Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28/03/2023, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
BraveBrowserSetup (2).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BraveBrowserSetup (2).exe
Resource
win10v2004-20230220-en
General
-
Target
BraveBrowserSetup (2).exe
-
Size
1.3MB
-
MD5
d7b3f0ba9013b54f0ee26f8e1363db6f
-
SHA1
4e2d0ef3b828c700c22862472ee5eaebb1e78161
-
SHA256
b8546f2662b5f95baf2f2fd25c3207c50403428bd73b71721bd8f02cfb65e6d6
-
SHA512
47a64d4919b1232a0c5c8e5af209836fb154aa2fe8fb7bad4b63cda03f7d837705cfc263a0d9ac10196a4bbe12df289127f79802039504f43070dc064de1a909
-
SSDEEP
24576:XahOv5YWCTmhb+i8XvfZX51YTjph3PvsomqtcbeWA8v10RvMgCUWA:KhOvPCTmhIRKHmucyW190RvtCUR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe -
Executes dropped EXE 14 IoCs
pid Process 1012 BraveUpdate.exe 1480 BraveUpdate.exe 1288 BraveUpdate.exe 652 BraveUpdateComRegisterShell64.exe 1472 BraveUpdateComRegisterShell64.exe 752 BraveUpdateComRegisterShell64.exe 1564 BraveUpdate.exe 240 BraveUpdate.exe 1544 BraveUpdate.exe 1580 brave_installer-x64.exe 1656 setup.exe 1860 setup.exe 1192 setup.exe 1052 setup.exe -
Loads dropped DLL 52 IoCs
pid Process 836 BraveBrowserSetup (2).exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1480 BraveUpdate.exe 1480 BraveUpdate.exe 1480 BraveUpdate.exe 1012 BraveUpdate.exe 1288 BraveUpdate.exe 1288 BraveUpdate.exe 1288 BraveUpdate.exe 652 BraveUpdateComRegisterShell64.exe 1288 BraveUpdate.exe 1288 BraveUpdate.exe 1472 BraveUpdateComRegisterShell64.exe 1288 BraveUpdate.exe 1288 BraveUpdate.exe 752 BraveUpdateComRegisterShell64.exe 1288 BraveUpdate.exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1564 BraveUpdate.exe 1012 BraveUpdate.exe 240 BraveUpdate.exe 240 BraveUpdate.exe 240 BraveUpdate.exe 1544 BraveUpdate.exe 1544 BraveUpdate.exe 1544 BraveUpdate.exe 1544 BraveUpdate.exe 240 BraveUpdate.exe 1544 BraveUpdate.exe 1580 brave_installer-x64.exe 1656 setup.exe 1656 setup.exe 1192 setup.exe 1192 setup.exe 1192 setup.exe 1192 setup.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1656 setup.exe 1656 setup.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found -
Registers COM server for autorun 1 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ServerExecutable = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32 BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\ml\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\psuser.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\psmachine_arm64.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fa.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ms.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sv.dll BraveBrowserSetup (2).exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\el\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\fi\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateOnDemand.exe BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateCore.exe BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\psmachine.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\libEGL.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\ru\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_ko.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_lt.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_uk.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\nl.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\vi\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_es-419.dll BraveBrowserSetup (2).exe File opened for modification C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateSetup.exe BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_ja.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\cs.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandlerArm64.exe BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_tr.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\SETUP.EX_ brave_installer-x64.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\d3dcompiler_47.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\cs\messages.json setup.exe File opened for modification C:\Program Files (x86)\BraveSoftware\Temp\GUTBA6.tmp BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_pt-BR.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\sl.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\chrome_proxy.exe setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_vi.dll BraveBrowserSetup (2).exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\he.pak setup.exe File opened for modification C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\CHROME.PACKED.7Z brave_installer-x64.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_th.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdate.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateOnDemand.exe BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe brave_installer-x64.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\ar.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\MEIPreload\manifest.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\sk\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_bn.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pt-BR.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateSetup.exe BraveBrowserSetup (2).exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\da.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sk.dll BraveBrowserSetup (2).exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\109.1.47.186.manifest setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\en-US.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\fi.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\id.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\ml.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_ta.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\psuser_arm64.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\zh-TW.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\es_419\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\psmachine_64.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_da.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\nl\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\zh-CN.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandler64.exe BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_am.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ro.dll BraveBrowserSetup (2).exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_vi.dll BraveUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods\ = "6" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\ = "BraveUpdate Update3Web" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\ = "Google Update Legacy On Demand" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\LocalServer32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598BBE98-5919-4392-B62A-50D7115F10A3}\LocalServer32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\ = "IPolicyStatusValue" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\BraveHTML setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc.1.0\CLSID\ = "{3A9D7221-2278-41DD-930B-C2356B7D3725}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ = "ICredentialDialog" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveHTML\shell\open\command\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe\" --single-argument %1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ = "IPolicyStatus" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine.1.0\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598BBE98-5919-4392-B62A-50D7115F10A3}\LocalServer32\ = "\"C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\BraveUpdateBroker.exe\"" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB}\ = "Update3COMClass" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ = "ICoCreateAsync" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\NumMethods\ = "5" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\VersionIndependentProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassMachineFallback" BraveUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{B7965C30-7D58-4D86-9E18-4794256409EE}\ProxyStubClsid32 setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\LocalServer32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7965C30-7D58-4D86-9E18-4794256409EE}\1.0\0\win64\ = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\elevation_service.exe" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\ = "ICurrentState" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachine\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine\ = "Google Update Broker Class Factory" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine\CurVer BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\ProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd BraveUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd BraveUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A BraveUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 BraveUpdate.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe 1012 BraveUpdate.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1012 BraveUpdate.exe Token: SeDebugPrivilege 1012 BraveUpdate.exe Token: SeDebugPrivilege 1012 BraveUpdate.exe Token: SeDebugPrivilege 1012 BraveUpdate.exe Token: 33 1580 brave_installer-x64.exe Token: SeIncBasePriorityPrivilege 1580 brave_installer-x64.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 836 wrote to memory of 1012 836 BraveBrowserSetup (2).exe 28 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1480 1012 BraveUpdate.exe 29 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1012 wrote to memory of 1288 1012 BraveUpdate.exe 30 PID 1288 wrote to memory of 652 1288 BraveUpdate.exe 31 PID 1288 wrote to memory of 652 1288 BraveUpdate.exe 31 PID 1288 wrote to memory of 652 1288 BraveUpdate.exe 31 PID 1288 wrote to memory of 652 1288 BraveUpdate.exe 31 PID 1288 wrote to memory of 1472 1288 BraveUpdate.exe 32 PID 1288 wrote to memory of 1472 1288 BraveUpdate.exe 32 PID 1288 wrote to memory of 1472 1288 BraveUpdate.exe 32 PID 1288 wrote to memory of 1472 1288 BraveUpdate.exe 32 PID 1288 wrote to memory of 752 1288 BraveUpdate.exe 33 PID 1288 wrote to memory of 752 1288 BraveUpdate.exe 33 PID 1288 wrote to memory of 752 1288 BraveUpdate.exe 33 PID 1288 wrote to memory of 752 1288 BraveUpdate.exe 33 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 1564 1012 BraveUpdate.exe 34 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1012 wrote to memory of 240 1012 BraveUpdate.exe 35 PID 1544 wrote to memory of 1580 1544 BraveUpdate.exe 37 PID 1544 wrote to memory of 1580 1544 BraveUpdate.exe 37 PID 1544 wrote to memory of 1580 1544 BraveUpdate.exe 37 PID 1544 wrote to memory of 1580 1544 BraveUpdate.exe 37 PID 1580 wrote to memory of 1656 1580 brave_installer-x64.exe 38 PID 1580 wrote to memory of 1656 1580 brave_installer-x64.exe 38 PID 1580 wrote to memory of 1656 1580 brave_installer-x64.exe 38 PID 1656 wrote to memory of 1860 1656 setup.exe 39 PID 1656 wrote to memory of 1860 1656 setup.exe 39 PID 1656 wrote to memory of 1860 1656 setup.exe 39 PID 1656 wrote to memory of 1192 1656 setup.exe 40 PID 1656 wrote to memory of 1192 1656 setup.exe 40 PID 1656 wrote to memory of 1192 1656 setup.exe 40 PID 1192 wrote to memory of 1052 1192 setup.exe 41 PID 1192 wrote to memory of 1052 1192 setup.exe 41 PID 1192 wrote to memory of 1052 1192 setup.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup (2).exe"C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup (2).exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none"2⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1480
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:652
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1472
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:752
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins2RDM4RkQ4Mi0wQTU2LTQ4QkEtQjI1Mi0wOUFGM0Q2NjA0NDV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkM2NzJCNDEtQkQ5Qi00NDE5LUEzRTItOTQ0NTc5QzFDODkxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjEzNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyNjgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1564
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none" /installsource taggedmi /sessionid "{6D38FD82-0A56-48BA-B252-09AF3D660445}"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\brave_installer-x64.exe" --do-not-launch-chrome2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=109.1.47.186 --initial-client-data=0x144,0x148,0x14c,0x118,0x150,0x13f989710,0x13f989720,0x13f9897304⤵
- Executes dropped EXE
PID:1860
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=109.1.47.186 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f989710,0x13f989720,0x13f9897305⤵
- Executes dropped EXE
PID:1052
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
293KB
MD5abb49e6c916cff25bbf5242645fd557e
SHA1ed609fb8b041778da2e1533360e23d50bf002d75
SHA2563b8f707a42f5066a73365a8c1add83c2c0471ec5023fa78e29e462c0fedb07f5
SHA51249e3c3a6e748f003a9cfb1f3d0bff741974dc16926b37d295757b1eac5147b244cb7f62a0d035349a1ce38f49da373fda94d9d5fa36ad912fc18e365519f92fc
-
Filesize
386KB
MD5beb606f6abcdac6b5d28de211c0d4994
SHA182b029ec64b2ec5763aa9cab2123b29648a2e302
SHA256722657346ee99cc00381b4c776eaebc234fafa3e5c793f88a5d8a78a35aadd99
SHA5124df5d358bb96f0cf5243bae4882aed50f1b370089638325c9719967237e2326e7dff5e57dcf681d265a750064f003765a4e6f1cd98fb18d745bc8250ebff16bf
-
Filesize
360KB
MD5274e80f8eb7fa05bd261f2ccd6c2390e
SHA17cec99912119392d7eb6992111c681906bee4f20
SHA25639ccbb5fcedda830ab38d4b4eafafdfd91c52ddf0af7c330a09aed7226910143
SHA51219ddb56070ec853964421ac57a6590a7e943630ac18cdf101d37d31cd67bbcfdb5a884cf8a9b076369f5db0dda3b21fd3622d99f05c62292c80bfca3274ed82e
-
Filesize
170KB
MD503b044f98add31e5a2f9b426e071c79e
SHA1368eac50491d63765846dc15730a03d3865c2357
SHA256d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0
SHA512b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07
-
Filesize
170KB
MD503b044f98add31e5a2f9b426e071c79e
SHA1368eac50491d63765846dc15730a03d3865c2357
SHA256d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0
SHA512b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07
-
Filesize
188KB
MD53c9c826018046cdca56c2a836be9b335
SHA122edad3dee4f3dccf8c54e53f7bd7641116427f5
SHA256672fa5f1c003e947ce1e91f29179842a65abd6af9aacb51fcdfb87734e817785
SHA512944623416671d6790620bef79271b69392596819978939e4a525e60e965d4a619cc2bc4dc1bd547a381e716e957a34d30c85694c17f82e03953b26711ac5b388
-
Filesize
148KB
MD55b5f553e1188300dc69884f1866feb87
SHA1d074eaedd00e78405dee4104df55e5712d7b9ec2
SHA2561390f9a36491000cd5fc040947b8366c45f91541c9ff635ab3d2317e04892aa5
SHA512ebd79509da32df3e07da930e406dcab80b1453dfabbc179b1c1cfc2167606134a062745330d3b8b6474ab77466d66e71dbef81a2d05c490940e446a27956c1e3
-
Filesize
217KB
MD5fb3a65a300be7d3be09e62d21024e8cf
SHA1800c6656e487c4b31927f09825fe061cdc665d8d
SHA256d031fd1220844dafc8d791d4ecafb225d097f29060c00f90389b9b354d0a869f
SHA5125221bef6a5b27916d48851c85d785fea15d094809819b100e44e6c0a490f9588351407ed811f665739abed2f0ce0a7eee45766a5fb6fbc7fb38ca65326486c3b
-
Filesize
1.1MB
MD5fe167e5aef821cd99da031451f1a37db
SHA12b3972bd0feecdfa80cee56d8e1378c5d44d6c23
SHA256b8239acce72683344981558cda543df6c51194f6dc0b79073369a1a1707310b0
SHA512755912da93f75cf6b94a3805c01f94fe46ab5169d3787bba15a230a95c543323801d51b71912dc46f17ec1769f4c421fa71debda406a3e90ee03d2337d7f9e3d
-
Filesize
51KB
MD5952d728eb12b3ae0cbbe510cb88c9125
SHA198154a08ebb701d6e250d928ac090ed6319d17f1
SHA2564170acb4971b5373c760b02a81aa71ec7927efc50af69091e07c66c67ab3b884
SHA51221efd8f71d7f2f817f76a88273f1101022b21e8adfc8515218627bf863ffab7b2560a41767350ac47028427e3313b8933997cf799ce8efa524c32c732c3c9b4c
-
Filesize
50KB
MD5c7af9d4f208838ac39a6243207200412
SHA196de7400552706d036b3ce100a25bd7a0f336152
SHA256d78959ad0e5febdcebfec904f77e1229428bf3086c149b4dd94930e18b727e52
SHA512d230998443c3718e547064afa5f2afe94da3a5297a7b6a071449a588b4dc51741c179892eaf7d4a8d7db3681744c520046a841c67b32cb9d3a4c244ef9c94580
-
Filesize
53KB
MD5c2d5910c73b089748760138b0da0bbcd
SHA1ee90ca2adbd41345d48b7e8821c44e55934913b9
SHA2569a165e164dd179e4fcbd50a29b9a0f9d5682f14046b8a15c593850342d0ae6b1
SHA512bd2c47952663e188b9d788e538a65adf37a4260c13bde970556ca538d2b0d58d913713ce22e743ac8aa0b571a51e6ee14218f5f5728f0a3b77b87189d710bd0b
-
Filesize
53KB
MD5456d9591ce37ea5ac81a587048312ec0
SHA14b8673321e5c47e758f2c3128197ed84c8b0a681
SHA256afc531f51285860b3db534855f152c326fd59a42a5b4554c07ca894ebb6ed100
SHA512f123ad5e18128c26d30c3e9394d40331f183dd255edf06b5f9c5c4f609ece464111fd4dace39bba15a9a0265afb35bfc6b6e858b65ab1d5fec306ac837163e5a
-
Filesize
53KB
MD5edf6ed54c56ec183e22f8e61a23b3e4e
SHA18bce2a05e8b3f4a2b96991d19bfd79cb4fa0246e
SHA2568f1f3af179ce7431dc3c85f74a3029daface80f0bc40b0435b4e7bf4a4966efe
SHA51260e8e354a886bb8090a57f84a122b909e92f9b05cb98bf537109ad68e9ff9b97aedb0465c802f0e42ea4548aa013e8569eef283c8ec0acedaa47fd4c71df10db
-
Filesize
52KB
MD56239aac4448afe6a7c8ca08ca6fd8477
SHA1f5ebb49968ed75a6470205c1c068e680dacd44c1
SHA256ed0f1127eade9ac63c159388ada59fe6727c03a526820423be30769b6c3407be
SHA512176006c675c23fede59847fc257887b50c5c6898053000beecbede1c00bde3446a9d400dac25a782d12646e7ca21945e6860b30be992931c8c3f42cd92d433c9
-
Filesize
52KB
MD5bf0deb435d0fb825ac19187540deaee8
SHA15aee9b601ebe86191d8a470b3ac9dbca054f5114
SHA256a34c551be33fff045cbbfe7ee234840ec94cbf67f94b5a4e90fe2ea02b36e13c
SHA512639ce39403bce096f9c0b64adfa5e45b2f3dd7819180f9d8d6cf5cf77209fbe052779cd2d402252052c3261b6a134f872e3d70dc99cc1c67bbfdbe6deba95772
-
Filesize
54KB
MD5732ffb4e91ea6f1cfd0b5075abb8e616
SHA1b529a294f219bfb6f3384b13fd4f0cacabf2ead6
SHA256e883fd20ccc807c084798adaf5cbd8c9b192c3e21713bc26c196f93aa92cfb2f
SHA5122bd9acb40f780078748f9e2c99b11233fe8f6a04218404d94ad350b1b43282560a58e7ad681032a2fe01b98f6e96d0784c64983afb82f9d2f92f3a4033f6923b
-
Filesize
54KB
MD58e8bb6d072d0fd0d78b1d7ea912fe8d1
SHA1ecdda631b83573f0023294f4b2f1cf14aa64613a
SHA2561111fd426002a993332e175461c8d81638357fa61f31212f48131ab2e454abea
SHA5122ce4231abb03ad6d46da822ec90c8b1d741f84e780f41326519c5c6df0c50b46dcca1f86bdf43a711655ec71c38a6f8a9f274b02f46f43ca77af536288d0b10c
-
Filesize
51KB
MD550fe0df9d9612b6d4636c0b8543bb1ae
SHA1f1d183ead20c7f4707525d970e4f69c6df38b7a7
SHA2565acbd02c5aa6f3fa9fe640e27ff58357b4e3b625e521aa9167698a1c574be0a2
SHA512fa89b39e71285f21914a615b00043af3dae185a24d8a8d4bb5faad682d351203afdc4271258562b78d552a2ba877b9555b9ba2b9fe2a3f7533c90c574d2fe6cf
-
Filesize
52KB
MD5c119b7f4421d3b56286ccc95fb6072db
SHA13386841db70d8b3c24f4f8a61e03b8bcd0ddcc01
SHA256f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b
SHA512f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767
-
Filesize
53KB
MD55ee19bf2cda7cd4f5d2b904aaeaf1a70
SHA18910926d01c1551a1ad0d4914ae7704a95f44855
SHA25699124fc1426f415dbd44799c1c95c8774b569ab6502b1f71fdaf34a789bd46ca
SHA512ab851cabc8f83c86542247b2226f3a52be12a08fcafc7d3d7c093646a010dc199d35f3978e07db7beb281858b69ad968adba092cd64c2d8010d1362a77998da6
-
Filesize
54KB
MD5f95890d91bdb05c8c9f894c8e702e944
SHA1b2d371d71b9b8ea59286b61f45d0450c4e466ed1
SHA2562bf91b4b88f19c30f50f73cdbd77251abf5d2ec87502fd0125845cb17e49c047
SHA5121fb96de04492c70f05fa70db11706c04b71f2e00b93d5c1b4d4d9ddad47918402c3e7d89baf0dbbcdcf587b08bea6b29f2dbe31d286c18398a097635d1a6f01f
-
Filesize
52KB
MD5336d29829a5e7f45b3c668c5318d59d0
SHA1e078502116345a3d42805a103c3c744207768ea2
SHA256c9f02b65f1ae42932098aa15f079a7bbc62af675e8ec4170fca2e5607517ed48
SHA512648be41e0f0e3ddcf00c1d5030c918db4171c00534045db253366189722a1e99fe23e94ff7f960f3614252a7b72a8c56fc10e1d91f91b072de6f19cdce49a2af
-
Filesize
51KB
MD5b2dea0295b886bb951715d7437ce2502
SHA1272f12985ffacb46432c014cdd0c44b5e4de8fa2
SHA256fa08a49321dadea11d5b060d9e6baedd63fd9cd641744b8158da9d8fdc4dcffa
SHA512fc471a8ea39b6bcfcebda72469b27008fe98888f066db6d074cd52393a320da96f9d9ceae7d12b15415525f1d81215172e05c8c903a78ced03d1014399573d88
-
Filesize
52KB
MD5e017a8cc3a9a3842c21442f06c347b89
SHA1f2f0022a093e1b896d8910116826eda60573b036
SHA256c8a08859c185da734f95f69cc2e7d0e76c2b922f9b7b25b72d9aa28ea9302419
SHA512c05fdd334aef7cf5f230eca6702c7346b133a0ea5b24528d9ff0fcd7ffd18b20f8a4d5ae8184767f93da02e3a6fd4bd87ff3bf55602d90734d2c813f98b0f459
-
Filesize
53KB
MD544f3f887738b5c4b5a8b474c11c88ba6
SHA1f5acd286f6a34994cf3dfcb79fa21ca93e5833d3
SHA2560e63151e6a39c394c939e34a22854122ee6d217754ea575ede21eaec3267d4d4
SHA512520b7a71651a2fbf0820f7e6458eb6c3289b675feb27dca758d1731788d95407d89e3bd6901f4bcf81ab144f0e2996a498b4ac5f00129a5f47e7456a3d5b7bb6
-
Filesize
54KB
MD5d6fed020daef639970bae58a52d96b7f
SHA14de8d2aa82ec0954b32c8ffa136e2e9d7bc30d86
SHA256c08e507c3f5b07fc818c0204e34789ec8e5e6bf97ef78bef80a0658fe76403ad
SHA51246cf1e03bb3f0cc5d55b9d57900bc4fbfb8dfdc0e6dd71449307c93a54861ae35f89d52056a6dee2457a6c9c4c10a03525017c06fa76dc8ca6205ef97ee7b057
-
Filesize
54KB
MD596f5aa5232067ca2c14d74a41e0ced25
SHA1a00451c1b1860f5da35ac509f0f97f4c4ba94f87
SHA2567d8a7bba1057a83ef03ea971299eaaac1ed92d23642aa040c233acf263bc51a9
SHA512c52130b049dc8e981b85d0fbb1e34a9ec98fb44b50fd60c856000d525e9e9d32ff6edcb2e1174031f9b779998a73fa72c148591d0622de46067f81450ab2d150
-
Filesize
52KB
MD53cb19e36ec8aaa6095dd8fc9e1b0b199
SHA118a202c5bb123f9667f0328e4efd5dd814a0d3bd
SHA2566b21d6b9bed85798a748c3a8905960b8526739392d7d3d8bd9833d39d5c92aee
SHA51221b477480c0e697e7ae201e3c15e772cab4f77519db74c3d71b37f689a24cee918ea37dba9f488096e687e768c09c194447dfb0e13b3e9a9caecd03f333005d6
-
Filesize
53KB
MD5a3fa90aa21c2c5f0b2d72c223d899da4
SHA1fd93fad70ade266657b302237e3dca51401cc550
SHA256223198f64aaca92df2dbd6e6311760353c83671d202a2abb597679720d20c303
SHA512b8e1b891ac468570492f3812341028732355ca8193370a00fda6de67b60f3e64bc4d3207d139a5c11f1c486c3dafcb78591583aee61b17c110e13f9b358717d4
-
Filesize
53KB
MD55e17dd7c7c950af55f69f9e926fd5999
SHA1534cabac60a359b4098900e2c936c090e265dab5
SHA2560f6c78eae1a14d67cdc112d100a0f05764a7039b14a3fd6138f6c1efb3ef44a0
SHA512802e7f17f8519631ad4847d0ed53bb83cd1601cba455a432b13e4dc3ba1bcf4fff6bc7d1cf4866298f52b897f2c6ce7ce845ef3fc676328ca84c35bda6c8ddef
-
Filesize
52KB
MD5f8457a1cfe368b3c19bcacf7010f276e
SHA10fa4bc120abf94a8b5c0de30f910040f10351ad9
SHA2560fb838120c6a0c8cb95a4e54073c905fb7d2b27811792e01fe221b3991e89c6e
SHA512cfd90e17adbb9796de2e63dc1c22d887aead64f929f3260bed0a796247757dc09b895de0cf2f5c3acd2ed6e067ac587f1f616c84f2dcfcb5a8e51ec12a9748b1
-
Filesize
52KB
MD53ee5e70581c5c0b9beb9d8d326502dc3
SHA17dfaa038f13b66e33e8f49a593afffc7d0973689
SHA256529eddf4c8ae1d513a49b8e70a3e6b87f7cd7100500ab09bdeb42c83b6708ce3
SHA5126d5e7337efe57bb9a42c4b93698bc4caef2b270e87c914d3205035919e5ba2bcf3a8fb04c3f15731a5a563c9d683cfcb1f202e56e0683387c5d5364522064bec
-
Filesize
54KB
MD53f2b1d765a20ccdbfafb4a4bb4f07f22
SHA1475e9b6a08df9ece6267c3424434e460051f5fdb
SHA256fe8400f598c83c8631cd619ec647535e63a9444d17a8942f8f2e320222cbf459
SHA5125bc377ab81ac1b5c0271859021e0f9beca37d97f1e7090ce67a2f2fdb49684909956e2839cb63cd55fa69f80613f9023a3c306bc9035ed07926a18a62bece861
-
Filesize
50KB
MD5b511684bcc597a2f708092397806e652
SHA1661c507e1b0a9022d1bef90ac1a4c64ac6193c4c
SHA256db19c22a5496596835b5677637234d1814d5c1004268add0b79ecf37796df3c3
SHA512f294cad9c98b2a7de124a1088c55713560d35822ab2e9dcee430ca925266424d8eff5e68602ddb050aab43e05b60ff6dd9f444136f8a8e1406fcdfaaf2c1adae
-
Filesize
49KB
MD59cfb7801967c067b2d8a81a35f2b1493
SHA182bd4b32850bccdeb576737947dd9c82a58c83d7
SHA2561187c6ae64f67ce6fccf5e8f79b395aa7501c0e5ff15cd07672d4c541780a169
SHA512421e2f969e393b5b7c1c61f0d2249f7c2d38ea21141a4a79c3bf275d10e6b75d81717f3c734220a6f459797aed59003c63ca43818d2cbdba028c618d153425a8
-
Filesize
54KB
MD51b15c55ea11bc61757e5d0c28eb10593
SHA1bbfc52e0a500b4d2c1a46fda5a5fd3a03d0f5ccc
SHA25673f7b6e62ec05ab990051a41c6309e75357700a57171832aab20c45bcc33951c
SHA512d22bbcbffcc64c6c0e59b254b2f6ba4af516f786c2877de82bb32184218bfd187c8f80e915ca68505d5b01efff98455713ae47849dc5acf98a67fcd30ef14dde
-
Filesize
48KB
MD54e34d3e033f632a26d470d5e6fa8d921
SHA190714ad57783ea435dd9df0974350e69cfc7a132
SHA256f8d20332d9ca70cade411d28e853aab93219939c17387918f4a8bb167926a342
SHA5122e671236a0d57838405ef8118999e1dd85a51a19bcf80e90d15cc50d7232a90152f2b57769404397b8d3402ff1222d62ba6a623208111dc697b634517cb6e1c1
-
Filesize
52KB
MD5a5caa7eb451940d8cb8e9a93a78c7b7f
SHA17645f6445948aefac145a3c354e6f9ef27398391
SHA2565a504f7e2c7248a32ccfe2f21218eebbc2d84bd13863247cc2855d1d91376658
SHA51224321764a6deeb59231fe666d01dea1eb311f53e9438408b02e4562feecd2e3c71a27ab38242bfbcab6d4626b84fea2d3924b9f3643a167b22adb3024c629564
-
Filesize
53KB
MD5ddc97b4cf9f34c4b75f6f46f47f8c064
SHA1a1ecfc6b8fa7d82103413bcc07716e12f6e1df1f
SHA256ad7f288eebc3403b98480181f4a209a12d80d742765b2ba43ba97a85aef7e515
SHA512d613bf6c6c214da9eb27022f5a654443c1f4e1be0b30d45682affebb1f8c070fdb04d88b8bd1e658ac378d5cae9f86a51d8932901696e59ef275ec0baacc45b4
-
Filesize
55KB
MD5fb29f8bccaca36cfe696af9c42ad1144
SHA1594708a8516eea8450c13a97a72790e2cd9d2df0
SHA25652d928792790ba56cf28fad00accd6087560e864e9b839e9c77a1b15000df001
SHA512881d872d2d9ff6012bef1bd6e5811c9947040da77b7b75fae71e29988959e59a3848e33025100197abb1eae4101fd93456f743fdb53e4e895c1e0d59c6daea83
-
Filesize
53KB
MD596099c3ca5f9cdfb13ba7ab6f95d2db8
SHA1a26f2af76338d83f48c1180d24469e661ec3c2c2
SHA256c0a5466fd29780f92db373d95e0a15c6c0f5d751b7783ba1a4fa584c56a46eec
SHA5122aecc53834a13ffd1a0586223c07ac61abd97b342108eadb39c36cbd5ee9477b5f36dfa1efa7af39905611edec242e74e9d8e3cd806694056678f0e0f1826ab8
-
Filesize
52KB
MD5b54dceae59496fea77e4553f7e901b2f
SHA1f4e109925ae7f697ea7ba1f215c053bd9bbf457e
SHA25655a0cd74c934ee3674bef493dc0e6cfa25be119a297d7e04b8ce7651705dc2c3
SHA512acaece2ff20f63fee3b6ed9b09ce742f0ca08ddfa021f998e5fac991d22a73e9ab399420cf73fb5b8efd2d8da467653a162d78d55a85fd439f1b4d26c02de291
-
Filesize
53KB
MD57f7d273fdd78862dd9b3c0f367d547fb
SHA19f137a382ecbdd2299a2a5d586796bb877901ebb
SHA25622546626e25468d569afba2035e68d8ea4514cba9dfaae3dbc1517c30af98849
SHA512860ec4a40fc1a52483329268e1add66a1f9bdaa21930fdfbb83ebe1a83f5966ac9cfdcae87e3e4ff2ed8a76dc3f6fd3244378d9eebda664cc350ca45c00c93d5
-
Filesize
52KB
MD5d50df053f14f93c1b489ff11e31f877b
SHA1bed9373f755d9c051279554bb8217bf06325a8c3
SHA25625d36d848aa7c510348667a918a23388b3059248358910b92b8f05ccd6ee7e59
SHA51233b455209993ad4d758750e14c26e21c4f0306ca30bd9afe56ea17d27cc62593130fffce72d1a0a94891b4682237d4729a11ab3554fb66ab3ade5d7154de504f
-
Filesize
53KB
MD55f720368334375a3c1486938064f1d7c
SHA13dbabc5b3714926a74523427067df9a170ef1ad8
SHA256624aa14c0f78ca26a685aab27f35e4b235e970666da8575b28faffdf71661327
SHA512a375d3b77d5d3e2f3dd50d83a3f2028669b166fd3b94445986abd370339793e95263983b8d120d196b2edb172db1e42dbd48ad9ba5a40482ad19ce273f1f165a
-
Filesize
52KB
MD5fe920d6abbeb347f7be6cb113869e405
SHA19e708cc5ccef1f2dd4cb3a87807aa0c0f9768604
SHA25679c509515e24b57ac1e6bc85cec17217d5dedaa582268d6b3fb7d0d596feeaa3
SHA512c1e26da50bffe378e2f878aedffaea7b1bb965a9f481b76de2358ddfe88e6c36011b10f90d253c5a802f9b374ada69c0eeedbcb6f824f7229cc25ff82f75a679
-
Filesize
53KB
MD5ee4066da61344abc68469272cd6b4d3c
SHA1553ed28fc59ca18e0b72bfb1cf5f8e592a68af45
SHA256e0039b9e02c7ce1fa6f1cd6eaa92891ef6d852f4099138f0354d964a1bb68d1a
SHA512180a76dae9ac52f2ce0fc2783ae720ec4033ad4930aa519466bc2175ff4bd3806c7494fd9ef31ac62cdd4ee062b8d8c3b2f10f9290268d136abd0c494be3556e
-
Filesize
53KB
MD5d3ae897d40f731303ee6a1581f91e9ac
SHA1a88d49a2f276699994670625dfce2f2b6ec1cad1
SHA256d5b18ffdacfac2f6c11568961ec513c82b88fa55fcc3600e9353cfe5b6e31dee
SHA5129afa29e3bef3c8e7313a85b52759859861339dc2ab1162ffe28be4a8f9e13c3c88e4ecd8df17ada32cd3a76ff580af739ac8a331c2f5d0d821cc7399d3fb5efd
-
Filesize
52KB
MD53ae763152c6b3f4cbf2cef797a3e6a30
SHA1d56b64d0d1770dfb4501cb22e8d048161649b568
SHA2560d1a5570526b0709919871a628968fee0c81eafdff068611e170087753b3cf50
SHA51281c77aef5654ac6d628a5c6839f01c161fc58a392528944d3f65ba03b434854dbab34b5cdd668f45250a2fd4aa8fa4080784ac6fff70edd42812f388a0543441
-
Filesize
52KB
MD582d06e4181b4430b82516fd204fa3060
SHA17d6dc8e04e86a950ce877c1dc8d489fd9eb962f2
SHA256cbdd7c4663cbd2ddfea9be39739de303fe848733f2a36ab6851a910d99d047e5
SHA512cbf28df25e38f7f87e85c3eac9005d7d04b86d962399235c69a9816c0427f56d727de563c2ec98341082dbbc732eb3fd788dc48dc7a9d10276975d5cc2de1e05
-
Filesize
53KB
MD567505810f3a2f7a62e41b266c63089b7
SHA1effa6a0dd0e44e5ef7bda5437b2a88b24f3215d8
SHA256872fb34599b78c787e89e66f9968f1bd6e76488a2b7dc0c14cd3930abb8c5cef
SHA512f39ce7aa6bfe5b22b54f465d8ed5e1e28d0d48fe51a0cbb841fd6dc3eaa2ab4592277f9e470d932eb2b093f7fd71128b66c9d2886611618df16aa33c2d679373
-
Filesize
52KB
MD5b51894d5b79c77ee9c5284a8540fa0ba
SHA1aeb94bb01bc2d28a14d24ee0da0943c52b5ea0b9
SHA256b092ca092e0f653c1649603ae4b7ecf38dbbedeffb65d11a241fecad66cf3274
SHA512544894d19921ef0764b82997a6e7a8969396bdf85483f8278d70eca9f97ed47c0ffcec89053be048835fc298c55048fe40e5b9401e794154af9d75b961fd8cab
-
Filesize
52KB
MD5379cf8bd71842efd4af506562a11e7c1
SHA192c4416558b4a419f40d8445d80266f272f921ec
SHA25663b76553af76b31fa6c34e4e3be71e2d144d0ed8ec3a2fe9e3634175d795cbac
SHA51234f4c22aed0d151159005a4ae8309d217fb7b0b28e2f0b95cd18cf2fe9826d11a68e046f0fed69a954eb99ef105fcc06da03667b45fc756f59bd9402868d621a
-
Filesize
54KB
MD5ba9c6a3681424ec11586936a04200a2e
SHA1ec86a71db9c8bf39ca4205f5a3f1ac92defc2ea1
SHA256ea9207dc37c8806913665028aa6440bdd14c10c7e09b251e99937d1062e0bcc6
SHA512977eed7cee3617c916b83fdb9136728ff64163f6aa4dfbabd2bde5c43e881075cc8a65742c4f7e23e69fbf86293e4767bb28f1184e32707221b1ab7858794616
-
Filesize
54KB
MD50fe4e8e35d75999ff7b4639994eaef07
SHA1af469e1b62a6fe8e5feac3889f44ae009b6bdb88
SHA256ce6a20ce93579fa0be8a334395d5d6ba395a242e9a288d3d907eb62f3eb8ba7f
SHA512d9f7d8ca1a58059e44b6eff9411e92ca4211c5ee83577b4d42433e697096b5d8a9b651e7b5bb4959d6952fee4c1b9f13f4062fd10205f6a18bdaced5159a9dc2
-
Filesize
54KB
MD5ab5817d15b4272cdba6ad78806e6cdde
SHA1af7139e6b06ee30133c7ffb3e9e3a0f0b5de554d
SHA2565030f0d18f191622f6d5a0fe010949e3c8e2ffc63d0f2f76fb87340e2c29d0da
SHA5129a9f2d3c69d0f13933f6373d683abe676a75725a75380af389de91624d7f9a5033f674797665ab1a1a185491a5c9f828723b05f54935f16e0031dee86d13fa08
-
Filesize
51KB
MD5ace174d516146601b46bab25d1e6b25f
SHA120d5f3381e6a3b97a38bdcc9b385791b88392d8f
SHA256f87bd8490cbd7ac13fe81d1d04017218db88f8a3f6afbac734dfdc9e662228c2
SHA512428068e7dfce8ddc5fbb625b71168489d9b6cce10f6fd8bfd5390b2b6cc7273cbab310d68daae825fd1e75697e7d4e16fb4b0a5c71bff8096425cc6061598678
-
Filesize
52KB
MD57e6c746dcc0522d285dcaa59c626f3d3
SHA165b8434658926d7eb53aa3bb937044ee42adec9b
SHA2562b8f98783f81f7cf60073482c9b014667ab4663a7e617bc080d35778a25bf401
SHA5125820f22ec392bdfd1fe943f70e76ae82f2d3bba0721779794011c5903f36c8c9187912a0d679b440029c13a83217b6ef242242c307e05356d573226d4100f0c2
-
Filesize
52KB
MD5198d90c9de4097d4dc19ee8b342f5a18
SHA11d7512b2b6daf5d99dfde548296960cbd24c094d
SHA256b12cf6a71db741a0bf27a1371c0a78de9e6174bd75c2d945bfab36fd62de9e27
SHA512fc0bd9a21c1059b610020bf74784ab43097d228bfe96504e5884e6552db7b940361ca20a69445c42bd42bd7a3b51d3f0b2bf1fdda510a735cce39fbf0322575f
-
Filesize
170KB
MD503b044f98add31e5a2f9b426e071c79e
SHA1368eac50491d63765846dc15730a03d3865c2357
SHA256d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0
SHA512b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07
-
C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\109.1.47.186\brave_installer-x64.exe
Filesize100.9MB
MD5a4599022b5d1691983c26936f2125d5c
SHA11456be249bbf22ea515d817ea89e91d9b30ffba3
SHA25624d4198fe7204663379a308532b997a70841fe55f8b20f10536c9e6f445cb791
SHA5124464c1670391f1e4654593d2af32f0c35f1c68e4fa84c3c6e54aae85952f8429247bca22ff9babff4110876b5262411dd1bd34c71574c6b81e529b2c0b4bcdd4
-
Filesize
3.5MB
MD543a8a1eaf7c7b53c8569d8a5b4dbb476
SHA1b57972aee7518565e4eda1f20d3717d205c87ccc
SHA25690f1ce74855aa7e17a44a75fcbb356c315aabd84dd9c2d01062a27383c5444a8
SHA5129b2543da8851836a08aa185c1596e0ce23a4eedc18d04b9876fa1ee16cb8cf588886f76d2dd3b2f37b6961911af0333284044a835c3244b112598087d27e67a2
-
Filesize
2KB
MD58de7607305d5086bb7fe86274b7df2bb
SHA196ce1cdf3bfc4a8bc4145810928edc8a55d95c4e
SHA25684e52559ddded3ff4c6c9f8b006492ea577bb4973aa40d29e6073a458f8cff0a
SHA51210941bc738e3925ea028c7faad99137105e838f3bfb67a1d68f6ab22d679d1102671f4aca9b3742f3c3c0f194c811edba98dca4edb29f15b96b62a54c5a704dd
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
170KB
MD503b044f98add31e5a2f9b426e071c79e
SHA1368eac50491d63765846dc15730a03d3865c2357
SHA256d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0
SHA512b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07
-
Filesize
1.1MB
MD5fe167e5aef821cd99da031451f1a37db
SHA12b3972bd0feecdfa80cee56d8e1378c5d44d6c23
SHA256b8239acce72683344981558cda543df6c51194f6dc0b79073369a1a1707310b0
SHA512755912da93f75cf6b94a3805c01f94fe46ab5169d3787bba15a230a95c543323801d51b71912dc46f17ec1769f4c421fa71debda406a3e90ee03d2337d7f9e3d
-
Filesize
52KB
MD5c119b7f4421d3b56286ccc95fb6072db
SHA13386841db70d8b3c24f4f8a61e03b8bcd0ddcc01
SHA256f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b
SHA512f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767
-
Filesize
52KB
MD5c119b7f4421d3b56286ccc95fb6072db
SHA13386841db70d8b3c24f4f8a61e03b8bcd0ddcc01
SHA256f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b
SHA512f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767