607773825481396966,192892019240398961,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=6596 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5684,i,17984122252484988370,15859018825935658834,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=5972 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,17426295672858767459,16767981928367037724,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=4816 /prefetch:84⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6044,i,7227560735074865037,5332870872527562129,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=5868 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=5572,i,16545246639884655845,1942983596584110353,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=5600 /prefetch:24⤵
- Checks computer location settings
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7172,i,17154671592714246790,7272315440048537941,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=6140 /prefetch:84⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,5500098978836146977,8407902229637606919,524288 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=7368 /prefetch:84⤵
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=5612,i,7604568938148330454,3835284689772940277,2097152 --field-trial-handle=1844,i,16151603306086084869,6018629846229973490,262144 --variations-seed-version=main@c5eff80db0bd71a4fbed0555a903ff4d62ca075e --pseudonymization-salt-handle=1960,i,18342622696402723485,1049829663268962440,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=7640 /prefetch:24⤵
- Checks computer location settings
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.121\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\bloxflareV8 (1) (1)\" -ad -an -ai#7zMap18695:100:7zEvent36281⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
BraveCrashHandler.exe
BraveCrashHandler64.exe
BraveCrashHandlerArm64.exe
BraveUpdate.exe
BraveUpdateComRegisterShell64.exe
BraveUpdateComRegisterShellArm64.exe
BraveUpdateCore.exe
goopdate.dll
goopdateres_am.dll
goopdateres_ar.dll
goopdateres_bg.dll
goopdateres_bn.dll
goopdateres_ca.dll
goopdateres_cs.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_el.dll
goopdateres_en-GB.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_et.dll
goopdateres_fa.dll
goopdateres_fi.dll
goopdateres_fil.dll
goopdateres_fr.dll
goopdateres_gu.dll
goopdateres_hi.dll
goopdateres_hr.dll
goopdateres_hu.dll
goopdateres_id.dll
goopdateres_is.dll
goopdateres_it.dll
goopdateres_iw.dll
goopdateres_ja.dll
goopdateres_kn.dll
goopdateres_ko.dll
goopdateres_lt.dll
83df8c7c-0cec-4493-9821-7d9095e3b129.png
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
f56fbdd1-5829-47e5-991e-9e418f72f778.jpg
c02bed80-543f-4039-95d8-ec0a40cf6b05.jpg
218de658-00ce-46bc-8b4c-9c9d5c23a403.jpg
verified_contents.json
campaigns.json
5c1eb5c5-0430-4e65-85be-373297b49241.jpg
Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
ask-brave-icon-DdJTJrmV.webp
de-de-wann-startet-die-bundesliga-dieses-jahr.webp
de-de-warum-haben-schnecken-ein-spiralformiges-haus.webp
de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp
en-ca-whats-the-tallest-free-standing-structure-in-canada.webp
en-ca-when-does-the-toronto-international-film-festival-start-this-year.webp
en-ca-why-do-loons-make-that-eerie-call-at-night.webp
en-gb-whats-the-loudest-sound-ever-recorded.webp
en-gb-when-does-the-premier-league-season-start-this-year.webp
en-gb-why-do-robins-sing-through-the-night-in-cities.webp
en-us-what-does-space-actually-smell-like.webp
en-us-when-does-the-world-series-start.webp
en-us-why-do-flamingos-stand-on-one-leg.webp
es-us-cuando-empieza-la-temporada-de-la-nfl-este-ano.webp
es-us-por-que-los-delfines-duermen-con-un-ojo-abierto.webp
es-us-por-que-los-pulpos-tienen-tres-corazones.webp
fr-ca-a-quelle-distance-un-orignal-peut-il-vraiment-nager.webp
fr-ca-pourquoi-le-castor-est-il-devenu-le-symbole-du-canada.webp
fr-ca-quand-commence-la-saison-de-hockey.webp
fr-fr-pourquoi-les-chats-ronronnent-ils-vraiment.webp
fr-fr-pourquoi-y-a-t-il-autant-de-boulangeries-a-paris.webp
fr-fr-quand-a-lieu-la-rentree-scolaire-en-france-cette-annee.webp
index-1ilobi2k.js
index-C8g22OGQ.css
index.html
logo.webp
mouse-pointer-DSDsXotA.webp
search-icon-BD6Rfjhr.webp
search-logo.webp
wallpaper.webp
manifest.json
photo.json
tiles.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
brave-checks.txt
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
setup.exe
messages.json
363d0f8d-9b39-4a0c-9dc0-02f7dd1ce7da.tmp
814ef236-6191-47c1-99c9-9993a2deec5b.tmp
crl-set
settings.dat
Preload Data
0b727f1f-e652-4681-8f06-f74cebb9e2d9.tmp
f_000139
f_0001f9
f_0001fa
f_0001fb
f_0001fc
f_0001fd
f_0001fe
f_0001ff
f_000200
f_000201
f_000202
f_000203
f_000204
f_000205
f_000206
f_000207
f_000208
f_000209
f_00020a
f_00020b
f_00020c
f_00020d
f_00020e
f_00020f
f_000210
f_000211
f_000212
f_000213
f_000214
f_000215
f_000216
f_000217
f_000218
f_000219
f_00021a
f_00021b
f_00021c
f_00021d
f_00021e
f_00021f
f_000220
f_000221
f_000222
f_000224
f_000225
f_000227
f_000228
f_000229
f_00022a
f_00022b
f_00022c
f_00022d
f_00022e
f_00022f
f_000230
f_000231
f_000232
f_000233
f_000234
f_000235
f_000236
f_000237
f_000238
f_000239
f_00023a
f_00023b
f_00023c
f_00023d
f_00023e
f_00023f
f_000240
f_000241
f_000242
f_000243
f_000244
f_000245
f_000246
f_000247
f_000248
f_000249
f_00024a
f_00024b
f_00024c
f_00024d
f_00024e
f_00024f
f_000250
f_000251
f_000252
f_000253
f_000254
f_000255
f_000256
f_000257
f_000258
f_000259
f_00025a
f_00025b
f_00025c
f_00025d
f_00025e
f_00025f
f_000260
f_000261
f_000262
f_000263
f_000264
f_000265
f_000266
f_000267
f_000268
f_000269
f_00026a
f_00026b
f_00026c
f_00026d
f_00026e
f_00026f
f_000270
f_000271
f_000272
f_000273
f_000274
f_000275
f_000276
f_000278
f_000279
f_00027a
f_00027b
f_00027c
f_00027d
f_00027e
f_00027f
f_000280
f_000281
f_000282
f_000283
f_000284
f_000285
f_000286
f_000287
f_000288
f_000289
f_00028b
f_00028c
f_00028d
f_00028f
f_000290
f_000291
f_000292
f_000295
f_000296
f_000298
f_000299
f_00029a
f_00029c
f_00029d
f_00029e
f_00029f
f_0002a0
f_0002a1
f_0002a3
f_0002a4
f_0002a5
f_0002a6
f_0002a7
f_0002a8
f_0002a9
f_0002aa
f_0002ab
f_0002ad
f_0002b3
f_0002b4
f_0002d3
2b59a83513075cb2_0
407bc79c8351c575_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Google Profile.ico6bcab055-13a6-49c1-a775-7222f28263ff.tmp
000003.log
000004.log
000005.ldb
LOG
LOG
MANIFEST-000001
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
a2d9c20c-512e-47c5-bab3-6adc7282dbe7.tmp
Preferences
Preferences
Preferences
Secure Preferences4079dd2b-7367-4149-a79e-aabf9610845c.tmp
bff02783-8bda-49cf-b7d0-e45322f51279.tmp
the-real-index
CURRENT
MANIFEST-000001
download_file_types.pb
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State1d3c1605-451c-4719-bb5a-c8556e69d8b1.tmp
preloaded_data.pb
cr_en-us_500000_index.bin
p3a_manifest.json
crs.pb
ct_config.pb
kp_pinslist.pb
ssl_error_assistant.pb
safety_tips.pb
VariationsSafeSeedV2
VariationsSeedV2
VariationsSeedV2
ranked_dicts
list.txt
clean-urls-permissions.json
clean-urls.json
debounce.json
https-upgrade-exceptions-list.txt
adrian-limani.jpg
gabriel-dizzi.jpg
photo.json
list.txt
list.txt
query-filter.json
resources.json
23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
29825ffc59dcfb45c8d203b6681e4940b893296c7f1228e5184298e7561b4aa5
2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
2d40f590a583652e86a644074da80be152b6d8aadf4a53e9e7eeab542cdecaf3
33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
34eba3c9cfe9297524128c34f04fed206bdbaeaf48a0024239e8ad20dc9c599d
3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
412f72d6ad6db7c33794dfb8abe9f2037d48bdc2b8fc7c3159e8622bb92df4ba
435f8062af5134c46eae2595c790e39ad83defd954a20573ad396fa68929a1b2
545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
5dbc38ee-27a5-4d48-9212-ce0cff7293f4.tmp
62d96c1cd969fbb3f34dbfafeaa0915a68b35f18e7de3f102a43c9d521c1d99a
7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
8079ee13f17028be6fbc6a8b26a15a7b03c7e645831b5b4dccd9c022a9ee858b
8846cc85512389359593fb746c0498af54259729896b43fc1e2b9f8ec27c1b87
8abbf2005663279a05d196b11973cc9c238732a176ffbb98b0185a8f442a536d
8f4c675945d498a334d03982cba45e6532ac8323e694fb91d6f2688aa118d1d2
925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
9425df057173f767acb2e84d721e0d596d355f594a2385ba2a5c763449c48894
9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
9edc7759248af1decb413fcee3e5f0039e4116e49ea5e329e78a6f3bb14b6db2
acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
d0a36e95c3aa3e632cee5efc3015bf58c4e1b43b1a930b550ee90298917c9fda
d336c91dae6f1b3756ad213bbe283011de92e15ca10a8716ae52d85b463bab92
f03cb3d1169e0cbe9c1041e14ea92fc1b52bc5354b1c87ebfc324b5d737f7f68
metadata.json
metadata.json
metadata.json
list.txt
ee0eab8a-6881-4a33-93c2-6eabb08f5f58.tmp
list_catalog.json
resources.json
list.txt
list.txt
list.txt
resources.json
4f92b40c-9105-459a-8f93-6db27ad75b20.tmp
BrowsingTopicsState
f_000005
f_000020
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Brave.lnk
default.dic
BraveBrowserSetup-BRV010.exe
bloxflareV8 (1) (1).rar
memory/2108-2972-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2981-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2977-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2973-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2978-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2979-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2971-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2980-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2983-0x0000020139110000-0x0000020139111000-memory.dmp
memory/2108-2982-0x0000020139110000-0x0000020139111000-memory.dmp
memory/4520-3829-0x00007FF6069D0000-0x00007FF607034000-memory.dmp
memory/4608-1084-0x00007FFDA31A0000-0x00007FFDA31A1000-memory.dmp
memory/5804-1113-0x00007FFDA3310000-0x00007FFDA3311000-memory.dmp
memory/5804-1112-0x00007FFDA4880000-0x00007FFDA4881000-memory.dmp
memory/5900-3830-0x00007FF6069D0000-0x00007FF607034000-memory.dmp