Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2023, 01:43

General

  • Target

    BraveBrowserSetup (2).exe

  • Size

    1.3MB

  • MD5

    d7b3f0ba9013b54f0ee26f8e1363db6f

  • SHA1

    4e2d0ef3b828c700c22862472ee5eaebb1e78161

  • SHA256

    b8546f2662b5f95baf2f2fd25c3207c50403428bd73b71721bd8f02cfb65e6d6

  • SHA512

    47a64d4919b1232a0c5c8e5af209836fb154aa2fe8fb7bad4b63cda03f7d837705cfc263a0d9ac10196a4bbe12df289127f79802039504f43070dc064de1a909

  • SSDEEP

    24576:XahOv5YWCTmhb+i8XvfZX51YTjph3PvsomqtcbeWA8v10RvMgCUWA:KhOvPCTmhIRKHmucyW190RvtCUR

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 52 IoCs
  • Registers COM server for autorun 1 TTPs 34 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup (2).exe
    "C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup (2).exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none"
      2⤵
      • Sets file execution options in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        PID:1480
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:652
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:1472
        • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:752
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins2RDM4RkQ4Mi0wQTU2LTQ4QkEtQjI1Mi0wOUFGM0Q2NjA0NDV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkM2NzJCNDEtQkQ5Qi00NDE5LUEzRTItOTQ0NTc5QzFDODkxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjEzNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyNjgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:1564
      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none" /installsource taggedmi /sessionid "{6D38FD82-0A56-48BA-B252-09AF3D660445}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:240
  • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\brave_installer-x64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\brave_installer-x64.exe" --do-not-launch-chrome
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=109.1.47.186 --initial-client-data=0x144,0x148,0x14c,0x118,0x150,0x13f989710,0x13f989720,0x13f989730
          4⤵
          • Executes dropped EXE
          PID:1860
        • C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
          "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1192
          • C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
            "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=109.1.47.186 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f989710,0x13f989720,0x13f989730
            5⤵
            • Executes dropped EXE
            PID:1052

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandler.exe

    Filesize

    293KB

    MD5

    abb49e6c916cff25bbf5242645fd557e

    SHA1

    ed609fb8b041778da2e1533360e23d50bf002d75

    SHA256

    3b8f707a42f5066a73365a8c1add83c2c0471ec5023fa78e29e462c0fedb07f5

    SHA512

    49e3c3a6e748f003a9cfb1f3d0bff741974dc16926b37d295757b1eac5147b244cb7f62a0d035349a1ce38f49da373fda94d9d5fa36ad912fc18e365519f92fc

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandler64.exe

    Filesize

    386KB

    MD5

    beb606f6abcdac6b5d28de211c0d4994

    SHA1

    82b029ec64b2ec5763aa9cab2123b29648a2e302

    SHA256

    722657346ee99cc00381b4c776eaebc234fafa3e5c793f88a5d8a78a35aadd99

    SHA512

    4df5d358bb96f0cf5243bae4882aed50f1b370089638325c9719967237e2326e7dff5e57dcf681d265a750064f003765a4e6f1cd98fb18d745bc8250ebff16bf

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandlerArm64.exe

    Filesize

    360KB

    MD5

    274e80f8eb7fa05bd261f2ccd6c2390e

    SHA1

    7cec99912119392d7eb6992111c681906bee4f20

    SHA256

    39ccbb5fcedda830ab38d4b4eafafdfd91c52ddf0af7c330a09aed7226910143

    SHA512

    19ddb56070ec853964421ac57a6590a7e943630ac18cdf101d37d31cd67bbcfdb5a884cf8a9b076369f5db0dda3b21fd3622d99f05c62292c80bfca3274ed82e

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe

    Filesize

    170KB

    MD5

    03b044f98add31e5a2f9b426e071c79e

    SHA1

    368eac50491d63765846dc15730a03d3865c2357

    SHA256

    d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

    SHA512

    b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe

    Filesize

    170KB

    MD5

    03b044f98add31e5a2f9b426e071c79e

    SHA1

    368eac50491d63765846dc15730a03d3865c2357

    SHA256

    d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

    SHA512

    b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateComRegisterShell64.exe

    Filesize

    188KB

    MD5

    3c9c826018046cdca56c2a836be9b335

    SHA1

    22edad3dee4f3dccf8c54e53f7bd7641116427f5

    SHA256

    672fa5f1c003e947ce1e91f29179842a65abd6af9aacb51fcdfb87734e817785

    SHA512

    944623416671d6790620bef79271b69392596819978939e4a525e60e965d4a619cc2bc4dc1bd547a381e716e957a34d30c85694c17f82e03953b26711ac5b388

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateComRegisterShellArm64.exe

    Filesize

    148KB

    MD5

    5b5f553e1188300dc69884f1866feb87

    SHA1

    d074eaedd00e78405dee4104df55e5712d7b9ec2

    SHA256

    1390f9a36491000cd5fc040947b8366c45f91541c9ff635ab3d2317e04892aa5

    SHA512

    ebd79509da32df3e07da930e406dcab80b1453dfabbc179b1c1cfc2167606134a062745330d3b8b6474ab77466d66e71dbef81a2d05c490940e446a27956c1e3

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateCore.exe

    Filesize

    217KB

    MD5

    fb3a65a300be7d3be09e62d21024e8cf

    SHA1

    800c6656e487c4b31927f09825fe061cdc665d8d

    SHA256

    d031fd1220844dafc8d791d4ecafb225d097f29060c00f90389b9b354d0a869f

    SHA512

    5221bef6a5b27916d48851c85d785fea15d094809819b100e44e6c0a490f9588351407ed811f665739abed2f0ce0a7eee45766a5fb6fbc7fb38ca65326486c3b

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdate.dll

    Filesize

    1.1MB

    MD5

    fe167e5aef821cd99da031451f1a37db

    SHA1

    2b3972bd0feecdfa80cee56d8e1378c5d44d6c23

    SHA256

    b8239acce72683344981558cda543df6c51194f6dc0b79073369a1a1707310b0

    SHA512

    755912da93f75cf6b94a3805c01f94fe46ab5169d3787bba15a230a95c543323801d51b71912dc46f17ec1769f4c421fa71debda406a3e90ee03d2337d7f9e3d

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_am.dll

    Filesize

    51KB

    MD5

    952d728eb12b3ae0cbbe510cb88c9125

    SHA1

    98154a08ebb701d6e250d928ac090ed6319d17f1

    SHA256

    4170acb4971b5373c760b02a81aa71ec7927efc50af69091e07c66c67ab3b884

    SHA512

    21efd8f71d7f2f817f76a88273f1101022b21e8adfc8515218627bf863ffab7b2560a41767350ac47028427e3313b8933997cf799ce8efa524c32c732c3c9b4c

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ar.dll

    Filesize

    50KB

    MD5

    c7af9d4f208838ac39a6243207200412

    SHA1

    96de7400552706d036b3ce100a25bd7a0f336152

    SHA256

    d78959ad0e5febdcebfec904f77e1229428bf3086c149b4dd94930e18b727e52

    SHA512

    d230998443c3718e547064afa5f2afe94da3a5297a7b6a071449a588b4dc51741c179892eaf7d4a8d7db3681744c520046a841c67b32cb9d3a4c244ef9c94580

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_bg.dll

    Filesize

    53KB

    MD5

    c2d5910c73b089748760138b0da0bbcd

    SHA1

    ee90ca2adbd41345d48b7e8821c44e55934913b9

    SHA256

    9a165e164dd179e4fcbd50a29b9a0f9d5682f14046b8a15c593850342d0ae6b1

    SHA512

    bd2c47952663e188b9d788e538a65adf37a4260c13bde970556ca538d2b0d58d913713ce22e743ac8aa0b571a51e6ee14218f5f5728f0a3b77b87189d710bd0b

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_bn.dll

    Filesize

    53KB

    MD5

    456d9591ce37ea5ac81a587048312ec0

    SHA1

    4b8673321e5c47e758f2c3128197ed84c8b0a681

    SHA256

    afc531f51285860b3db534855f152c326fd59a42a5b4554c07ca894ebb6ed100

    SHA512

    f123ad5e18128c26d30c3e9394d40331f183dd255edf06b5f9c5c4f609ece464111fd4dace39bba15a9a0265afb35bfc6b6e858b65ab1d5fec306ac837163e5a

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ca.dll

    Filesize

    53KB

    MD5

    edf6ed54c56ec183e22f8e61a23b3e4e

    SHA1

    8bce2a05e8b3f4a2b96991d19bfd79cb4fa0246e

    SHA256

    8f1f3af179ce7431dc3c85f74a3029daface80f0bc40b0435b4e7bf4a4966efe

    SHA512

    60e8e354a886bb8090a57f84a122b909e92f9b05cb98bf537109ad68e9ff9b97aedb0465c802f0e42ea4548aa013e8569eef283c8ec0acedaa47fd4c71df10db

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_cs.dll

    Filesize

    52KB

    MD5

    6239aac4448afe6a7c8ca08ca6fd8477

    SHA1

    f5ebb49968ed75a6470205c1c068e680dacd44c1

    SHA256

    ed0f1127eade9ac63c159388ada59fe6727c03a526820423be30769b6c3407be

    SHA512

    176006c675c23fede59847fc257887b50c5c6898053000beecbede1c00bde3446a9d400dac25a782d12646e7ca21945e6860b30be992931c8c3f42cd92d433c9

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_da.dll

    Filesize

    52KB

    MD5

    bf0deb435d0fb825ac19187540deaee8

    SHA1

    5aee9b601ebe86191d8a470b3ac9dbca054f5114

    SHA256

    a34c551be33fff045cbbfe7ee234840ec94cbf67f94b5a4e90fe2ea02b36e13c

    SHA512

    639ce39403bce096f9c0b64adfa5e45b2f3dd7819180f9d8d6cf5cf77209fbe052779cd2d402252052c3261b6a134f872e3d70dc99cc1c67bbfdbe6deba95772

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_de.dll

    Filesize

    54KB

    MD5

    732ffb4e91ea6f1cfd0b5075abb8e616

    SHA1

    b529a294f219bfb6f3384b13fd4f0cacabf2ead6

    SHA256

    e883fd20ccc807c084798adaf5cbd8c9b192c3e21713bc26c196f93aa92cfb2f

    SHA512

    2bd9acb40f780078748f9e2c99b11233fe8f6a04218404d94ad350b1b43282560a58e7ad681032a2fe01b98f6e96d0784c64983afb82f9d2f92f3a4033f6923b

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_el.dll

    Filesize

    54KB

    MD5

    8e8bb6d072d0fd0d78b1d7ea912fe8d1

    SHA1

    ecdda631b83573f0023294f4b2f1cf14aa64613a

    SHA256

    1111fd426002a993332e175461c8d81638357fa61f31212f48131ab2e454abea

    SHA512

    2ce4231abb03ad6d46da822ec90c8b1d741f84e780f41326519c5c6df0c50b46dcca1f86bdf43a711655ec71c38a6f8a9f274b02f46f43ca77af536288d0b10c

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en-GB.dll

    Filesize

    51KB

    MD5

    50fe0df9d9612b6d4636c0b8543bb1ae

    SHA1

    f1d183ead20c7f4707525d970e4f69c6df38b7a7

    SHA256

    5acbd02c5aa6f3fa9fe640e27ff58357b4e3b625e521aa9167698a1c574be0a2

    SHA512

    fa89b39e71285f21914a615b00043af3dae185a24d8a8d4bb5faad682d351203afdc4271258562b78d552a2ba877b9555b9ba2b9fe2a3f7533c90c574d2fe6cf

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en.dll

    Filesize

    52KB

    MD5

    c119b7f4421d3b56286ccc95fb6072db

    SHA1

    3386841db70d8b3c24f4f8a61e03b8bcd0ddcc01

    SHA256

    f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b

    SHA512

    f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_es-419.dll

    Filesize

    53KB

    MD5

    5ee19bf2cda7cd4f5d2b904aaeaf1a70

    SHA1

    8910926d01c1551a1ad0d4914ae7704a95f44855

    SHA256

    99124fc1426f415dbd44799c1c95c8774b569ab6502b1f71fdaf34a789bd46ca

    SHA512

    ab851cabc8f83c86542247b2226f3a52be12a08fcafc7d3d7c093646a010dc199d35f3978e07db7beb281858b69ad968adba092cd64c2d8010d1362a77998da6

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_es.dll

    Filesize

    54KB

    MD5

    f95890d91bdb05c8c9f894c8e702e944

    SHA1

    b2d371d71b9b8ea59286b61f45d0450c4e466ed1

    SHA256

    2bf91b4b88f19c30f50f73cdbd77251abf5d2ec87502fd0125845cb17e49c047

    SHA512

    1fb96de04492c70f05fa70db11706c04b71f2e00b93d5c1b4d4d9ddad47918402c3e7d89baf0dbbcdcf587b08bea6b29f2dbe31d286c18398a097635d1a6f01f

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_et.dll

    Filesize

    52KB

    MD5

    336d29829a5e7f45b3c668c5318d59d0

    SHA1

    e078502116345a3d42805a103c3c744207768ea2

    SHA256

    c9f02b65f1ae42932098aa15f079a7bbc62af675e8ec4170fca2e5607517ed48

    SHA512

    648be41e0f0e3ddcf00c1d5030c918db4171c00534045db253366189722a1e99fe23e94ff7f960f3614252a7b72a8c56fc10e1d91f91b072de6f19cdce49a2af

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fa.dll

    Filesize

    51KB

    MD5

    b2dea0295b886bb951715d7437ce2502

    SHA1

    272f12985ffacb46432c014cdd0c44b5e4de8fa2

    SHA256

    fa08a49321dadea11d5b060d9e6baedd63fd9cd641744b8158da9d8fdc4dcffa

    SHA512

    fc471a8ea39b6bcfcebda72469b27008fe98888f066db6d074cd52393a320da96f9d9ceae7d12b15415525f1d81215172e05c8c903a78ced03d1014399573d88

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fi.dll

    Filesize

    52KB

    MD5

    e017a8cc3a9a3842c21442f06c347b89

    SHA1

    f2f0022a093e1b896d8910116826eda60573b036

    SHA256

    c8a08859c185da734f95f69cc2e7d0e76c2b922f9b7b25b72d9aa28ea9302419

    SHA512

    c05fdd334aef7cf5f230eca6702c7346b133a0ea5b24528d9ff0fcd7ffd18b20f8a4d5ae8184767f93da02e3a6fd4bd87ff3bf55602d90734d2c813f98b0f459

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fil.dll

    Filesize

    53KB

    MD5

    44f3f887738b5c4b5a8b474c11c88ba6

    SHA1

    f5acd286f6a34994cf3dfcb79fa21ca93e5833d3

    SHA256

    0e63151e6a39c394c939e34a22854122ee6d217754ea575ede21eaec3267d4d4

    SHA512

    520b7a71651a2fbf0820f7e6458eb6c3289b675feb27dca758d1731788d95407d89e3bd6901f4bcf81ab144f0e2996a498b4ac5f00129a5f47e7456a3d5b7bb6

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fr.dll

    Filesize

    54KB

    MD5

    d6fed020daef639970bae58a52d96b7f

    SHA1

    4de8d2aa82ec0954b32c8ffa136e2e9d7bc30d86

    SHA256

    c08e507c3f5b07fc818c0204e34789ec8e5e6bf97ef78bef80a0658fe76403ad

    SHA512

    46cf1e03bb3f0cc5d55b9d57900bc4fbfb8dfdc0e6dd71449307c93a54861ae35f89d52056a6dee2457a6c9c4c10a03525017c06fa76dc8ca6205ef97ee7b057

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_gu.dll

    Filesize

    54KB

    MD5

    96f5aa5232067ca2c14d74a41e0ced25

    SHA1

    a00451c1b1860f5da35ac509f0f97f4c4ba94f87

    SHA256

    7d8a7bba1057a83ef03ea971299eaaac1ed92d23642aa040c233acf263bc51a9

    SHA512

    c52130b049dc8e981b85d0fbb1e34a9ec98fb44b50fd60c856000d525e9e9d32ff6edcb2e1174031f9b779998a73fa72c148591d0622de46067f81450ab2d150

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_hi.dll

    Filesize

    52KB

    MD5

    3cb19e36ec8aaa6095dd8fc9e1b0b199

    SHA1

    18a202c5bb123f9667f0328e4efd5dd814a0d3bd

    SHA256

    6b21d6b9bed85798a748c3a8905960b8526739392d7d3d8bd9833d39d5c92aee

    SHA512

    21b477480c0e697e7ae201e3c15e772cab4f77519db74c3d71b37f689a24cee918ea37dba9f488096e687e768c09c194447dfb0e13b3e9a9caecd03f333005d6

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_hr.dll

    Filesize

    53KB

    MD5

    a3fa90aa21c2c5f0b2d72c223d899da4

    SHA1

    fd93fad70ade266657b302237e3dca51401cc550

    SHA256

    223198f64aaca92df2dbd6e6311760353c83671d202a2abb597679720d20c303

    SHA512

    b8e1b891ac468570492f3812341028732355ca8193370a00fda6de67b60f3e64bc4d3207d139a5c11f1c486c3dafcb78591583aee61b17c110e13f9b358717d4

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_hu.dll

    Filesize

    53KB

    MD5

    5e17dd7c7c950af55f69f9e926fd5999

    SHA1

    534cabac60a359b4098900e2c936c090e265dab5

    SHA256

    0f6c78eae1a14d67cdc112d100a0f05764a7039b14a3fd6138f6c1efb3ef44a0

    SHA512

    802e7f17f8519631ad4847d0ed53bb83cd1601cba455a432b13e4dc3ba1bcf4fff6bc7d1cf4866298f52b897f2c6ce7ce845ef3fc676328ca84c35bda6c8ddef

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_id.dll

    Filesize

    52KB

    MD5

    f8457a1cfe368b3c19bcacf7010f276e

    SHA1

    0fa4bc120abf94a8b5c0de30f910040f10351ad9

    SHA256

    0fb838120c6a0c8cb95a4e54073c905fb7d2b27811792e01fe221b3991e89c6e

    SHA512

    cfd90e17adbb9796de2e63dc1c22d887aead64f929f3260bed0a796247757dc09b895de0cf2f5c3acd2ed6e067ac587f1f616c84f2dcfcb5a8e51ec12a9748b1

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_is.dll

    Filesize

    52KB

    MD5

    3ee5e70581c5c0b9beb9d8d326502dc3

    SHA1

    7dfaa038f13b66e33e8f49a593afffc7d0973689

    SHA256

    529eddf4c8ae1d513a49b8e70a3e6b87f7cd7100500ab09bdeb42c83b6708ce3

    SHA512

    6d5e7337efe57bb9a42c4b93698bc4caef2b270e87c914d3205035919e5ba2bcf3a8fb04c3f15731a5a563c9d683cfcb1f202e56e0683387c5d5364522064bec

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_it.dll

    Filesize

    54KB

    MD5

    3f2b1d765a20ccdbfafb4a4bb4f07f22

    SHA1

    475e9b6a08df9ece6267c3424434e460051f5fdb

    SHA256

    fe8400f598c83c8631cd619ec647535e63a9444d17a8942f8f2e320222cbf459

    SHA512

    5bc377ab81ac1b5c0271859021e0f9beca37d97f1e7090ce67a2f2fdb49684909956e2839cb63cd55fa69f80613f9023a3c306bc9035ed07926a18a62bece861

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_iw.dll

    Filesize

    50KB

    MD5

    b511684bcc597a2f708092397806e652

    SHA1

    661c507e1b0a9022d1bef90ac1a4c64ac6193c4c

    SHA256

    db19c22a5496596835b5677637234d1814d5c1004268add0b79ecf37796df3c3

    SHA512

    f294cad9c98b2a7de124a1088c55713560d35822ab2e9dcee430ca925266424d8eff5e68602ddb050aab43e05b60ff6dd9f444136f8a8e1406fcdfaaf2c1adae

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ja.dll

    Filesize

    49KB

    MD5

    9cfb7801967c067b2d8a81a35f2b1493

    SHA1

    82bd4b32850bccdeb576737947dd9c82a58c83d7

    SHA256

    1187c6ae64f67ce6fccf5e8f79b395aa7501c0e5ff15cd07672d4c541780a169

    SHA512

    421e2f969e393b5b7c1c61f0d2249f7c2d38ea21141a4a79c3bf275d10e6b75d81717f3c734220a6f459797aed59003c63ca43818d2cbdba028c618d153425a8

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_kn.dll

    Filesize

    54KB

    MD5

    1b15c55ea11bc61757e5d0c28eb10593

    SHA1

    bbfc52e0a500b4d2c1a46fda5a5fd3a03d0f5ccc

    SHA256

    73f7b6e62ec05ab990051a41c6309e75357700a57171832aab20c45bcc33951c

    SHA512

    d22bbcbffcc64c6c0e59b254b2f6ba4af516f786c2877de82bb32184218bfd187c8f80e915ca68505d5b01efff98455713ae47849dc5acf98a67fcd30ef14dde

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ko.dll

    Filesize

    48KB

    MD5

    4e34d3e033f632a26d470d5e6fa8d921

    SHA1

    90714ad57783ea435dd9df0974350e69cfc7a132

    SHA256

    f8d20332d9ca70cade411d28e853aab93219939c17387918f4a8bb167926a342

    SHA512

    2e671236a0d57838405ef8118999e1dd85a51a19bcf80e90d15cc50d7232a90152f2b57769404397b8d3402ff1222d62ba6a623208111dc697b634517cb6e1c1

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_lt.dll

    Filesize

    52KB

    MD5

    a5caa7eb451940d8cb8e9a93a78c7b7f

    SHA1

    7645f6445948aefac145a3c354e6f9ef27398391

    SHA256

    5a504f7e2c7248a32ccfe2f21218eebbc2d84bd13863247cc2855d1d91376658

    SHA512

    24321764a6deeb59231fe666d01dea1eb311f53e9438408b02e4562feecd2e3c71a27ab38242bfbcab6d4626b84fea2d3924b9f3643a167b22adb3024c629564

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_lv.dll

    Filesize

    53KB

    MD5

    ddc97b4cf9f34c4b75f6f46f47f8c064

    SHA1

    a1ecfc6b8fa7d82103413bcc07716e12f6e1df1f

    SHA256

    ad7f288eebc3403b98480181f4a209a12d80d742765b2ba43ba97a85aef7e515

    SHA512

    d613bf6c6c214da9eb27022f5a654443c1f4e1be0b30d45682affebb1f8c070fdb04d88b8bd1e658ac378d5cae9f86a51d8932901696e59ef275ec0baacc45b4

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ml.dll

    Filesize

    55KB

    MD5

    fb29f8bccaca36cfe696af9c42ad1144

    SHA1

    594708a8516eea8450c13a97a72790e2cd9d2df0

    SHA256

    52d928792790ba56cf28fad00accd6087560e864e9b839e9c77a1b15000df001

    SHA512

    881d872d2d9ff6012bef1bd6e5811c9947040da77b7b75fae71e29988959e59a3848e33025100197abb1eae4101fd93456f743fdb53e4e895c1e0d59c6daea83

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_mr.dll

    Filesize

    53KB

    MD5

    96099c3ca5f9cdfb13ba7ab6f95d2db8

    SHA1

    a26f2af76338d83f48c1180d24469e661ec3c2c2

    SHA256

    c0a5466fd29780f92db373d95e0a15c6c0f5d751b7783ba1a4fa584c56a46eec

    SHA512

    2aecc53834a13ffd1a0586223c07ac61abd97b342108eadb39c36cbd5ee9477b5f36dfa1efa7af39905611edec242e74e9d8e3cd806694056678f0e0f1826ab8

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ms.dll

    Filesize

    52KB

    MD5

    b54dceae59496fea77e4553f7e901b2f

    SHA1

    f4e109925ae7f697ea7ba1f215c053bd9bbf457e

    SHA256

    55a0cd74c934ee3674bef493dc0e6cfa25be119a297d7e04b8ce7651705dc2c3

    SHA512

    acaece2ff20f63fee3b6ed9b09ce742f0ca08ddfa021f998e5fac991d22a73e9ab399420cf73fb5b8efd2d8da467653a162d78d55a85fd439f1b4d26c02de291

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_nl.dll

    Filesize

    53KB

    MD5

    7f7d273fdd78862dd9b3c0f367d547fb

    SHA1

    9f137a382ecbdd2299a2a5d586796bb877901ebb

    SHA256

    22546626e25468d569afba2035e68d8ea4514cba9dfaae3dbc1517c30af98849

    SHA512

    860ec4a40fc1a52483329268e1add66a1f9bdaa21930fdfbb83ebe1a83f5966ac9cfdcae87e3e4ff2ed8a76dc3f6fd3244378d9eebda664cc350ca45c00c93d5

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_no.dll

    Filesize

    52KB

    MD5

    d50df053f14f93c1b489ff11e31f877b

    SHA1

    bed9373f755d9c051279554bb8217bf06325a8c3

    SHA256

    25d36d848aa7c510348667a918a23388b3059248358910b92b8f05ccd6ee7e59

    SHA512

    33b455209993ad4d758750e14c26e21c4f0306ca30bd9afe56ea17d27cc62593130fffce72d1a0a94891b4682237d4729a11ab3554fb66ab3ade5d7154de504f

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pl.dll

    Filesize

    53KB

    MD5

    5f720368334375a3c1486938064f1d7c

    SHA1

    3dbabc5b3714926a74523427067df9a170ef1ad8

    SHA256

    624aa14c0f78ca26a685aab27f35e4b235e970666da8575b28faffdf71661327

    SHA512

    a375d3b77d5d3e2f3dd50d83a3f2028669b166fd3b94445986abd370339793e95263983b8d120d196b2edb172db1e42dbd48ad9ba5a40482ad19ce273f1f165a

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pt-BR.dll

    Filesize

    52KB

    MD5

    fe920d6abbeb347f7be6cb113869e405

    SHA1

    9e708cc5ccef1f2dd4cb3a87807aa0c0f9768604

    SHA256

    79c509515e24b57ac1e6bc85cec17217d5dedaa582268d6b3fb7d0d596feeaa3

    SHA512

    c1e26da50bffe378e2f878aedffaea7b1bb965a9f481b76de2358ddfe88e6c36011b10f90d253c5a802f9b374ada69c0eeedbcb6f824f7229cc25ff82f75a679

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pt-PT.dll

    Filesize

    53KB

    MD5

    ee4066da61344abc68469272cd6b4d3c

    SHA1

    553ed28fc59ca18e0b72bfb1cf5f8e592a68af45

    SHA256

    e0039b9e02c7ce1fa6f1cd6eaa92891ef6d852f4099138f0354d964a1bb68d1a

    SHA512

    180a76dae9ac52f2ce0fc2783ae720ec4033ad4930aa519466bc2175ff4bd3806c7494fd9ef31ac62cdd4ee062b8d8c3b2f10f9290268d136abd0c494be3556e

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ro.dll

    Filesize

    53KB

    MD5

    d3ae897d40f731303ee6a1581f91e9ac

    SHA1

    a88d49a2f276699994670625dfce2f2b6ec1cad1

    SHA256

    d5b18ffdacfac2f6c11568961ec513c82b88fa55fcc3600e9353cfe5b6e31dee

    SHA512

    9afa29e3bef3c8e7313a85b52759859861339dc2ab1162ffe28be4a8f9e13c3c88e4ecd8df17ada32cd3a76ff580af739ac8a331c2f5d0d821cc7399d3fb5efd

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ru.dll

    Filesize

    52KB

    MD5

    3ae763152c6b3f4cbf2cef797a3e6a30

    SHA1

    d56b64d0d1770dfb4501cb22e8d048161649b568

    SHA256

    0d1a5570526b0709919871a628968fee0c81eafdff068611e170087753b3cf50

    SHA512

    81c77aef5654ac6d628a5c6839f01c161fc58a392528944d3f65ba03b434854dbab34b5cdd668f45250a2fd4aa8fa4080784ac6fff70edd42812f388a0543441

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sk.dll

    Filesize

    52KB

    MD5

    82d06e4181b4430b82516fd204fa3060

    SHA1

    7d6dc8e04e86a950ce877c1dc8d489fd9eb962f2

    SHA256

    cbdd7c4663cbd2ddfea9be39739de303fe848733f2a36ab6851a910d99d047e5

    SHA512

    cbf28df25e38f7f87e85c3eac9005d7d04b86d962399235c69a9816c0427f56d727de563c2ec98341082dbbc732eb3fd788dc48dc7a9d10276975d5cc2de1e05

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sl.dll

    Filesize

    53KB

    MD5

    67505810f3a2f7a62e41b266c63089b7

    SHA1

    effa6a0dd0e44e5ef7bda5437b2a88b24f3215d8

    SHA256

    872fb34599b78c787e89e66f9968f1bd6e76488a2b7dc0c14cd3930abb8c5cef

    SHA512

    f39ce7aa6bfe5b22b54f465d8ed5e1e28d0d48fe51a0cbb841fd6dc3eaa2ab4592277f9e470d932eb2b093f7fd71128b66c9d2886611618df16aa33c2d679373

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sr.dll

    Filesize

    52KB

    MD5

    b51894d5b79c77ee9c5284a8540fa0ba

    SHA1

    aeb94bb01bc2d28a14d24ee0da0943c52b5ea0b9

    SHA256

    b092ca092e0f653c1649603ae4b7ecf38dbbedeffb65d11a241fecad66cf3274

    SHA512

    544894d19921ef0764b82997a6e7a8969396bdf85483f8278d70eca9f97ed47c0ffcec89053be048835fc298c55048fe40e5b9401e794154af9d75b961fd8cab

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sv.dll

    Filesize

    52KB

    MD5

    379cf8bd71842efd4af506562a11e7c1

    SHA1

    92c4416558b4a419f40d8445d80266f272f921ec

    SHA256

    63b76553af76b31fa6c34e4e3be71e2d144d0ed8ec3a2fe9e3634175d795cbac

    SHA512

    34f4c22aed0d151159005a4ae8309d217fb7b0b28e2f0b95cd18cf2fe9826d11a68e046f0fed69a954eb99ef105fcc06da03667b45fc756f59bd9402868d621a

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sw.dll

    Filesize

    54KB

    MD5

    ba9c6a3681424ec11586936a04200a2e

    SHA1

    ec86a71db9c8bf39ca4205f5a3f1ac92defc2ea1

    SHA256

    ea9207dc37c8806913665028aa6440bdd14c10c7e09b251e99937d1062e0bcc6

    SHA512

    977eed7cee3617c916b83fdb9136728ff64163f6aa4dfbabd2bde5c43e881075cc8a65742c4f7e23e69fbf86293e4767bb28f1184e32707221b1ab7858794616

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ta.dll

    Filesize

    54KB

    MD5

    0fe4e8e35d75999ff7b4639994eaef07

    SHA1

    af469e1b62a6fe8e5feac3889f44ae009b6bdb88

    SHA256

    ce6a20ce93579fa0be8a334395d5d6ba395a242e9a288d3d907eb62f3eb8ba7f

    SHA512

    d9f7d8ca1a58059e44b6eff9411e92ca4211c5ee83577b4d42433e697096b5d8a9b651e7b5bb4959d6952fee4c1b9f13f4062fd10205f6a18bdaced5159a9dc2

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_te.dll

    Filesize

    54KB

    MD5

    ab5817d15b4272cdba6ad78806e6cdde

    SHA1

    af7139e6b06ee30133c7ffb3e9e3a0f0b5de554d

    SHA256

    5030f0d18f191622f6d5a0fe010949e3c8e2ffc63d0f2f76fb87340e2c29d0da

    SHA512

    9a9f2d3c69d0f13933f6373d683abe676a75725a75380af389de91624d7f9a5033f674797665ab1a1a185491a5c9f828723b05f54935f16e0031dee86d13fa08

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_th.dll

    Filesize

    51KB

    MD5

    ace174d516146601b46bab25d1e6b25f

    SHA1

    20d5f3381e6a3b97a38bdcc9b385791b88392d8f

    SHA256

    f87bd8490cbd7ac13fe81d1d04017218db88f8a3f6afbac734dfdc9e662228c2

    SHA512

    428068e7dfce8ddc5fbb625b71168489d9b6cce10f6fd8bfd5390b2b6cc7273cbab310d68daae825fd1e75697e7d4e16fb4b0a5c71bff8096425cc6061598678

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_tr.dll

    Filesize

    52KB

    MD5

    7e6c746dcc0522d285dcaa59c626f3d3

    SHA1

    65b8434658926d7eb53aa3bb937044ee42adec9b

    SHA256

    2b8f98783f81f7cf60073482c9b014667ab4663a7e617bc080d35778a25bf401

    SHA512

    5820f22ec392bdfd1fe943f70e76ae82f2d3bba0721779794011c5903f36c8c9187912a0d679b440029c13a83217b6ef242242c307e05356d573226d4100f0c2

  • C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_uk.dll

    Filesize

    52KB

    MD5

    198d90c9de4097d4dc19ee8b342f5a18

    SHA1

    1d7512b2b6daf5d99dfde548296960cbd24c094d

    SHA256

    b12cf6a71db741a0bf27a1371c0a78de9e6174bd75c2d945bfab36fd62de9e27

    SHA512

    fc0bd9a21c1059b610020bf74784ab43097d228bfe96504e5884e6552db7b940361ca20a69445c42bd42bd7a3b51d3f0b2bf1fdda510a735cce39fbf0322575f

  • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdate.exe

    Filesize

    170KB

    MD5

    03b044f98add31e5a2f9b426e071c79e

    SHA1

    368eac50491d63765846dc15730a03d3865c2357

    SHA256

    d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

    SHA512

    b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

  • C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\109.1.47.186\brave_installer-x64.exe

    Filesize

    100.9MB

    MD5

    a4599022b5d1691983c26936f2125d5c

    SHA1

    1456be249bbf22ea515d817ea89e91d9b30ffba3

    SHA256

    24d4198fe7204663379a308532b997a70841fe55f8b20f10536c9e6f445cb791

    SHA512

    4464c1670391f1e4654593d2af32f0c35f1c68e4fa84c3c6e54aae85952f8429247bca22ff9babff4110876b5262411dd1bd34c71574c6b81e529b2c0b4bcdd4

  • C:\Program Files\BraveSoftware\Brave-Browser\Application\109.1.47.186\Installer\setup.exe

    Filesize

    3.5MB

    MD5

    43a8a1eaf7c7b53c8569d8a5b4dbb476

    SHA1

    b57972aee7518565e4eda1f20d3717d205c87ccc

    SHA256

    90f1ce74855aa7e17a44a75fcbb356c315aabd84dd9c2d01062a27383c5444a8

    SHA512

    9b2543da8851836a08aa185c1596e0ce23a4eedc18d04b9876fa1ee16cb8cf588886f76d2dd3b2f37b6961911af0333284044a835c3244b112598087d27e67a2

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk

    Filesize

    2KB

    MD5

    8de7607305d5086bb7fe86274b7df2bb

    SHA1

    96ce1cdf3bfc4a8bc4145810928edc8a55d95c4e

    SHA256

    84e52559ddded3ff4c6c9f8b006492ea577bb4973aa40d29e6073a458f8cff0a

    SHA512

    10941bc738e3925ea028c7faad99137105e838f3bfb67a1d68f6ab22d679d1102671f4aca9b3742f3c3c0f194c811edba98dca4edb29f15b96b62a54c5a704dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    e71c8443ae0bc2e282c73faead0a6dd3

    SHA1

    0c110c1b01e68edfacaeae64781a37b1995fa94b

    SHA256

    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

    SHA512

    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

  • C:\Windows\Temp\Tar341D.tmp

    Filesize

    161KB

    MD5

    be2bec6e8c5653136d3e72fe53c98aa3

    SHA1

    a8182d6db17c14671c3d5766c72e58d87c0810de

    SHA256

    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

    SHA512

    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

  • \Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe

    Filesize

    170KB

    MD5

    03b044f98add31e5a2f9b426e071c79e

    SHA1

    368eac50491d63765846dc15730a03d3865c2357

    SHA256

    d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

    SHA512

    b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

  • \Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdate.dll

    Filesize

    1.1MB

    MD5

    fe167e5aef821cd99da031451f1a37db

    SHA1

    2b3972bd0feecdfa80cee56d8e1378c5d44d6c23

    SHA256

    b8239acce72683344981558cda543df6c51194f6dc0b79073369a1a1707310b0

    SHA512

    755912da93f75cf6b94a3805c01f94fe46ab5169d3787bba15a230a95c543323801d51b71912dc46f17ec1769f4c421fa71debda406a3e90ee03d2337d7f9e3d

  • \Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en.dll

    Filesize

    52KB

    MD5

    c119b7f4421d3b56286ccc95fb6072db

    SHA1

    3386841db70d8b3c24f4f8a61e03b8bcd0ddcc01

    SHA256

    f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b

    SHA512

    f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767

  • \Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en.dll

    Filesize

    52KB

    MD5

    c119b7f4421d3b56286ccc95fb6072db

    SHA1

    3386841db70d8b3c24f4f8a61e03b8bcd0ddcc01

    SHA256

    f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b

    SHA512

    f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767

  • memory/240-346-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1012-312-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB