Overview

overview

10

Static

static

10

2026-10-17...at.exe

windows10-2004-x64

10

2026-10-17...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 19:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
  • Size 2.0MB
  • Sample261018-ybkdmscd48
  • SHA256 3ab7f67a6b2d6c7653e5bc5decd752d7e7c982af65f92d1ea26f0e2907ac57b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryxredpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 59 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 30 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SystemTemp\GUM3700.tmp\BraveUpdate.exe
        C:\Windows\SystemTemp\GUM3700.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:612
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5836
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:5372
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4784
          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3820
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntERTdDQzJBMy04RjA0LTRERTAtOUY2RS0yRjAyRDQwOUU5RjZ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NjQ0QTNFRDYtQ0M5MC00MzQ3LTkyNTItN0M0QkVBODk5NDg3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjMyMyIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2580
        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{DE7CC2A3-8F04-4DE0-9F6E-2F02D409E9F6}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:820
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4956
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2604
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1864
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5468
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5192
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2328
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5504
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\guiA0C7.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3228
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe" --mini-installer-path="C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\brave_installer-x64.exe" --archive-resource-name="CHROME.PACKED.7Z" --archive-resource-type="B7" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\guiA0C7.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5324
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=155.1.97.59 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff6816bd018,0x7ff6816bd028,0x7ff6816bd038
          4⤵
          • Executes dropped EXE
          PID:3412
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\guiA0C7.tmp" --create-shortcuts=0 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4284
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=155.1.97.59 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x264,0x2b8,0x7ff6816bd018,0x7ff6816bd028,0x7ff6816bd038
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:612
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntERTdDQzJBMy04RjA0LTRERTAtOUY2RS0yRjAyRDQwOUU5RjZ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkY1QTU4NTctM0FDOC00MDY4LUE3NjAtRDUzOEU3MDVGNTJDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTU1LjEuOTcuNTkiIGFwPSJyZWxlYXNlIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly91cGRhdGVzLWNkbi5icmF2ZXNvZnR3YXJlLmNvbS9idWlsZC9CcmF2ZS1SZWxlYXNlL3JlbGVhc2Uvd2luLzE1NS4xLjk3LjU5L3g2NC9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTYzMTA0ODQ4IiB0b3RhbD0iMTYzMTA0ODQ4IiBkb3dubG9hZF90aW1lX21zPSIxNDgwNSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzI5IiBkb3dubG9hZF90aW1lX21zPSIxNjY3OCIgZG93bmxvYWRlZD0iMTYzMTA0ODQ4IiB0b3RhbD0iMTYzMTA0ODQ4IiBpbnN0YWxsX3RpbWVfbXM9IjUxMjQzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1596
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1516
  • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
    "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4068
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=155.1.97.59 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffaf7322ed0,0x7ffaf7322ee0,0x7ffaf7322ef0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6124
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1692,i,6247563942395861222,17132396252808866487,262144 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1940 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4968
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2164,i,12734222186572423491,13056940589250959457,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2208 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          PID:3096
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2492,i,15378225223086382274,5848934133857063216,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2572 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4256
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3456,i,6848069962518338876,8440290460482410152,1572864 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3480 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2896
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3500,i,497345798627224992,122164292222765595,1572864 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3612 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4876
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1646187373816978968,12328041144651200106,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5460 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:4544
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,13874822792181227229,9840860376144002628,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5524 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1580
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,4041190011747995765,12002870250756893788,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5588 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3048
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,13987665581398036751,14410606198881229668,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5544 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4540
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,12883076569426464487,17962407193394158464,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5688 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4196
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,11279305045436012758,1838253048630451762,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5932 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:616
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,13693160804092808184,17745334162891959700,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6580 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3504
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,250678165699646707,5376069761503249966,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6736 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4508
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,13380245550378954189,4623501227496036765,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5696 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6132
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=155.1.97.59 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x26c,0x2b8,0x7ff65c78d018,0x7ff65c78d028,0x7ff65c78d038
            5⤵
            • Executes dropped EXE
            PID:3296
          • C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe
            "C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4728
            • C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe
              "C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=155.1.97.59 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x254,0x2b8,0x7ff65c78d018,0x7ff65c78d028,0x7ff65c78d038
              6⤵
              • Executes dropped EXE
              PID:4304
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,7817036315972396387,9627082425421886479,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5656 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2092
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,7422474225096732689,10465512049764179435,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5924 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2580
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,2307211342951530924,15687809742833717721,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6692 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2092
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,9401976606293314066,7478890427278696959,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6612 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5688
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,13441558320941544192,17187586713368014778,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6692 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3964
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,1351383365528385121,3945280699005856068,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6700 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5140
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,3994695160389598058,5081095160269646452,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5872 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6036
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,13062077964327896336,16400129992968018887,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=4908 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4948
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6800,i,7020767039173528301,14730482242589883524,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5772 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:6008
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,10378257116463684634,13840440643375591442,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6872 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3760
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,7692320578920974413,11481786449812541105,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5420 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5100
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,13004256318260638989,11627239244855347395,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=5908 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:2144
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,17813591109447495161,18427824732665261484,524288 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=5736 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5240
        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6744,i,17617201883343789069,8589693285850837347,1572864 --field-trial-handle=1944,i,9812839150730417840,1733060461402412288,262144 --variations-seed-version=main@86c21c7cb7fb8377d7bc24b0f6b8862a54b61993 --pseudonymization-salt-handle=1948,i,12653558199305935063,14992084965928139598,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6836 /prefetch:1
          4⤵
          • Executes dropped EXE
          PID:5192
  • C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\elevation_service.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4060
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:5236
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:2280

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          2
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          setup.exe
          • Path C:\Program Files (x86)\BraveSoftware\Update\Install\{15221B11-65D9-46BD-B154-E871A741BD5A}\CR_4AE18.tmp\setup.exe
          • Size 7.4MB
          • SHA256 e5a5cace212a936cf930863b2782cd7f177bec74f395ce6e4ba8a41873f13df5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          af.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\af.pak
          • Size 709KB
          • SHA256 225be4d90d41be82944fe06552cdb0d38323dfb1de8e6d94c6d01e97bd1e92fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\am.pak
          • Size 1.1MB
          • SHA256 86cd1cc2bc74271121b5bd5b1c2b59cc8910ffe52f3a85de6f5d5202141b8e0d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ar.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ar.pak
          • Size 1.2MB
          • SHA256 d1c39c04d560474c63598e9f875d9829f02d2b3846b204fe1d69293d2022acdc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          az.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\az.pak
          • Size 813KB
          • SHA256 d664679580f8681f70255718b10bf065db314190e11878ada1ecea9b3aca8c37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bg.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\bg.pak
          • Size 1.3MB
          • SHA256 0596b076eefab813b2109c7a068b33c04270a5e968e609c51a843ff3678e28ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bn.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\bn.pak
          • Size 1.6MB
          • SHA256 f64763d3d1c5f0a910a49396475118a2716cd0c222e281cb64a5d7b5224d2807
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bs.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\bs.pak
          • Size 791KB
          • SHA256 7649e7ba88a39612a0cc407e8619809376dcfdd774db6ed940478d86fc6f31fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ca.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ca.pak
          • Size 815KB
          • SHA256 5cd6b369a13e03162a254fd8422649e64a8e8bf4991fde1db1bc2df55016ec4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cs.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\cs.pak
          • Size 826KB
          • SHA256 9b2877b8655fea2ae9c7c1e36848e0e0232cd1172000c56e413263fd86157867
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          da.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\da.pak
          • Size 747KB
          • SHA256 0edf3a5df3e0f9d92ac98cce55815363de6f7e35057789ec6469b20ef4195d0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\de.pak
          • Size 820KB
          • SHA256 c42f4591b600c83c805ad3fe6460aa62004420513f46e76762a67685e84394f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          el.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\el.pak
          • Size 1.4MB
          • SHA256 3be290e49d5ffbbef1fb86db2d4b8f2e8da079211cf3671dfb1bf0d9e3a29cf4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-GB.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\en-GB.pak
          • Size 657KB
          • SHA256 bd322ca194f010d53fbe4d55279031c67124c416e7e24b55eb0e8da3c30ef147
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\en-US.pak
          • Size 663KB
          • SHA256 be3b3f54c767aec018d549b583f2e5294760a2b4d4cc1366beee3292425afb75
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es-419.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\es-419.pak
          • Size 803KB
          • SHA256 75ca1c99049c501945464c19e2a4bf48459f115c042c2103861ae7f34968c7c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\es.pak
          • Size 798KB
          • SHA256 d12f7516d31209021a00daf5850cdcf692e071db44f0ee9d6b47c2b335447ee1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          et.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\et.pak
          • Size 727KB
          • SHA256 3111314291859465ffc560d46c84339f06caab0f74efa0640d06c2b6a7e7e7d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fa.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\fa.pak
          • Size 1.2MB
          • SHA256 f8486e31575ecbfedd65e274dd3faf600078a36a56adb4e9ea27069e511a6049
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fi.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\fi.pak
          • Size 744KB
          • SHA256 fc84af361b5a1a1184cee3bb1ba4d50572296a56219d71238ba165bc0a4cae16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fil.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\fil.pak
          • Size 830KB
          • SHA256 afc1b59d5e675ff834e945b80410378a18f030e1a00e65fd86753e9f53517489
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\fr.pak
          • Size 863KB
          • SHA256 92e3b13d21c21b850c8d29fa62f237dce1309965a02aeba621fa96c7d45de6d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gu.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\gu.pak
          • Size 1.6MB
          • SHA256 8e97a79897839106951223725fda65571a26cf01f59dea29c15e73a211e71050
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          he.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\he.pak
          • Size 1021KB
          • SHA256 7609d16f619324a0e09ef6ff176cf416fc068566e181b2c71a439a918f33ab33
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hi.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\hi.pak
          • Size 1.7MB
          • SHA256 f34f7a61431db2714c035492a52708a76439793f2c525749d0419db898cd283c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hr.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\hr.pak
          • Size 801KB
          • SHA256 791b4fa1d02762fa466964791b43ed008e54acc6104ec1ad5b10f74d841f2cb4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hu.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\hu.pak
          • Size 859KB
          • SHA256 139935fc4c0cd782abba74339672e5633df0714da9ceec004e36500e70beaea0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          id.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\id.pak
          • Size 723KB
          • SHA256 009d708c6649eb4c775dd6765cb43c7fdaa7048d4153bd10e48b662b00f1e111
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          it.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\it.pak
          • Size 792KB
          • SHA256 af2cd000ae4bf83d260fc422011b9a1828c1a7be08ed46f3ac2d3101b7a07623
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ja.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ja.pak
          • Size 956KB
          • SHA256 202b321734db8158a4e38b68f5a0ff9af8eeaf36a073703ccfb736d29bd2d1ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ka.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ka.pak
          • Size 1.7MB
          • SHA256 b23c939f44d4f3c28143a7af5f12944c9537631c054695ff389d726614dfc307
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kk.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\kk.pak
          • Size 1.3MB
          • SHA256 4e4518e8b378dae5a18805e7ad55a41bd7151e52b1a507cfb67b74da9bfef10b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          km.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\km.pak
          • Size 1.8MB
          • SHA256 45031a1fc163533c34517410314cf0b3ab3e1e47a98f315ca9c34ed5ee7c38df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kn.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\kn.pak
          • Size 1.9MB
          • SHA256 bdab2ca97efdea851d6b43f8f668b452778f094ed30041509c53b89c4e309379
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ko.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ko.pak
          • Size 811KB
          • SHA256 b13da82fce45522e9b37c18e1b673aed9985676bdc156886560919ba3f242ee8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lo.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\lo.pak
          • Size 1.5MB
          • SHA256 f20a6e134db445e8354a2646fecfc067bd58e32d5a600a729c7134c32184a196
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lt.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\lt.pak
          • Size 858KB
          • SHA256 1a7047ed69cbfed305225bb849603b8040296b129bf4436781041afdbb4baaa8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lv.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\lv.pak
          • Size 847KB
          • SHA256 e0a10c70832d54e2d34dabfe4240399ae6684831947d4db457e7d3297628af29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mk.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\mk.pak
          • Size 1.3MB
          • SHA256 f4472738dd1f0cb5ef6cc8183bfb81f6d4c64d97ea51e3b7f330eeb4140ccca7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ml.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ml.pak
          • Size 1.9MB
          • SHA256 e0df383e19a077a829aa88d5847ebbd0b31a9cf8cc87a40ae2da8821cfe1a83a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mn.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\mn.pak
          • Size 1.2MB
          • SHA256 bef4c55a9cff9b81f9ed753ab379c26c46fdd88b2f06e545ae1dcb2ca332d72f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mr.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\mr.pak
          • Size 1.6MB
          • SHA256 ac21a47f80c875c3c6dd81fb579f294a841fa5c39308152572ef0cc0c7c1eb4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ms.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ms.pak
          • Size 754KB
          • SHA256 266b8912882722a8afac611e47ba8616337b62a251f99eaa1aff07e98f5c3be1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          my.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\my.pak
          • Size 1.8MB
          • SHA256 253a3713cd806e6260cef017e6b83820159b213b6ad4b5a7e0674adb35fd7af5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nb.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\nb.pak
          • Size 719KB
          • SHA256 1d4dfbad1b9184d59e55dad7ba5ef506ef2ffcef9b2403fce6d79ed65bd28f91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nl.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\nl.pak
          • Size 753KB
          • SHA256 f6a85ffba69bd3a5b8b94caa32a314151ea4a1f838f3385912d38c62a9ff5d51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pl.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\pl.pak
          • Size 828KB
          • SHA256 b9d305caad2f91a4eaf96420ccd2549253725e42812964ecad41a84b2bde7783
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pt-BR.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\pt-BR.pak
          • Size 784KB
          • SHA256 91902645e01d9173437426d5d7aa8f129d1b52f618350f431cc006022365256d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pt-PT.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\pt-PT.pak
          • Size 790KB
          • SHA256 83d11ad210d5e2e5bb60bba8f496c19ead954faa39c5b1a243101f7226c60b07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ro.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ro.pak
          • Size 819KB
          • SHA256 b7b583bd2afa96624a90df79f724ff42605e77ec634f3d1f034a005496e13d57
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ru.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ru.pak
          • Size 1.3MB
          • SHA256 6189b7b6202a1e60430dd92890898f2d764d7a29f3759cc8a8c9df0e31c4c563
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          si.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\si.pak
          • Size 1.5MB
          • SHA256 ec4870c0531b4e88d84f0a16a09921c1cf04e93f552f917d655135d6d1b1745e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sk.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sk.pak
          • Size 838KB
          • SHA256 b089860538c3fb5c09b0f31373cf7f694c6eb06bca77a81778b2a9a4ca051c07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sl.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sl.pak
          • Size 797KB
          • SHA256 b80439f73184237d01596ba21065e04c5eaee675650cc929aa808383fd56d5b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sq.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sq.pak
          • Size 811KB
          • SHA256 de2c06d4b9574354f003935b44d23819b0aeb0b1e070c797380d9c9442b010f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sr-Latn.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sr-Latn.pak
          • Size 779KB
          • SHA256 0ecd35f9e066f9b7a2b8ef2164253bea0402ff0b50991211b8a90c81f1dda20c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sr.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sr.pak
          • Size 1.1MB
          • SHA256 0718944847c36c18145919f535a99bf1d1118349d3d5af8d889c4c807a324b49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sv.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sv.pak
          • Size 731KB
          • SHA256 e0f52fa601c81747dda1138239a492afa4009773fb909909c401f55149a51393
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sw.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\sw.pak
          • Size 767KB
          • SHA256 d4f26316a03b3eae0d655bef370067bab5f549b70ee6675dbfab338a4a9b99df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ta.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ta.pak
          • Size 1.9MB
          • SHA256 4d72eb5ec24480cb5144128256102dbcea5c68deb6dcd889af07f54e86020d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          te.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\te.pak
          • Size 1.8MB
          • SHA256 f51d273f5476d12028db9370a08a691e2564dd24500469053c79224b7bba3584
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          th.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\th.pak
          • Size 1.5MB
          • SHA256 73a56ea04e378d0617d265837eb8f2999ee167d6828a188ed8e56fc7c51ff7d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tr.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\tr.pak
          • Size 787KB
          • SHA256 1183034d44d2572caa855039ae4b0a6364d845a2c6821d443fe5515168fa610a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uk.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\uk.pak
          • Size 1.3MB
          • SHA256 ba796832b07bebe4864a69d6dddd501489e4a77c81ec70bb742f86d255e6c5fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ur.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\ur.pak
          • Size 1.0MB
          • SHA256 cc1ab33ea67c21b66d8818f270fcf2be868d4e7808788ba7e4b16297e68bdbd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uz.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\uz.pak
          • Size 764KB
          • SHA256 3fe36ec783292e63a627161881c908a0f845d0d2b30e9cb6052a5a96f616b306
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vi.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\vi.pak
          • Size 930KB
          • SHA256 c935380fe3f198830e283f14a1c19c0fe163856502c124fdd1ca90c0c69a4ad3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-CN.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\zh-CN.pak
          • Size 665KB
          • SHA256 8e359de98cd340ef8b9c7c9664de248852dd6b91b3028a1cd1c89beb273d50b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-TW.pak
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\155.1.97.59\Locales\zh-TW.pak
          • Size 659KB
          • SHA256 fa76cb62d047d38bab0756ad1e53399e047096353f73e66bd3723e2cd7215a7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          brave.exe
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
          • Size 4.4MB
          • SHA256 6882ca1240c84214a0f928c211075fd66a848cf99381e32fa1f30de6c706e3a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Application\chrome_proxy.exe
          • Size 2.5MB
          • SHA256 e1d7b9105147eecbbc5e879638f1bf459b5f3db9bbda30aaceeac740e3acfe85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          messages.json
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source5324_151589978\Chrome-bin\155.1.97.59\resources\brave_extension\_locales\en_US\messages.json
          • Size 9KB
          • SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          messages.json
          • Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source5324_151589978\Chrome-bin\155.1.97.59\resources\brave_extension\_locales\hr\messages.json
          • Size 9KB
          • SHA256 bf4799a7899490a023cb617dba40e32f16748cb8c9dffc26e299e327a76375fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Synaptics.exe
          • Path C:\ProgramData\Synaptics\Synaptics.exe
          • Size 753KB
          • SHA256 491d5c52e200c57d608f907cf4fb8d5dce0f09524d2c767d192f3f568950d8df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\BraveWallet\Brave Wallet Storage\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DawnGraphiteCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DawnGraphiteCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DawnGraphiteCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Google Profile.ico09e14814-69d3-4ffd-9ebc-55f5f3ac7451.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Google Profile.ico09e14814-69d3-4ffd-9ebc-55f5f3ac7451.tmp
          • Size 165KB
          • SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
          • Size 3KB
          • SHA256 e512099a1ce40242d8c5dd153d831c965a1241f439f3500d2c35f5897390b6c9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Preferences40d126bc-c5fa-4246-b004-c3e65c77f882.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences40d126bc-c5fa-4246-b004-c3e65c77f882.tmp
          • Size 19KB
          • SHA256 c14e0fd9a20d6580baabf8b9f560f409c00e35c7611b5abaf8223d40a6bf7cd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences5a8fe01e-c4f1-4b8f-b542-30ac9fde52e5.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences5a8fe01e-c4f1-4b8f-b542-30ac9fde52e5.tmp
          • Size 19KB
          • SHA256 3c79019ce06f102f8039605b39e6d51596528323c9543243f26321ac43f22220
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Sync Data\LevelDB\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
          • Size 10KB
          • SHA256 4ae925bb3c6a3331bca6d89df61baff811bad9aed7d55bb0deea2887bca5a83a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State1b9b49fe-6c17-4a99-9f42-577d56048f25.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State1b9b49fe-6c17-4a99-9f42-577d56048f25.tmp
          • Size 53KB
          • SHA256 d68a092415f0ed297314e50d306c91702cda93865f4c86b27e86e057ffa967fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State2d82ebf0-8a38-4719-b43d-6447d05cefae.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State2d82ebf0-8a38-4719-b43d-6447d05cefae.tmp
          • Size 44KB
          • SHA256 8f3d73182678baeb9308f81acc949408a42b049857d48cdecc31d29ba3d272bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local Statebc7ac87e-409b-4c77-8feb-73034d6cfae4.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local Statebc7ac87e-409b-4c77-8feb-73034d6cfae4.tmp
          • Size 53KB
          • SHA256 f592e58b853bdf99801341b9b06145a5b8c4a67c0f4dbe3c254131ab828690fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSafeSeedV2
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSafeSeedV2
          • Size 19B
          • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
          • MD5 SHA1 SHA512
          Submit Download

          VariationsSafeSeedV291e12e29-e49e-45c9-9bcc-26c0bee112be.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSafeSeedV291e12e29-e49e-45c9-9bcc-26c0bee112be.tmp
          • Size 7KB
          • SHA256 08cec0df8619504164106b5821a0ff663e61474eb69c91900b4d9c5b562ae77e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSeedV2
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSeedV2
          • Size 7KB
          • SHA256 4be4d470ab027d65b5f5d774e716e47622da9c35578c5ce7c4d880631b1afca4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSeedV23baaf2b5-29e1-4822-b6cd-9c2f5b3091af.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSeedV23baaf2b5-29e1-4822-b6cd-9c2f5b3091af.tmp
          • Size 7KB
          • SHA256 383a34cb5b37b1fdd54a06455d8dc3a7b58d585f0bc705ed00882d19bb05ec0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSeedV29e9feea4-4fed-4c9f-8690-cbaf47f8f024.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\VariationsSeedV29e9feea4-4fed-4c9f-8690-cbaf47f8f024.tmp
          • Size 166B
          • SHA256 72b10ef28345b21a603fb23c1361130e9c15128b07c61a1173a174acc50df4d6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          0a8cbe9f476fde506eec4cf6532541b923809b3e0ca51743e38ef6c4b34bf7e5
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\0a8cbe9f476fde506eec4cf6532541b923809b3e0ca51743e38ef6c4b34bf7e5
          • Size 4KB
          • SHA256 0a8cbe9f476fde506eec4cf6532541b923809b3e0ca51743e38ef6c4b34bf7e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • Size 11KB
          • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
          • Size 3KB
          • SHA256 2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3febc617953b91891e2212b8252e7be381b2066dc6e24b42faa4940482edda61
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\3febc617953b91891e2212b8252e7be381b2066dc6e24b42faa4940482edda61
          • Size 271KB
          • SHA256 3febc617953b91891e2212b8252e7be381b2066dc6e24b42faa4940482edda61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          4eea198900f80362be049efdab87745e20b805efae8f7045171540fc69123afc
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\4eea198900f80362be049efdab87745e20b805efae8f7045171540fc69123afc
          • Size 20KB
          • SHA256 4eea198900f80362be049efdab87745e20b805efae8f7045171540fc69123afc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          6aa0d86e882913da48afa16bdb5d90f632040d96e906738ad1c07b3786e27deb
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\6aa0d86e882913da48afa16bdb5d90f632040d96e906738ad1c07b3786e27deb
          • Size 832KB
          • SHA256 6aa0d86e882913da48afa16bdb5d90f632040d96e906738ad1c07b3786e27deb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          77f68f5931f241a1a0dd9e0ed0911a09d434278913c10d1f1e92e7b6575e344e
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\77f68f5931f241a1a0dd9e0ed0911a09d434278913c10d1f1e92e7b6575e344e
          • Size 884KB
          • SHA256 77f68f5931f241a1a0dd9e0ed0911a09d434278913c10d1f1e92e7b6575e344e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7df1aaeccb0c7bef43249ccfc991ca260b9cce63b30500ec922d9fe7ad5022ce
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7df1aaeccb0c7bef43249ccfc991ca260b9cce63b30500ec922d9fe7ad5022ce
          • Size 18.7MB
          • SHA256 7df1aaeccb0c7bef43249ccfc991ca260b9cce63b30500ec922d9fe7ad5022ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • Size 7KB
          • SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8079ee13f17028be6fbc6a8b26a15a7b03c7e645831b5b4dccd9c022a9ee858b
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\8079ee13f17028be6fbc6a8b26a15a7b03c7e645831b5b4dccd9c022a9ee858b
          • Size 48KB
          • SHA256 8079ee13f17028be6fbc6a8b26a15a7b03c7e645831b5b4dccd9c022a9ee858b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
          • Size 3KB
          • SHA256 925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9a53298f1f361e0d7de4e9f50fc573584eb58b8f8ac7ecd3be635d3bf17964b6
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\9a53298f1f361e0d7de4e9f50fc573584eb58b8f8ac7ecd3be635d3bf17964b6
          • Size 3KB
          • SHA256 9a53298f1f361e0d7de4e9f50fc573584eb58b8f8ac7ecd3be635d3bf17964b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • Size 14KB
          • SHA256 acceb354266f9ed53a1b6ace9cb8261965ce0ca763badde74904298ef956bdc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          b462b03c6835050005e2c03adbeb99166339b092ffd6e3b8794e7e5db5c8727c
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\b462b03c6835050005e2c03adbeb99166339b092ffd6e3b8794e7e5db5c8727c
          • Size 490KB
          • SHA256 b462b03c6835050005e2c03adbeb99166339b092ffd6e3b8794e7e5db5c8727c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          b9b8100ac11fee77fb723002f8e753d37b1f5ffda79398def7e2645be32b5478
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\b9b8100ac11fee77fb723002f8e753d37b1f5ffda79398def7e2645be32b5478
          • Size 44KB
          • SHA256 b9b8100ac11fee77fb723002f8e753d37b1f5ffda79398def7e2645be32b5478
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bf0fe50642b04640ea4fa0b13b980985a6005ee849379e21661f91d7ce5784d0
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\bf0fe50642b04640ea4fa0b13b980985a6005ee849379e21661f91d7ce5784d0
          • Size 88KB
          • SHA256 bf0fe50642b04640ea4fa0b13b980985a6005ee849379e21661f91d7ce5784d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • Size 3KB
          • SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dbdf0edec63135261870b2810b001af0aab4a2d8150d1729442bf929e8ca27fd
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\dbdf0edec63135261870b2810b001af0aab4a2d8150d1729442bf929e8ca27fd
          • Size 483KB
          • SHA256 dbdf0edec63135261870b2810b001af0aab4a2d8150d1729442bf929e8ca27fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e2c50eca0c941d10b594e18cfb0f6da3d2f18dbde53d8169421ca0d61c06dbfb
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\e2c50eca0c941d10b594e18cfb0f6da3d2f18dbde53d8169421ca0d61c06dbfb
          • Size 1.6MB
          • SHA256 e2c50eca0c941d10b594e18cfb0f6da3d2f18dbde53d8169421ca0d61c06dbfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f1953f3a71bab4c6666200a86b535ed00e97f9596517a1e9286932ae921f90e5
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\f1953f3a71bab4c6666200a86b535ed00e97f9596517a1e9286932ae921f90e5
          • Size 1.2MB
          • SHA256 f1953f3a71bab4c6666200a86b535ed00e97f9596517a1e9286932ae921f90e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f19934b6bd39905c9473aa63819bc7a9704c0cb022fcee6cc443b9f4afe7d51b
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\f19934b6bd39905c9473aa63819bc7a9704c0cb022fcee6cc443b9f4afe7d51b
          • Size 12KB
          • SHA256 f19934b6bd39905c9473aa63819bc7a9704c0cb022fcee6cc443b9f4afe7d51b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
          • Size 1KB
          • SHA256 77af9667527b347e5737a8dc6f12f6e051ea9a91c3946c4bffd28bd5447e634b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json873100df-6147-47e3-ad71-b480c3c5b3ec.tmp
          • Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json873100df-6147-47e3-ad71-b480c3c5b3ec.tmp
          • Size 2KB
          • SHA256 01ef93408c1ca8b9fb7ba1efc675469ac839a5ddc1ae5d9faaa058abd7abdf6a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ._cache_2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
          • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat.exe
          • Size 1.2MB
          • SHA256 655fa2e96b8e853f09383f9f3cf0d18f5cd220b92412476aeaf03a282bc8a730
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1026242501\manifest.json
          • Size 587B
          • SHA256 2a75478b285626c52571ad1ef9638c9537ca6050efa8b30d2f924953710491e3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1131857636\manifest.json
          • Size 563B
          • SHA256 9d2a71a0a0495eac6de46f5254997edab01cab2d9fa20f30dfc422b4463c8eb7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1270859209\manifest.json
          • Size 533B
          • SHA256 cfb711300137c877ba9ac562dbabc18879f7494ecc1d182af8dd4909c29e9bb3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1399704914\manifest.json
          • Size 584B
          • SHA256 a2a3f7ed87efc9e8153171f0e18144cd463f651f8f2572ef33de79f95ec6b0f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          fc037faa-8196-459e-91e6-1aa1083367dd.png
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1503848662\c79d61e4-a5bd-4865-a616-b70bd63d4a94\fc037faa-8196-459e-91e6-1aa1083367dd.png
          • Size 26KB
          • SHA256 791f7346c4046712e0dc30e2a63f36dc205c9dc7a56f6edf030a4894374e4936
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1503848662\manifest.json
          • Size 546B
          • SHA256 11d0b642fb595056f6ab2d13f6bddca3a1a8ba71423e99625512782b3fab85ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          photo.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1503848662\photo.json
          • Size 50B
          • SHA256 c9b5c6de15d08254da3d561470114637abdf1715f2b24b4747152fd774d81bac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1726397233\manifest.json
          • Size 558B
          • SHA256 3152b43a7242220c00b363ba7ead4665b8b39010dc3e69136ee8edc63114e87e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_1830248443\manifest.json
          • Size 564B
          • SHA256 c90156b0befec33bd73c4501561b099a505886db8398680502b43515561121e5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_2024335173\manifest.json
          • Size 512B
          • SHA256 6250bf4ad5ec850ae3a0944907d688c5c9334173063bbcf2add2a03a2b078976
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_2040550700\manifest.json
          • Size 580B
          • SHA256 bfad155b88d1441588aed8777cd1548d05edbf513bfb6da5917a384db7e3acc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_2118207689\manifest.json
          • Size 581B
          • SHA256 e9b2bef1e170dde425ab4e7a432b3ed9eeb71797035bbd1c4c8bac5054e8e39a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_216831868\manifest.json
          • Size 534B
          • SHA256 5418dd13c0d199a1ee2b0c492e198f346f9034ce484fb2de079f1b0795005b73
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_342922521\manifest.json
          • Size 592B
          • SHA256 1c28e94ce8790debe988d67819a564b4eaa866cb380cbad21a51325269f7824a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_344810954\manifest.json
          • Size 86B
          • SHA256 31a56f514d228a98683b8cbf7e8a3ced78857ef3e745a06fbc2c5b33162d3220
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_405915103\manifest.json
          • Size 95B
          • SHA256 7b62bbf778317b72e6ae0f19219e150f818c4f6039b2b327ed56d6dfba83eb23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_499763196\manifest.json
          • Size 504B
          • SHA256 9f604b6a7eead839ef5f4f7c52c1d1b277d72a6971c0afeb8563e4847dc445d3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_52481954\manifest.json
          • Size 540B
          • SHA256 e66e402edd069ef0aa45e5f580e6241848d1c20fdc8bff99ab1ac79cc13cd758
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_606615103\manifest.json
          • Size 518B
          • SHA256 43ac09cee97c15a43c3d34458c36223e3108d8a2f04f7369fb4315af7e867a98
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_855824098\manifest.json
          • Size 591B
          • SHA256 9d08147a8d24c7e4b896d517cb3a3bc0f178fd40440c9b20ac5f29a482c69259
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_878511812\manifest.json
          • Size 594B
          • SHA256 c0564829533a0b07f1887095c9512383c2fea84db0f071b0bba8a70d5bb61da1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping4068_950424643\manifest.json
          • Size 546B
          • SHA256 8923881de92da31b03486b33f576f6369cb8615ac5709b02636fc792b37c3500
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.dat
          • Path C:\Windows\SystemTemp\Crashpad\settings.dat
          • Size 40B
          • SHA256 9861796d261df8333355675f9995b47a31e48936d51b81a8ee3ecfe8501f1d40
          • MD5 SHA1 SHA512
          Submit Download

          BraveCrashHandler.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveCrashHandler.exe
          • Size 270KB
          • SHA256 a48460a9a9630feed8ce8cfaa8220afb5008ebc8df588e4d8357d1b702abf26e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandler64.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveCrashHandler64.exe
          • Size 355KB
          • SHA256 58f08cf6780a909753951faaefc0297cd0da405888c58fdea50002f105564932
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveCrashHandlerArm64.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveCrashHandlerArm64.exe
          • Size 353KB
          • SHA256 1b72a8979096f7597d3381955b365954eb5b5cfc5bfdf3c85866598906aa5ad6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdate.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveUpdate.exe
          • Size 163KB
          • SHA256 d6f7fda11eeaaab01ff04849fe80c893bb6341c9e5d73bec90014c3a4ec90d02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShell64.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveUpdateComRegisterShell64.exe
          • Size 170KB
          • SHA256 102067ecfcfa782cbb8a35d11d3fc9ef9e5c2972a613bdec69fd0bce997c88ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateComRegisterShellArm64.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveUpdateComRegisterShellArm64.exe
          • Size 154KB
          • SHA256 ad45abbcfba124407222a9a0acb6734f5f20fe4efc86da255f511c56c0749f9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BraveUpdateCore.exe
          • Path C:\Windows\SystemTemp\GUM3700.tmp\BraveUpdateCore.exe
          • Size 195KB
          • SHA256 c25ab36c4fefe0bf36b97907379311a1c5effc40af40f764c509eb74510ed3d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdate.dll
          • Size 1.0MB
          • SHA256 9a1f5a84fbc7108e80da6e35d2115bbe3fc3fd4b6059704879f0f35bfe66c9b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_am.dll
          • Size 42KB
          • SHA256 540664063e9331e20c96d6d4d656a240ef1d05f31036071e0b0b67bfadf598fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ar.dll
          • Size 41KB
          • SHA256 6c57e2790926c7fee841320752868150a1668ac9f29f23e3a6fc7e7ad304f1ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_bg.dll
          • Size 44KB
          • SHA256 c5757d0bb160344a94e2e111adbd10bc74221e2bfadaeb15f070d295f8197f30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_bn.dll
          • Size 44KB
          • SHA256 4410b76993013fc04f01f60533b69dabb8f6d2347166742d6ba6e2d303553561
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ca.dll
          • Size 44KB
          • SHA256 107aca214e8a3b7f4a924680e6e4c730b80eb6903dc69c81e8ac68be2df7e68c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_cs.dll
          • Size 43KB
          • SHA256 2866167a6fc6dedf41c134c369b7d25577c14718363ec2ea814eb137eb2ab4be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_da.dll
          • Size 43KB
          • SHA256 244032ef3f85dd0d81b225994ab6ffa13166d41f1cd57d463eb8e15ada00a3c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_de.dll
          • Size 45KB
          • SHA256 cff784e128807d7f2e3dc561630ff89dade0606b59fcf952cfd0ca4ba1dcbf48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_el.dll
          • Size 44KB
          • SHA256 0df831eeeb37cc004390ffe8dd3c0d6e724bc73752c2061d512e2bbe62c3b26a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_en-GB.dll
          • Size 42KB
          • SHA256 7b53f4312869cd1b66d72707deefefaa38718b6cdafb7dcdd2167f53ed0e1611
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_en.dll
          • Size 42KB
          • SHA256 0169f5f73a7b4fad4eb2cf173786b230442b697aab9522268012f7be01907880
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_es-419.dll
          • Size 43KB
          • SHA256 8d981321850ba037eb82988e4fbe7f29170a4353bdc7e2b7e143b249f0a219a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_es.dll
          • Size 45KB
          • SHA256 ae897e76351274d4430b55175ef639a32b4b0affbfbd5fa45a4306514f2ad5de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_et.dll
          • Size 42KB
          • SHA256 a0ec8757d0c7cba6b5b6f02efc0620b57e08b9888d8b1da2ed2b101c90fbd55a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_fa.dll
          • Size 42KB
          • SHA256 0a1139281eb50df6d31f1d2c7a29b8e1e42093d0450d5dfd5f946a2963198c96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_fi.dll
          • Size 43KB
          • SHA256 c4fff9e149aba54e0c712e23898de924677d3ac94d4168263bfcfe4a979a0592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_fil.dll
          • Size 44KB
          • SHA256 c0958c6dc8279fbfc2c19a84a5c7eb1f9036d44f202f194aa3a8408dff8ebab8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_fr.dll
          • Size 44KB
          • SHA256 3c9c431b424ee5050533f2a3cbe833d306576ceed9cab920559d3de45347dfe4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_gu.dll
          • Size 44KB
          • SHA256 0e8ce89a8202193c01e229405f454709b99edfcb05e3f487428cbff6cf1509c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_hi.dll
          • Size 43KB
          • SHA256 e28364c5d40dfef5b1ad5d0a5e34a5ef0dc399844196db559d74255f7d3670de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_hr.dll
          • Size 43KB
          • SHA256 0a101caa52e7e04b5567fb37a01300c214723f65550b6351105f46b1b13a8061
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_hu.dll
          • Size 43KB
          • SHA256 54ff35a64d43083656a6081a21b2e524362ded9f8e7a36bbfbce1b41671fe9a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_id.dll
          • Size 42KB
          • SHA256 3e46c1b3991be5bf6427746ee0c2299ecd68cefeb318f5549783b48f6afedb4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_is.dll
          • Size 42KB
          • SHA256 87faf1d818761d324b5e772e4209ca8b542a3fd4c5672a81a4ce81b11cf42d30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_it.dll
          • Size 44KB
          • SHA256 a2f4ae9aea36abf29d561e86bd25ff23839ffaa7d84ece41754280a0b3069c38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_iw.dll
          • Size 40KB
          • SHA256 44dde4a00f760de4a1b87fefc7721560e47bbd893f5cda8a8ac2a9f381dbe57b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ja.dll
          • Size 39KB
          • SHA256 d288ca00e0c0ae175ef52d802a051af828b3e6c022a922425957d9f7b9e7c09e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_kn.dll
          • Size 44KB
          • SHA256 4d704a2fc807abf216a4576055e00ff2b93d7351dc95621fb26f2714e0a1edd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ko.dll
          • Size 39KB
          • SHA256 1c77a1a3cc924d21e4f0c266711714152c9b8def96d2564a0f98b26989f43dab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_lt.dll
          • Size 42KB
          • SHA256 f28311d7d0cc040c2748539ba256e68a7ff70b43f5f575efeff88d48aa2e9f16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_lv.dll
          • Size 43KB
          • SHA256 8c46ef1088de4c8a55fa9431b528cc885ec80582e7de432a0122956f2232c829
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ml.dll
          • Size 46KB
          • SHA256 ca17b0da7822ba3923841543ea20e9b71f57ab6cf2c3035cb3030dc8a26b4ead
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_mr.dll
          • Size 44KB
          • SHA256 81e6f0998d955434903057d0fb9aae394a33afd9c02e58964866eb1d7d862704
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ms.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ms.dll
          • Size 42KB
          • SHA256 3512dbc3c9a379d5175e046c5983fc73f9b94fd9b6dc22db9a183d7712a40acb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_nl.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_nl.dll
          • Size 44KB
          • SHA256 e9c5c3033d436cfa1e83659d2400bdb4e468c135f2c1adc4fac14e5c85161e3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_no.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_no.dll
          • Size 43KB
          • SHA256 1f9f34cb61fadb1c48202e951457b159071b65410a0e65ccbd74782c6467f787
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pl.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_pl.dll
          • Size 43KB
          • SHA256 118faeab656ff0358ed852fb5f29c0820568d4b24269ec399912b1dbfa8ab76e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-BR.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_pt-BR.dll
          • Size 43KB
          • SHA256 afe9d4a37e1423bb87891417e7a28db3886e32684877c9b039d5c300f68b002e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-PT.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_pt-PT.dll
          • Size 43KB
          • SHA256 5666f23ad75f6f0702ccea3236881967c685ff7450a9667df5c78d08d36756d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ro.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ro.dll
          • Size 43KB
          • SHA256 4937a9228222e270b1c7d4354941a7dbade1c12f585802cae8e03e708e663569
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ru.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ru.dll
          • Size 42KB
          • SHA256 65261ee644fb0802b070fb2a4e89289d8fba0dbc9de9526daa941939165427da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sk.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_sk.dll
          • Size 43KB
          • SHA256 0f408bf9be38ba4876ab4d43c78e758964fae3ba50da7f46aec87a95d5680e3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sl.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_sl.dll
          • Size 43KB
          • SHA256 6071f30701e4058385d119e5dc94b311675b287d5c750df378e93b2563386aee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sr.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_sr.dll
          • Size 43KB
          • SHA256 c5d2e741528e28a47de8e9c617b0e1bb57a99ed5badc5f1cc56530d9b55dbe31
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sv.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_sv.dll
          • Size 43KB
          • SHA256 efeddeffb183a998ba5edd9d2084f11f8a79dba322132eb932e5161a653b6b48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sw.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_sw.dll
          • Size 44KB
          • SHA256 a3f0fb73001e98f06c2f534b8e2d8f40104c88423769c21d405e27a7221bad09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ta.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_ta.dll
          • Size 45KB
          • SHA256 8d5af479ba6703bc6636afafd4b4d391ae7b23af9771885679d165f26c62547e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_te.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_te.dll
          • Size 44KB
          • SHA256 c81394b2bed52dfd3e8729c13bff4af7848232c7bc5b3731cb1660c734a455a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_th.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_th.dll
          • Size 42KB
          • SHA256 2fc1b4e5ba606682757e6420f91e811d0f9dcf929672553ee3d5ff00897c8d4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_tr.dll
          • Path C:\Windows\SystemTemp\GUM3700.tmp\goopdateres_tr.dll
          • Size 43KB
          • SHA256 2ec349cfea9906784b3dc05b482e40d4155488da4460ecc9b86492f835417516
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1864-261-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/2604-777-0x000002547FCB0000-0x000002547FF80000-memory.dmp
          Download

          memory/2604-277-0x000002547FCB0000-0x000002547FF80000-memory.dmp
          Download

          memory/2604-201-0x00007FFAE4F80000-0x00007FFAE4F90000-memory.dmp
          Download

          memory/2604-387-0x000002547FCB0000-0x000002547FF80000-memory.dmp
          Download

          memory/2604-1749-0x000002547FCB0000-0x000002547FF80000-memory.dmp
          Download

          memory/2604-303-0x000002547FCB0000-0x000002547FF80000-memory.dmp
          Download

          memory/2604-198-0x00007FFAE4F80000-0x00007FFAE4F90000-memory.dmp
          Download

          memory/2604-259-0x00007FFAE2730000-0x00007FFAE2740000-memory.dmp
          Download

          memory/2604-197-0x00007FFAE4F80000-0x00007FFAE4F90000-memory.dmp
          Download

          memory/2604-196-0x00007FFAE4F80000-0x00007FFAE4F90000-memory.dmp
          Download

          memory/2604-260-0x00007FFAE2730000-0x00007FFAE2740000-memory.dmp
          Download

          memory/2604-200-0x00007FFAE4F80000-0x00007FFAE4F90000-memory.dmp
          Download

          memory/4076-0-0x00000000023C0000-0x00000000023C1000-memory.dmp
          Download

          memory/4076-118-0x0000000000400000-0x00000000005FA000-memory.dmp
          Download

          memory/4076-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
          Download

          memory/4956-276-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/4956-285-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/4956-842-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/4968-865-0x00007FFB23220000-0x00007FFB23221000-memory.dmp
          Download