Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
be5dc0d38251a54350c462a7f4a6c70028ee05c01bde5c1974342893bf12ba5e.msi
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be5dc0d38251a54350c462a7f4a6c70028ee05c01bde5c1974342893bf12ba5e.msi
Resource
win10v2004-20240226-en
General
-
Target
be5dc0d38251a54350c462a7f4a6c70028ee05c01bde5c1974342893bf12ba5e.msi
-
Size
1.9MB
-
MD5
2bc783b5193fa2dafe58065209be31f1
-
SHA1
7b7f31705565570dbf095a251769f9b73c3cafb7
-
SHA256
be5dc0d38251a54350c462a7f4a6c70028ee05c01bde5c1974342893bf12ba5e
-
SHA512
b82d58793679153c54106b5dfd851926aba258c64334a4a107d91bd9feb89a91e38320cc28e628b4ea7a32efe0a2c3ce401c93d93616fed1e6325383c8cf6be6
-
SSDEEP
49152:ipdSHSQrakKZFl8Zm0KmDNB1zToUM2J1m:ipmSQrecIXoNB1i2J1
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\browser-up.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\browser-up.exe cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 4868 ICACLS.EXE 3088 ICACLS.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 4 2004 msiexec.exe -
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\123.1.64.116\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation BraveUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation brave.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_cs.dll BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_en.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_is.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe brave_installer-x64.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\cs.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\VisualElements\Logo.png setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\fa.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\sk.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\mojo_core.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\cs\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\hr\messages.json setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_1608942565\1\scripts\brave_rewards\publisher\reddit\redditBase.bundle.js brave.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_ru.dll BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_te.dll BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_pl.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\ms.pak setup.exe File created C:\Program Files\chrome_url_fetcher_2072_1112775058\extension_1_0_14.crx brave.exe File created C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\CHROME.PACKED.7Z brave_installer-x64.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\chrome.dll.sig setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\ar\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\fr\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\hi\messages.json setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_224323555\resources.json brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_1833743262\list_catalog.json brave.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\th\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_sw.dll BraveBrowserSetup-VER979.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\libEGL.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\ja.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_lt.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_sr.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_ta.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateOnDemand.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\eventlog_provider.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\sw.pak setup.exe File opened for modification C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\20240410135858.pma chrmstp.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\ad0af5da-b4b7-42f3-9793-749d81579023.tmp chrmstp.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdate.dll BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_es-419.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\am\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\ja\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\6672f464-f2d4-4569-8d40-44c6e14ae3ac.tmp setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_1608942565\1\scripts\brave_rewards\publisher\twitter\twitterBase.bundle.js brave.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_gu.dll BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_id.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_th.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\psmachine_64.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\id.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\de\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\resources\brave_extension\_locales\sk\messages.json setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_1608942565\1\scripts\brave_rewards\publisher\twitter\twitterAutoContribution.bundle.js brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_1608942565\1\scripts\brave_rewards\publisher\twitch\twitchAutoContribution.bundle.js brave.exe File created C:\Program Files\chrome_url_fetcher_2072_1234456321\khaoiebndkojlmppeemjhbpbandiljpe_63_win_pz5ggrx6ddtwepg55hf2663jnu.crx3 brave.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_ml.dll BraveBrowserSetup-VER979.exe File opened for modification C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\BraveUpdateSetup.exe BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_bn.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\ko.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1144_988605026\Chrome-bin\123.1.64.116\Locales\th.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_sr.dll BraveBrowserSetup-VER979.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\goopdateres_fil.dll BraveUpdate.exe File created C:\Program Files\chrome_url_fetcher_2072_955544689\extension_1_0_696.crx brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_1608942565\1\scripts\brave_talk\confabs\oneOnOneMeetings.bundle.js brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2072_674588644\photo.json brave.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\goopdateres_nl.dll BraveBrowserSetup-VER979.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI750D.tmp msiexec.exe File created C:\Windows\Installer\e579163.msi msiexec.exe File opened for modification C:\Windows\Installer\e579163.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI926C.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI751D.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{EC86CB51-7016-4AB4-97A7-A6A4AFBFC4EB} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 37 IoCs
pid Process 5000 browser-up.exe 592 BraveBrowserSetup-VER979.exe 1612 BraveUpdate.exe 3020 BraveUpdate.exe 2960 BraveUpdate.exe 3496 BraveUpdateComRegisterShell64.exe 688 BraveUpdateComRegisterShell64.exe 3312 BraveUpdateComRegisterShell64.exe 2392 BraveUpdate.exe 820 BraveUpdate.exe 1088 BraveUpdate.exe 4360 brave_installer-x64.exe 1144 setup.exe 1284 setup.exe 3472 setup.exe 2676 setup.exe 4968 BraveUpdateOnDemand.exe 2424 BraveUpdate.exe 2092 BraveUpdate.exe 2072 brave.exe 3816 brave.exe 3084 brave.exe 3888 brave.exe 2552 brave.exe 4640 brave.exe 3288 brave.exe 5104 brave.exe 4496 brave.exe 368 brave.exe 2944 brave.exe 4920 brave.exe 1116 chrmstp.exe 1148 chrmstp.exe 3600 brave.exe 4384 chrmstp.exe 4600 chrmstp.exe 5168 brave.exe -
Loads dropped DLL 52 IoCs
pid Process 4748 MsiExec.exe 1612 BraveUpdate.exe 3020 BraveUpdate.exe 2960 BraveUpdate.exe 3496 BraveUpdateComRegisterShell64.exe 2960 BraveUpdate.exe 688 BraveUpdateComRegisterShell64.exe 2960 BraveUpdate.exe 3312 BraveUpdateComRegisterShell64.exe 2960 BraveUpdate.exe 2392 BraveUpdate.exe 820 BraveUpdate.exe 1088 BraveUpdate.exe 1088 BraveUpdate.exe 820 BraveUpdate.exe 2424 BraveUpdate.exe 2424 BraveUpdate.exe 2072 brave.exe 2092 BraveUpdate.exe 3816 brave.exe 2072 brave.exe 4748 MsiExec.exe 3084 brave.exe 3888 brave.exe 3888 brave.exe 3084 brave.exe 2552 brave.exe 3084 brave.exe 3084 brave.exe 3084 brave.exe 2552 brave.exe 3084 brave.exe 3084 brave.exe 3084 brave.exe 4640 brave.exe 4640 brave.exe 3288 brave.exe 3288 brave.exe 5104 brave.exe 5104 brave.exe 4496 brave.exe 4496 brave.exe 368 brave.exe 368 brave.exe 2944 brave.exe 2944 brave.exe 4920 brave.exe 4920 brave.exe 3600 brave.exe 3600 brave.exe 5168 brave.exe 5168 brave.exe -
Registers COM server for autorun 1 TTPs 23 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.101.0\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.101.0\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.101.0\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ServerExecutable = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\123.1.64.116\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.101.0\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.101.0\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.101.0\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5A27D85-3D4F-4806-933C-7B4E566E375A}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\123.1.64.116\\notification_helper.exe\"" setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007667065a040ee7130000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007667065a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007667065a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7667065a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007667065a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName brave.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry brave.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133572311382897586" brave.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\ = "IPackage" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\ = "IPackage" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FF255A-A593-41BD-A69B-E05D72B72756}\VersionIndependentProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\NumMethods BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\NumMethods\ = "5" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\.svg setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassSvc\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveFile\AppUserModelId = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A9D7221-2278-41DD-930B-C2356B7D3725}\ = "BraveUpdate Update3Web" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\NumMethods\ = "41" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\NumMethods\ = "17" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\ = "Google Update Legacy On Demand" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\ = "IAppBundleWeb" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\NumMethods\ = "24" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CurVer BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveFile\Application\ApplicationName = "Brave" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreMachineClass\ = "Google Update Core Class" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\ProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9AEB1CC-DF9B-45CB-B70B-084D2E869A1C}\LocalServer32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassSvc.1.0 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\NumMethods BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\NumMethods\ = "4" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\NumMethods\ = "24" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\ProxyStubClsid32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\ProxyStubClsid32\ = "{B5A27D85-3D4F-4806-933C-7B4E566E375A}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\NumMethods\ = "41" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7F65EDCA-A4BF-47E9-9200-DA0CE4F413F2} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine.1.0 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\ProxyStubClsid32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine\CLSID\ = "{28C83F57-E4C0-4B54-B187-585C51EE8F9C}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\ = "Interface {F396861E-0C8E-4C71-8256-2FAE6D759CE9}" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\BraveHTML\shell\open\command setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.xhtml setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ = "IApp2" BraveUpdate.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2768 msiexec.exe 2768 msiexec.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 820 BraveUpdate.exe 820 BraveUpdate.exe 2092 BraveUpdate.exe 2092 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 1612 BraveUpdate.exe 2072 brave.exe 2072 brave.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2072 brave.exe 2072 brave.exe 2072 brave.exe 2072 brave.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2004 msiexec.exe Token: SeIncreaseQuotaPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 2768 msiexec.exe Token: SeCreateTokenPrivilege 2004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2004 msiexec.exe Token: SeLockMemoryPrivilege 2004 msiexec.exe Token: SeIncreaseQuotaPrivilege 2004 msiexec.exe Token: SeMachineAccountPrivilege 2004 msiexec.exe Token: SeTcbPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeLoadDriverPrivilege 2004 msiexec.exe Token: SeSystemProfilePrivilege 2004 msiexec.exe Token: SeSystemtimePrivilege 2004 msiexec.exe Token: SeProfSingleProcessPrivilege 2004 msiexec.exe Token: SeIncBasePriorityPrivilege 2004 msiexec.exe Token: SeCreatePagefilePrivilege 2004 msiexec.exe Token: SeCreatePermanentPrivilege 2004 msiexec.exe Token: SeBackupPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeShutdownPrivilege 2004 msiexec.exe Token: SeDebugPrivilege 2004 msiexec.exe Token: SeAuditPrivilege 2004 msiexec.exe Token: SeSystemEnvironmentPrivilege 2004 msiexec.exe Token: SeChangeNotifyPrivilege 2004 msiexec.exe Token: SeRemoteShutdownPrivilege 2004 msiexec.exe Token: SeUndockPrivilege 2004 msiexec.exe Token: SeSyncAgentPrivilege 2004 msiexec.exe Token: SeEnableDelegationPrivilege 2004 msiexec.exe Token: SeManageVolumePrivilege 2004 msiexec.exe Token: SeImpersonatePrivilege 2004 msiexec.exe Token: SeCreateGlobalPrivilege 2004 msiexec.exe Token: SeBackupPrivilege 3128 vssvc.exe Token: SeRestorePrivilege 3128 vssvc.exe Token: SeAuditPrivilege 3128 vssvc.exe Token: SeBackupPrivilege 2768 msiexec.exe Token: SeRestorePrivilege 2768 msiexec.exe Token: SeRestorePrivilege 2768 msiexec.exe Token: SeTakeOwnershipPrivilege 2768 msiexec.exe Token: SeRestorePrivilege 2768 msiexec.exe Token: SeTakeOwnershipPrivilege 2768 msiexec.exe Token: SeBackupPrivilege 4312 srtasks.exe Token: SeRestorePrivilege 4312 srtasks.exe Token: SeSecurityPrivilege 4312 srtasks.exe Token: SeTakeOwnershipPrivilege 4312 srtasks.exe Token: SeBackupPrivilege 4312 srtasks.exe Token: SeRestorePrivilege 4312 srtasks.exe Token: SeSecurityPrivilege 4312 srtasks.exe Token: SeTakeOwnershipPrivilege 4312 srtasks.exe Token: SeDebugPrivilege 1612 BraveUpdate.exe Token: SeDebugPrivilege 1612 BraveUpdate.exe Token: SeDebugPrivilege 1612 BraveUpdate.exe Token: 33 4360 brave_installer-x64.exe Token: SeIncBasePriorityPrivilege 4360 brave_installer-x64.exe Token: SeDebugPrivilege 820 BraveUpdate.exe Token: SeDebugPrivilege 2092 BraveUpdate.exe Token: SeDebugPrivilege 1612 BraveUpdate.exe Token: SeRestorePrivilege 2768 msiexec.exe Token: SeTakeOwnershipPrivilege 2768 msiexec.exe Token: SeRestorePrivilege 2768 msiexec.exe Token: SeTakeOwnershipPrivilege 2768 msiexec.exe Token: SeShutdownPrivilege 2072 brave.exe Token: SeCreatePagefilePrivilege 2072 brave.exe Token: SeShutdownPrivilege 2072 brave.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2004 msiexec.exe 3472 setup.exe 2004 msiexec.exe 2072 brave.exe 2072 brave.exe 2072 brave.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5000 browser-up.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 4312 2768 msiexec.exe 100 PID 2768 wrote to memory of 4312 2768 msiexec.exe 100 PID 2768 wrote to memory of 4748 2768 msiexec.exe 102 PID 2768 wrote to memory of 4748 2768 msiexec.exe 102 PID 2768 wrote to memory of 4748 2768 msiexec.exe 102 PID 4748 wrote to memory of 4868 4748 MsiExec.exe 103 PID 4748 wrote to memory of 4868 4748 MsiExec.exe 103 PID 4748 wrote to memory of 4868 4748 MsiExec.exe 103 PID 4748 wrote to memory of 4848 4748 MsiExec.exe 105 PID 4748 wrote to memory of 4848 4748 MsiExec.exe 105 PID 4748 wrote to memory of 4848 4748 MsiExec.exe 105 PID 4748 wrote to memory of 4668 4748 MsiExec.exe 107 PID 4748 wrote to memory of 4668 4748 MsiExec.exe 107 PID 4748 wrote to memory of 4668 4748 MsiExec.exe 107 PID 4668 wrote to memory of 5000 4668 cmd.exe 109 PID 4668 wrote to memory of 5000 4668 cmd.exe 109 PID 4668 wrote to memory of 5000 4668 cmd.exe 109 PID 4748 wrote to memory of 592 4748 MsiExec.exe 110 PID 4748 wrote to memory of 592 4748 MsiExec.exe 110 PID 4748 wrote to memory of 592 4748 MsiExec.exe 110 PID 592 wrote to memory of 1612 592 BraveBrowserSetup-VER979.exe 111 PID 592 wrote to memory of 1612 592 BraveBrowserSetup-VER979.exe 111 PID 592 wrote to memory of 1612 592 BraveBrowserSetup-VER979.exe 111 PID 1612 wrote to memory of 3020 1612 BraveUpdate.exe 112 PID 1612 wrote to memory of 3020 1612 BraveUpdate.exe 112 PID 1612 wrote to memory of 3020 1612 BraveUpdate.exe 112 PID 1612 wrote to memory of 2960 1612 BraveUpdate.exe 113 PID 1612 wrote to memory of 2960 1612 BraveUpdate.exe 113 PID 1612 wrote to memory of 2960 1612 BraveUpdate.exe 113 PID 2960 wrote to memory of 3496 2960 BraveUpdate.exe 114 PID 2960 wrote to memory of 3496 2960 BraveUpdate.exe 114 PID 2960 wrote to memory of 688 2960 BraveUpdate.exe 115 PID 2960 wrote to memory of 688 2960 BraveUpdate.exe 115 PID 2960 wrote to memory of 3312 2960 BraveUpdate.exe 116 PID 2960 wrote to memory of 3312 2960 BraveUpdate.exe 116 PID 1612 wrote to memory of 2392 1612 BraveUpdate.exe 117 PID 1612 wrote to memory of 2392 1612 BraveUpdate.exe 117 PID 1612 wrote to memory of 2392 1612 BraveUpdate.exe 117 PID 1612 wrote to memory of 820 1612 BraveUpdate.exe 118 PID 1612 wrote to memory of 820 1612 BraveUpdate.exe 118 PID 1612 wrote to memory of 820 1612 BraveUpdate.exe 118 PID 1088 wrote to memory of 4360 1088 BraveUpdate.exe 122 PID 1088 wrote to memory of 4360 1088 BraveUpdate.exe 122 PID 4360 wrote to memory of 1144 4360 brave_installer-x64.exe 123 PID 4360 wrote to memory of 1144 4360 brave_installer-x64.exe 123 PID 1144 wrote to memory of 1284 1144 setup.exe 124 PID 1144 wrote to memory of 1284 1144 setup.exe 124 PID 1144 wrote to memory of 3472 1144 setup.exe 125 PID 1144 wrote to memory of 3472 1144 setup.exe 125 PID 3472 wrote to memory of 2676 3472 setup.exe 126 PID 3472 wrote to memory of 2676 3472 setup.exe 126 PID 4968 wrote to memory of 2424 4968 BraveUpdateOnDemand.exe 129 PID 4968 wrote to memory of 2424 4968 BraveUpdateOnDemand.exe 129 PID 4968 wrote to memory of 2424 4968 BraveUpdateOnDemand.exe 129 PID 1088 wrote to memory of 2092 1088 BraveUpdate.exe 131 PID 1088 wrote to memory of 2092 1088 BraveUpdate.exe 131 PID 1088 wrote to memory of 2092 1088 BraveUpdate.exe 131 PID 2424 wrote to memory of 2072 2424 BraveUpdate.exe 130 PID 2424 wrote to memory of 2072 2424 BraveUpdate.exe 130 PID 2072 wrote to memory of 3816 2072 brave.exe 132 PID 2072 wrote to memory of 3816 2072 brave.exe 132 PID 4748 wrote to memory of 3088 4748 MsiExec.exe 133 PID 4748 wrote to memory of 3088 4748 MsiExec.exe 133 PID 4748 wrote to memory of 3088 4748 MsiExec.exe 133 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\be5dc0d38251a54350c462a7f4a6c70028ee05c01bde5c1974342893bf12ba5e.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2004
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E58F3CC8E263E093E58485402A23FEF22⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ea4271a8-713d-4099-987a-85975499cc5c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:4868
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:4848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MW-ea4271a8-713d-4099-987a-85975499cc5c\files\copy.bat" "3⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\browser-up.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\browser-up.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5000
-
-
-
C:\Users\Admin\AppData\Local\Temp\MW-ea4271a8-713d-4099-987a-85975499cc5c\files\BraveBrowserSetup-VER979.exe"C:\Users\Admin\AppData\Local\Temp\MW-ea4271a8-713d-4099-987a-85975499cc5c\files\BraveBrowserSetup-VER979.exe" /install3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Temp\GUMA009.tmp\BraveUpdate.exe" /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3020
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3496
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:688
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3312
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xMDEuMCIgc2hlbGxfdmVyc2lvbj0iMS4zLjEwMS4wIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU0NzQxNjQzLTZBMjktNDNDQy1CQ0FBLUIyQkY4RkIxQjM1Nn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MjQ3MTU2RTUtN0Q0OS00NDExLTg4REYtMDdFRjBGQTcwQzQ2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTAxLjAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTg1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none" /installsource otherinstallcmd /sessionid "{54741643-6A29-43CC-BCAA-B2BF8FB1B356}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ea4271a8-713d-4099-987a-85975499cc5c\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:3088
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\brave_installer-x64.exe" --do-not-launch-chrome2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome3⤵
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=123.1.64.116 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7c563efc0,0x7ff7c563efcc,0x7ff7c563efd84⤵
- Executes dropped EXE
PID:1284
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=14⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\CR_3347E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=123.1.64.116 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7c563efc0,0x7ff7c563efcc,0x7ff7c563efd85⤵
- Executes dropped EXE
PID:2676
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xMDEuMCIgc2hlbGxfdmVyc2lvbj0iMS4zLjEwMS4wIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU0NzQxNjQzLTZBMjktNDNDQy1CQ0FBLUIyQkY4RkIxQjM1Nn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MDBBNzUxODctRTA3Ni00RDY1LTlCMjYtMDg3MUMyRUQ4NTVEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntBRkU2QTQ2Mi1DNTc0LTRCOEEtQUY0My00Q0M2MERGNDU2M0J9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjMuMS42NC4xMTYiIGFwPSJ4NjQtcmVsIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly91cGRhdGVzLWNkbi5icmF2ZXNvZnR3YXJlLmNvbS9idWlsZC9CcmF2ZS1SZWxlYXNlL3g2NC1yZWwvd2luLzEyMy4xLjY0LjExNi9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTI2MzA0NzkyIiB0b3RhbD0iMTI2MzA0NzkyIiBkb3dubG9hZF90aW1lX21zPSIxMTc5NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc5NyIgZG93bmxvYWRfdGltZV9tcz0iMTI4MjkiIGRvd25sb2FkZWQ9IjEyNjMwNDc5MiIgdG90YWw9IjEyNjMwNDc5MiIgaW5zdGFsbF90aW1lX21zPSIzMjM0NCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.101.0\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=123.1.64.116 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffca4f9ec50,0x7ffca4f9ec5c,0x7ffca4f9ec684⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3816
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3084
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --start-stack-profiler --field-trial-handle=2136,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3888
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2352,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --no-appcompat-clear --start-stack-profiler --brave_session_token=5124794315489563505 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3372,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4640
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --no-appcompat-clear --brave_session_token=5124794315489563505 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3400,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3288
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --no-appcompat-clear --brave_session_token=5124794315489563505 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4092,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5104
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --no-appcompat-clear --brave_session_token=5124794315489563505 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4516,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4496
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4156,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:368
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1116 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=123.1.64.116 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff77a27efc0,0x7ff77a27efcc,0x7ff77a27efd85⤵
- Executes dropped EXE
PID:1148
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\master_preferences" --create-shortcuts=1 --install-level=05⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4384 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\123.1.64.116\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=123.1.64.116 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff77a27efc0,0x7ff77a27efcc,0x7ff77a27efd86⤵
- Executes dropped EXE
PID:4600
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5012,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5252,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4920
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4988,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3600
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5576,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5168
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2424,i,16766281494124116145,2863530273270169692,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:84⤵PID:5336
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:1500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD5063d8f06fc1a3fa72778ecda5049c48e
SHA1a3d29ce1e5903d10f678be50427d5b7f6cdb7d30
SHA256728d340a78658a2968b34d8d5f8f4ace2ef198b7bbcbf338fc7c33652742d634
SHA51214a3527409412e81e5d07548d2ea55c3d11e7907342ed8c2323fe2fe997a8724861808f19b5117ac3060de5069fed5a80471ade23f259f995852a2b79ac09158
-
Filesize
365KB
MD56df2f69f038354091734bee903ffb8b6
SHA113d77fea20151606cf8ee9a939d3c4a17d729be8
SHA256956d9ea3ede39de0b158eee857d1a459ee4d041daad75263024fc43197f64329
SHA5127d0daaa6889284015fd4fc73958c061ecf2563cf015160398cbcdf4dfc2b7f4bd9d359e61220efef3a8f8d796b0344089461e6a491e7304e2c3f4d7795ec9015
-
Filesize
158KB
MD5ba13bd1318d0ae1b441bab405d051ac0
SHA17887b25a4a5a3764d466537aac0b4ed2cfc61fec
SHA256e204bc6ddc8a0c7cc24349aceea633baf46d315db172f153c1a1b4d059caa2e7
SHA512218104921ffc0008ba5ecb6c88e41e2caad4c68eb74970a858555d82288c28beb987cf66812bcb2488a803cdcdc3887f319661723385b0c5bd11f7098cad6ce0
-
Filesize
176KB
MD52a3bb8908f002799f194a26e048933a2
SHA1517a2e82385797c05c47e7c34aa891a8850b8563
SHA256b1d4b8a40eeecab0399e16e6fb8e4dfa1b21509742bfacb949533c893da07bd3
SHA512891244d5a8647532a11d008ce24d9a09d3ce9c175e0d8452006fbdfb1c8443b2ddce05662928e3f18395bb3f4ea30798a977029b2066aed734e66ab6ec3957ca
-
Filesize
208KB
MD5c2d6c88423171cc951e794e18e394cd7
SHA15cc4823aed0c0d3e1b0109f5dcd91ec5105cfa9a
SHA256b272f392934334d4e6c2a6526a3f274f43b96f51322b4bef37f59c438787b646
SHA51252b0f9ad19e9938c0ef1cd112ced73f89abdbccb339b734988e702f7c684a0d2dbac4275ef67658b43c5c32ba4dc981d56f0e6b800c40973e2622375ae8d506d
-
Filesize
1.0MB
MD50ea93d250715a225f334faff13b32e86
SHA10e3e44d4d9a21cfa6b47a734ce30266ae5e7bb04
SHA256a00d5baf5fe3aed1d864e56c7ac847cf06ad2b02c63e0ea33c77a0d254311695
SHA51213aa7e3e0a07e3b39b1ea591ee5757910a70d7204a9e9bfc9eb0cfe78e70ea08f8c11d4e6a33f69ead86b544f18677b38c2de9134b7ef9230a1a55cdb0058919
-
Filesize
45KB
MD5459cc5bdc5c12e1c709b5d134327122b
SHA1eca0b45f61a7d4f3a897345d27577e58217c35fb
SHA25699702a5df6e94ceca75dbae44edf1b99f3eb668062ab21f775851f121125adc0
SHA512a2913e884c8cad52f01973a811dc16a97b0d79b1aa7691ae353bb476a0c1203d2c1c6ebbf37253f2a674a9f5ff3a69df4d589be1f4946f4ff210e6c9fffc7fa1
-
Filesize
44KB
MD50c64b2b0eaef9cf0822e7ae9325efc27
SHA11b65b3d50481e003d2efbb4e35e231bc5529eb70
SHA256d11c3fa05de102e9d47e1602217ca8e00d4832fa5b275eee16e4161b8863b018
SHA5125b0c9857801cf909eadde3c698847fdc17d21eea971a435b119e040406f37ee27c1b5a1658fdb0fdf48acd7fb1f9a4cbb04e1eb1059ee16a115ed83b35f86aab
-
Filesize
47KB
MD5f4fae110b3fa38ec03a47cf7a0977bac
SHA1e693ab743e77789ea768dba0b9f8cfc7863997fd
SHA2569fed950cbb4a5f9acadb24bca75b09eeaa37cb58e5c594bb06357c495dd81e1e
SHA512dfe106f5322b846f29e8ef0ada2f65920f52732c96e7018a671bd3ea68aee025ff29c34ca79f2ff759df31e260edcc502d747cc42da5a6ae8e65a59791fb0c9e
-
Filesize
47KB
MD5d257ac31a2c008eb474f102c4fe1a525
SHA180244cf1cf076b0c4375744e3cc6624b67a06e95
SHA2568622a1f768a812ee351802e286f7ece1fc8327e0e04e53d5bc39c00b3189b8f7
SHA51240c8705c4ab04abd7f92be3112d97a1d3d21008c0da48267e01b9335decfa27d9c7313c8447ff89b02066b30d434daa2c748b950b5872ba73114d543f4b268bf
-
Filesize
47KB
MD519dbd0d44e7f68f7a63f8fd77013ad0e
SHA173a7ab2e5051fdfd6103144389f69eaf9b2ae3a5
SHA256700d43e8703cd6d8dd4b0bba57eeabd743174e86102f7207267ba3ed7e9bc04b
SHA5129cebde40eeadfb87afc5be3d4939b864b5fd06e322aeb79ed1f365828314fc58e5ce56a0d2bea32792707b980579fb097d2879f435d80892dadbd2b2f63e2112
-
Filesize
46KB
MD59888f7c09e0660f4a30e776306c9e375
SHA10f2251cd44242bbdc6725cde2a730c466ef61568
SHA256ff2819eaef8634c8b800bac452b2d078dc92306aa030bc887d6bc0b542783917
SHA512b9147512b15332c9970fef3071f56f38143b1a27ff4446e52aba60fdc4e2daf40dff2b0e5b5824925530356747226b467d1e1a6e353697ff226baad39c2fb828
-
Filesize
46KB
MD55ed546f1887746e4dc16497fada602b2
SHA14cbd9bbff07e5657dfa8c598ef27085ae60b289d
SHA25607931d750c760fc026b1e508c9f2ad428ef56054e8d3b1856e15947747d22bd3
SHA512e2c99f262f235c39d3505855b099c9a5913ec14baf03352e72e64da6b80de107f5d79abea85370b243bc5ae57229289db2e8b73521408e203eee841dd1954c72
-
Filesize
48KB
MD5ef002d9d7e93d598f7f0a90fdc2a3ef4
SHA13bb49c87a555ab8094cff09f4c02d5a8293d5007
SHA25687b71c421f40184f964f14689eb32557eddd094a02e13ea3d08e2bb7a57a3828
SHA51260b33096d89577aba0cf2965b87e6a7e8fd8496cae9f58a4b1501f49f3a93b75eb2c62dc9a0a5b5ee4232943c873f82a78b6425dd71c4d208037369c10e826d9
-
Filesize
47KB
MD5ceb401f9e6193038518df82ef58ce4c4
SHA1d2db5b55bba82900529abfd2a47722fe39d78340
SHA2567f2c9ef3ba263909dd59d3d33483cd10054a219a91d38be79356edda5a23fcaf
SHA512e1ef05ca19e3cfab565760d1c3ad0d66e392aa1e3b445455df51262f88e73148ab6de6deb798a1e7e338d74b9530a612a860f5d134e694fba2b46d76530d0e50
-
Filesize
45KB
MD5907e7166f59a8f4c7434532cdd4362c3
SHA16f836bfa84fdf87129082990f377e69dade01c91
SHA256184f753d0ca1759043b5b4be6a7ab22f39f13c97b39d39e8a847ff64a0f75619
SHA5129823549e5e334f6b0d980c6a3a37353443b29e5ecb306f8b1988c91076bb1835f4d9e25560b846564cd24c9f96029f0a706977b9b4b99ddfa62d5d7506cab06d
-
Filesize
45KB
MD5e7cb8a13169f572f1e727fbc79b2bc8b
SHA1c8f920c371100dafc23370235b4071a8c91f6028
SHA25680fbbb89ea2f89dbe35fb36707f82abe479c9de60d105db5e9258b88d5e85d5c
SHA5122c92b99c8fab3b5f90d78ddf92ca6ba6634ae19117ddf5ecc6854719ee391edb7bc2d91ee7b5767c7a87d98e1517aa2cda18ed867e4a61f41771af97734308b7
-
Filesize
46KB
MD5664ed8f5e1141f526062576e57a6b839
SHA181bcd3711bd4659c5fc98703f27b911641febdc3
SHA2562902de20c7a6e715a9b761b231508bbbc4cec06d288a659a04b545b26051417e
SHA512165e80294c4766fe5afb655fb55701502b93da2c8e330bdb54e05108d02513ae7fee569470193db97f6e50bbfd5fbc236f35d2b8a633a9d54aa08e9b77259cca
-
Filesize
48KB
MD57475e2b5143b2f15e282569584cada5d
SHA100b174bed42fe12de34f74a40d4e4477e332f228
SHA256e34e45d8a05c3398b3be4f67f082ca76f0d35d93d97ad9f261ad225f886a4b7a
SHA512d68501bca95633855686b2d701975df7c695dccf87235bce40495c46326528a959e1318bc93edaf95d22b5d8290e6ce2f8715afe7c555470c60294feaf4c7754
-
Filesize
45KB
MD5fb5c0ee7ef213a77cd494621f2e2bc1c
SHA1f185f4b77cdb95afca30e0e7047b0d79f98eddd2
SHA25665079a6993fdc26cb99cb97fec0cdb1fe953728da629206c79d3e0e33b5fe4eb
SHA512d828003a50bfa93927b5867eb4c00912c2bd762def0a51358af35f9aed0aa3bf95848388eddf46da0ab221576d4c0c15f76d633ffdc570d7bc8de57d77a4ac42
-
Filesize
45KB
MD566a54e75fa330d6f2d83e779dbaed4a3
SHA14366abd29eef6538d033bbb20afebbec856e87d7
SHA256cbce95090f5a3aedffde646474855b4f99ff9ebe009b41159eebb84d934c0f70
SHA512d231178ccfff0c21f587e782f0a4b69ebb062ada89637cdc122c54225f602b1917db16bfe8f46db0e6853408a569516d552680b894c757798b17f791789f0b82
-
Filesize
46KB
MD5c7aec16828236f0542a5feef7a335289
SHA19d91047bc27dcbfbea62790235f91d6601851432
SHA2563f395c1ddcf679d6ace0b3399ed8a583c0e0555d5b744f76a773341d3d61e6e1
SHA5128084a35b476a8420e40d7afe11c74a67523ac61c2628614d20e2e0d9ac5fcde37b11a84ace660ba1fc6a61bfb23c310a58a99d6caabea348e5e887629d8f9a39
-
Filesize
47KB
MD57642ceb2c3b0228d2fcf5a09e26a7b51
SHA1bf3e6d68e5074b1c3176861eb1abd4e380f47c6f
SHA2565ad881b74069050b4a4106337fae283cf11033fa7c143999f225451053c4d326
SHA51208dca94a2f04edb1f97bf0461407f9e83125bc1856d1a466ece4c291b6463c8bcdc534eea7d7929b426264f0ae1eb10b0745760200cddedbf97bbef71f854cb0
-
Filesize
47KB
MD5feb29b940fea60cafa7b943b20dd1dc3
SHA19d0eb6e22af93b229665cbd16f1152805f7e9ea6
SHA256f0ef061bcf86b2edb7518c42cbc059960c5cb7786589028f5f6e433bdcf27341
SHA512091792da752b2b10d2af72cfdcdd1a26a73ded8d2af40e946bd7d77db0af61be725991cd79da603d0d42e01c5fa86cb3122e93e806fd9842d1dc2706b2c8a617
-
Filesize
47KB
MD57318bae423f57ec1874bb88e67bb1033
SHA1b9f57803a80b21dd2a4728f9027a8e144c360b8d
SHA2562d7cba572aeb8eea6f2b074ffd44fad28c1570dee968aba79f47613ba7cb8d9c
SHA5125f929f8e8096534dd15bf6a25bc163bb0c10ec92831e128c1466f59c1ca03a743c1b031548f799c16624d956473dcea7d2ba19a0b81e30a3f27d7736b0d6bcc5
-
Filesize
46KB
MD5e39ebff3af584d2ec925cca1aff90347
SHA147449d2cb7f80803f6319de31aaa4caf4919a97c
SHA2565c85ded9c6615da3d3a6e37c934b4f067a7b6d54810e0b26678658ad4fa0c69f
SHA51272796510fda15f84b620dcd9de262059336413ad2b278102daea8f79e1e057f75baa2ff2bf3120b505f7a640b5a10cbaa2d36ed85144b7087f18547d97722354
-
Filesize
46KB
MD55ba35641bcb53efb5c78f0f3f8944ecf
SHA1ddd96edc00dbce6f1ab21b38f4f7f88a5dfcee84
SHA2565ac86db141d968b952753d5dcbf39483de9f34f9eda895cc752dd1e3110a9250
SHA51205614aba3dab6c2db1505011619da3537a1bd4fc1030e216884b1741bf057190f17b6fb7a6a57bfcfa1a9c8826da7a055d95a00aed39d8a7b2935ccfd417d84d
-
Filesize
46KB
MD54ef567fb95af4d46d67dd319ee05dd0b
SHA1fa920ba29f1571b3cad54f9a9e52baa8b89ce0ce
SHA2565e8f3e00ca8170c125a3dbcdc887154b24aeb3b8bc9e23d6960acea163c3e40e
SHA5124d6cc7bafe945893f37ae57362e49ae573df994bada8c5507678524bdd3c4a47ed4abfc2a255142451df767577b7139687556045d5a46c841a7d579acbe58cc5
-
Filesize
45KB
MD57e921609b4281090ccddee4bd0198ecd
SHA12ad50c2ad23ebdf047d15a0b85ebec32d2cf4194
SHA256295646c23e3a389c81498971e5580e5bcdded3c783508c976998a1c95715c002
SHA5129487d846aeac1f9b2435ef05612b9a8bf630a460c14e1cb8b8bfc3229e64c0b8108c6901a1a2fe4dee9a9dcfc19558665f5aa25a1525f7eb4bcee4bd1e432d45
-
Filesize
45KB
MD5e0a97258dd76f335b7c61af4005ee8fd
SHA14856fa8eed75f88ba80323451ead1f1b94718416
SHA25629a93bac3351b2331bc4c367b1c539abb7ca66ae0ada3a5977420deddad96593
SHA5128042c665affaba97bab230e24cfe7c582e72a91700ad6d962aa61034b44669f3dec9411a7de88055bbd3a6fd98ee67f8b21e6af6a535d29608e21dcdc6f9abb5
-
Filesize
47KB
MD569d8a5bf42a8146a59a81939098a6f76
SHA1ef9c25ecfef768533907529e7e563deeca0fca70
SHA256cfaafa811b73ef124e49a7510244ec8f304ae5cbd956cd8fd7fd39d0a18b3cc8
SHA5128abb4028d92a0ed32fa1c12406da741a9f59bb18442bf506ca934fa81ba18004ac473f31c036f4d0f681f242638b523fc26e75c1dfb39ac5d55a3006c4c5d868
-
Filesize
43KB
MD5b57bb819c0778b7e9c72735001826bf2
SHA12d605bf1fe832276e3b782e84c60415f0874fbd1
SHA2564a8b187d4cf189e2cc276008ba7cce8fec769b45272e25caafd8c62890615674
SHA5124bc5570d1d338d025f77527395994c13913fe65bbd8389bfb2b5016b101c1cf25ba61c41a59afe46b0512d54c5464c32baab2b60cab974a0357e908bcd2ba109
-
Filesize
42KB
MD5da0b0719fcbd0876f3df569fbaafedb6
SHA1c54a135864bfe4483b70d6630aeef40e98ce0280
SHA25632d0c766ed731ff8f14d0faceaf4dae00947dde607e6d554dee3bd6c732973b8
SHA512c85e1ff78adee90af523ff8a9168fc43a9e05ee4e925241c8b6fcc13f06466330293377e340cd42361cdacad44c2abaee3808b21f0a9f99893c543bbe217891d
-
Filesize
47KB
MD5ecc4908186ff9fa7fc5698f43caa4f1f
SHA12a899699d134a59041c3d123860753adbc093be8
SHA256fa1ac2c9d68546ae96c545d7663428c845d3ccf278d9b0468443343a3d395122
SHA512ce06e6b8f22ff98830f63e71c896aaa9a1bf312495b2a4912963e37baea7d061d3a07d12fdf07e1edc3881575c9b51bbe54a8e370aa4d5c6aa361c1b9346e685
-
Filesize
41KB
MD566ef8d10713aba71338feec4795bae18
SHA1715c5962c47dea045e546e60ab95ffb30e27733e
SHA2569e7b5f5764fd303413d14ad3644aa4bae3e165d86e57b3a75d79e159385b1155
SHA5123211a99224f4b243ff3cfb6b4ba61c69102a64527d8bd41211fd94a3de27b6ddc9269fd313927a16fd945318738e8d4908c682de3ca271d32a33da0dcd684d21
-
Filesize
45KB
MD57df8ad8a6020a995d6dec6dac526493b
SHA1cd03591e155e80d465c4bf90c087c11d40a39daa
SHA256dd1dee2f146d8e252819af2f888863b07557f5f622c310f8512ea21933eb6d2b
SHA512804fe2ea4fa6069a195457f2752f9cfa8d695c86507ce782c530a8199c8c7b4671a0460503d8740bcbeb35114a6077b36b3c29decc96df22e874fe1e51254923
-
Filesize
46KB
MD54fefd8b661639eb356618dce060f028a
SHA1883dbd0c246ad91e14efa3fc38b9929f0f3d4d2d
SHA256cd21b825ba6479e67f00c031d0e052795d13a2be4b9c0299d8e1ac1eef558e62
SHA5127bcc001e3087a90fbabee902b7ec8cc6a8ae09c0fbe7e298b79a1bd25d0c58ee576731dc9cc1c8c9ffde7066c5ad02a37feac8b6bf4e6186ba87704eb5224ec8
-
Filesize
49KB
MD5506b807f58fb1d691fb66cf94dee9521
SHA1398f0d9a128957ae264b896e724fefe167099e61
SHA256286ffe35c55a28562996003428789362ee83d2922f1eb718b42ed3c84e7a8052
SHA512f20fb552b1f4f1dfa4dda5ff9e2c1771c1d731aa254bd0bcc886ef8ad7ed77538a536b409a1513b7f92d3f81f410e4b754910c66cbfe37da38f11ab8f2025968
-
Filesize
47KB
MD58946192390b804b2298f6cf6dc5194be
SHA1b1fdf7d159516fa8c7eafa404a4bc3e841773019
SHA2567913de660c6f87df576337b0bccf1f3da66ceffda4aaec49cc23f1312e715ca9
SHA512df631b927ca6d6bedc2bdb460e10cedac72975ab249f6451dddfcabcf3b41f57fbae995efd3d2ad4eb8b8d235244454b9a67b3f25c29b4a4287bc62fe25e8d47
-
Filesize
45KB
MD574e2a47d925669c86ee5527216c6e558
SHA15ffe411d0600ce867f0c5e287b49fb861616935d
SHA256bda87e8b4a353e6e74b2d500303991306624ea4f13a86f370c1ed2ac21184daf
SHA512403f50d0578ac5c85b01552ac439a9ad2d29641d7fce5d9b04d46bd08c3409313662195b7b84dceb4f282d85b0e52c0ce5bdaf89dad24b7336410215bc47eb2e
-
Filesize
47KB
MD5e8a935a73c3ab63a5a34d0d70a990d76
SHA171e1d16c2a91e4f4ab1364f70d227e22c608f4f9
SHA2565884ef775deecf19642fc4a9ee1414077afc3665d3584eadd03057c6f7623131
SHA512b3b81ef1118b3fc128599c727518eafe49972cd74147f5cccbd60629a7924368f88f1a1b91a70c79412cb80cfcd387d5068f17309ae8e6912c50d7d30f7e8075
-
Filesize
46KB
MD59121b0fef20b7627184c64ddfac947e3
SHA190caa41d7d4b47830975bd673f45e68d2cebcd9f
SHA25678a882229ca5f5a8cb5ca2b5eb920c4021ea153e09d304870e8c4ebbf598c5e2
SHA512e02bdd71e4af3afb1710b32d8ec1860ad5e1682ba58d66aa02eeb57ec5b36ea238b0bf2cab7e9f10f44e7da21d2d08d4ea357621638d577ac5e73f5a0ad8c8fb
-
Filesize
46KB
MD5dd7567c04ff8f6d4c86f299f3e09652e
SHA127336b9c8e90374c4fbc15a80b3e5d73a79381f7
SHA25686e023948c2fc795fc2b747403772171b7c3524d8fab36be6f114795968189f3
SHA512056a8695ce7866faf051e9384e6abd1888c68b2e8ca550ef60892274492c3bbf3a4f6f0381943215bf4f55bdf285eb51593e7e6b5fa8a9dcc35797f9b044da27
-
Filesize
46KB
MD57e729dc920528e359de063d56c3de178
SHA1e93e6222d91ec5e49658966ff89dd168fb218b62
SHA256c62180815f87524e01116473120c687dab1f2f6c4dbffc987d30ca8700be7991
SHA512d7bb4e0947732c1e6fb9ba3d8a68c81f8f397c69719e394ad78221d87c14207c0260310cb8db2cbc4dfb29b039473dc9641263864a39bf1176f35371583082d8
-
Filesize
46KB
MD5a09893b9e1427e88a74562226d6c2ff4
SHA1418830f9b6212c5d73661657491949621824026b
SHA25682cb861f8f05148f95b6adeb7d396ea3f1657d3d73fda681f118529a4394cf3e
SHA51246dbf0aec8d449efa2aeb1dcb3c5ff3473b84d0fd8bd8f4bd205cf8cf39b9102c5366b105ea5170ae09f915391dc8d9962dc35becb9b8017f401f982a61d5428
-
Filesize
46KB
MD500e5f1785ff1ffef2ca9730f32c74121
SHA15290da94479f70f4ce4eee12a28701c99f47c72d
SHA2564bffd78788383926085797194fb558debb66e005454b00e7320573f42c4a715a
SHA512b900597d7df4e3601ea94e3097c5e660096abda1308db50231942e816d08540dde794dbfa7562d6a77d5fb9777b24d57eda5b9647c915c39dafe165d961fc5ee
-
Filesize
45KB
MD5f2478199f66594735f185509d0d2841e
SHA11a0eb4e532d8c4bd719c1c4530cb12676faa3005
SHA256c0f5871dd59e1fe3233a12c52f55df73fffe41a2848edf60faedd5c75e64791b
SHA512363c975c6f5138825dfe5fffe9f77e515050989bd79a30ae00f21f58b82d29bde2b7bee16d855af3a2e47d7d0f147e93458cf1ddf6c934810a20eb1fc1f6c2cc
-
Filesize
46KB
MD5b9c0cbc9e52903b924afe951667a1c29
SHA13c6dd4061b1405f7268485f08c11c8dc9b4fc1a2
SHA2562410a91a46e7269456934fcb01cbb72ece10b5e6a2f8c4a08be67cbd50465745
SHA51236d4cff4ba45b6cdc65fb9b244e9201574db8caeef316243442996f1863d3a31786fc2f23970a3a13a46d8c9abdbcd5905b5b4abd979b36ea44e1cd13fbe4088
-
Filesize
46KB
MD5789d5a14ab21763522cc76ab68c92fae
SHA1e4c72d3ceabb9799743f7a619712e70cdfbc6930
SHA256c20b26a2c5e60082776f1d06b0555692f4edd1a2736fb12b5d6e3e9d0686e0d0
SHA512553dc857928e76af83ce0aa10877a03e40164465f6ce9dbd2125205e4fb659037b043c5fbd4db846c519be2484a080a049fa9f91f4950941a9fe535ae4dcecc3
-
Filesize
46KB
MD5f51425fbdcf5d239aca28b1fc433e583
SHA16c1c2545a4ea10452dfcc422de20ca09f31a4903
SHA2566e093e6954d83d486f64045c83c427e48ed99b539fcc105607bc96c98bc62952
SHA512e3c99f1ef2a96745880f5d93b1a6eb50e74aa4d76de269dbc85c91bb23ad1315eadbdbc88559e7df5ecd4f18b84f696ae3b9878aec9b4f24f94896a7b3430677
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{F606966A-E73B-4CDF-8FB1-888ACF4975F5}\brave_installer-x64.exe
Filesize120.5MB
MD5932652ed1ae498b4ebb88c8852ac34d5
SHA1ee586d573ff4f2d6dd0c91ed59a7a18a7e24ae5c
SHA25678803d20877557e9cd11558eedb5978d505077b46f2dd4317f565480ce6113ec
SHA51290d53a71188ae2abbef1ae9f850aea16f0677164face387b3601332d5ed5a28b99bdf4e0e8c7508173bb51467f4b911227c60cb839e86c39db0da28161ae5bbf
-
Filesize
3.5MB
MD559bd1b9e6707aa671074d63edd2ea097
SHA1faa991a9c0d00299d026c4025c2add258c7e6942
SHA256d1a1b1c0d11a712dd297b52a266b78cc778d0388ac982e07f2f1296207429cf6
SHA5124a5ffddc99588aeb3bff72b81d67ab5ee70a8014e418b080629e5dc23c7251dc3023c297c969b2ec1730908f1dd62789296802ca807784ec6e24dc66c6d97ec2
-
Filesize
2KB
MD5fa84baf1f4bf6538ee55546fd0c3bf58
SHA1802c7dc6e402a38bcdb93385a88d8064d9b4195b
SHA2568570210d2ada92ddc8e0b19203f2b310db69aabc54f4749a951a5d9b2d742483
SHA5124c2a5c4964f00754c1112406042f2649cafc2a9a3746be805d8a6dd97c75c4febdd6eb6aaafc78588360bf156dbc7ef0c9111274ae64c94816fa400c2ed6cbc9
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\ad0af5da-b4b7-42f3-9793-749d81579023.tmp
Filesize520B
MD5d7bdecbddac6262e516e22a4d6f24f0b
SHA11a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA5121e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
-
Filesize
40B
MD5b074de64e6c98c65c66b896a20546775
SHA1154ec10d9c5b93fc78bcfdb9941de6914ba7a715
SHA256d27a552879d6b84c1760ee044cef353f9d7492a99e77f371ca8eb845b045acc8
SHA512a22cf20af89db7562cf3187bcd11c2aa9b7cb4a7418f58beedadc3e65d2c3d1b742a466f53fde15175d453c9842c8b15f72db85730e9debae58c7664d2cf9cfb
-
Filesize
562B
MD54e20b15c2b940c19e0c476997ce591e4
SHA1ee2d2091242eb8518061e627f340a4ac51bd1e0d
SHA2565b4dddb85886c3cb5f43189a75ffca677d97c1b0f073f6682efc394b743e2904
SHA51256bb6f6fba20d9f11b159e6fc9916cdec68b7c188c4d54211d74d9577b2f4b289135eaa48922ee8e2df6491a69c3958534998e0a9927d2d5514487a2d6e6d422
-
Filesize
564B
MD5289684890b87ccede206c660789678d3
SHA1020ea5b004c30b1bf7c06861feb6e03cf654a1bf
SHA25649b16751605527743ea1e8f5ee015ca4188630c3cd57ba4a523a8188eefbed10
SHA512a3cabd1670ee7bebc184cb00f60952688fd50aab43407570104504b9c66bc342497dcf442e6000cda1d5bc55d575c2cea1eb924caed518815687f8d973e9db87
-
Filesize
557B
MD5224e60635fa97c55f4e98369c55277ca
SHA1da14de5af953186389222439bd544a6a9b71147e
SHA256ccaa30cb7674dd834c9e80911e152d86e17ff076c3460c13c5c46af26c236038
SHA512bb3b1d7e4f090f0920515e83b498d5c6f8717edfa4b738eb1bc58565ceae352bac6a834031fd07b10e6eca3fa1fee5680a5769b0bf16b02ad6b9c3128bf5ebdb
-
Filesize
546B
MD500d489c9ed228ae1802c00cca1e8febe
SHA1dc77065b35354e6a369a155f6c82b34b37f35676
SHA256fb6c5c9ef3cd3808e292a7412a77e1e855b0c93c043e5102accf37538adce4cb
SHA512706eb92c0b8d147bb039d3c9e4ced49db2298f1aba9769b29cad3f153b1e6a561245d5122b9133ddaa099a52974bc7ed301625190c99961fecae519f8c733fae
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\d0f18f55-8cc1-44aa-ae3e-e2a87f0f1667.tmp
Filesize165KB
MD5bc1359a54dcd9989c0e299ff35bd2683
SHA1952dda3536d912217f9964b0a9653fdd622815a1
SHA2563bdd0f91e0c498bb0c968b18917a48532c3958cf80711a4f6ae1506de1b6f072
SHA5124398af7fd94b0ebd620756d62eb30bcb3ea5b1fc5808c3df5628d40627d9739d9dafa8bac9f52207d1230a6783847b6d37b8e9601173342776ce319d4f3ee8db
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_1352054990\manifest.json
Filesize377B
MD51ee6fefe3b23c7c7a8059c979886b744
SHA1aed05f078d9b3da40e63a991ca07e36c99d67633
SHA256ce710effc16c600f9b09699c3dd82c94ef60f63c98411d14dedb6c5dfc201d28
SHA5129b609cd8afbcf2c53cf71dda6c235914155f704d7119090658b55ed96b28c950c110cc4a2955e0780a2efc79ee78bbf46a15ee65d7144ac991c6748a3f2892f7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_1882472764\manifest.json
Filesize385B
MD56f26172981ce246f21dbc1d853ec9433
SHA1a5461d9a26128670f2e2bbef2d1e7578f672a183
SHA25621ca7a61f92685256d98dfc78b9844e7ca784afa51fa5530a3dbd3ee6d79ed6b
SHA512bdefe588284e50e42abb743f3d04171823d2893a6d188cc95118be7dd292c6cd91d3eb827b54d39858698cb526b8e75648688b62bc463759e5b95b04fd09b847
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_223866861\manifest.json
Filesize349B
MD5c2aa2d6bda7acddee117477137bb0163
SHA14ef6fccff382121d84c22101a7f4677cf056b22e
SHA256cc55f3872699ff7cf5412491264f129c15738daa070001ea029cbf0a8e97dd47
SHA51234f28a91396718921fcd6e77a08346720edff952ee77485c9ba76e2839d1f780df2e225b5adfa2dbc55d68fa7f731427bc52019a93b55f2f5f24cc29dba49221
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_294810003\_metadata\computed_hashes.json
Filesize250B
MD5fe5222483493fd135f737ee8d96c6ec9
SHA1f78f932efe6131c8921262ae9ee131cf70b89444
SHA25646a8f292cf4959371f87fc099e09fd279452654e56fa603299f7e512dbb010ab
SHA5129a6d1f04cf4789a2df6d572d5fd516ad8b412530c86b4cc22588ec2405b5ec8e7bd15553aa2de01c37b5a8af5c3c7504c0251aea171e864620180230018162cb
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_294810003\manifest.json
Filesize408B
MD525e45b88de59ae31ed14c753d0ee98a7
SHA1a1193ba5afb2ec60d42b36dcb6456da21555b1bb
SHA2567b65ad26e9cabb61c61e7f1018632e36fd342c29c1079b83edea2114b0d60c31
SHA512a7f7e538f12d65b93af9d926b330ae0a3ba9ea547724a5a7fcfaa8bed103d1f3813fc12115bbc56ff80c3da384b74244ce37e58387cce9b10a1ccdf2f779b29b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_63882826\manifest.json
Filesize380B
MD56d68bb758b3a522bd31ccae240558a1e
SHA18cb3b932186ebfd919577d18dbd86e11b57a18bf
SHA256359e9e4eb323d43a311f38d8edba6ad8b399a5c4d014bf2a91d38142ef1dd2b3
SHA5121b7887bbe2b76e5201bbf153cfb19c8be860fa1e3a6959335eab6d757debe4568639a8da2574064510ed2a8101542d2abdd01c5c9a35a0f8a3744dcc6fe7891f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_858092167\_metadata\computed_hashes.json
Filesize250B
MD535be4f9b728230644568bb742bc8594e
SHA1ee4718273b5599b297bbe6917bd374ed57f49732
SHA256d8bff8ba892ed75a5857dfde7aa24ee5194e31cb64488a350299db9716887287
SHA512c16a9a34fab820616f386e30862bf4928fc271dd8a91e251daed65ab781751bc4ce925172136fab4ff87d4a4d2f6481af18544feb13ec2898e5585a594476877
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Greaselion\Temp\scoped_dir2072_858092167\manifest.json
Filesize407B
MD57488b6d6720532f4a267d26c247141d6
SHA18c94c0b8a7da8bb87085cce4ad42641ad3e8a842
SHA256fb5f4468336ac50fc71dee3568ed7bb2392952261076ea306fc9f4ed5972bde5
SHA5128567b3e896b5dd0bb3608f3fd65fd8cefd284ec4ed5dfa2d6803a962ff41d2c7a59c933f4dc9b9c7c6f6ffc4c0e8e85f62974fe3fbb09f758c2025523355dc42
-
Filesize
8KB
MD524e68a449b19f5edd83676fb8b95f045
SHA1eaee5d1fea2fda8687cfd1354464765bf743d2c1
SHA2567124a89eb2368058ab947e4899126ff2ccdac511cd1eac0c6898bea21ab5936a
SHA5125a721cad9f2465fa08102ce23ff6d8e8bf0484445599bdff12e857aec1b0ca8be31cef3fac35acc38f0441d6fdf712f7c518549863975abdd6dbed7dd3b370da
-
Filesize
1KB
MD564e8cdb3d525116e3251450334123709
SHA1eefdb9a40ad9987099db69c65443d5d18391f33b
SHA2565f1a8cf6c8cb8362386f7a223a3779b2c2e62d6275126f5b35f97f067edcd0ce
SHA5128fcfb7e698f7bc160d7a3ebba94c7a10dc496aac644670f8476ec1b6823118d235d76504bab39e321bcc6767f8cddb6143650c16c09cc148894aee480d868ed2
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\Greaselion.json
Filesize3KB
MD53b7f2cdce3ab5de01976c5219d661ee8
SHA1669c6fc08c14a0a66b18aab5a4c92c8d859ddb30
SHA256a04301151f5a06b2ffd4c006590c4eb801157e8d2235585da165b0314cd02348
SHA512d7e53e1873a1037e43578e57a018d63d1f7e991ef8320217e057d06a649b4baf7de880637d2ec57c17dfa9ab5e1b3d60c189dc07ef55c9b5325d8fcfe2f8f8b7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\clean-urls.json
Filesize11KB
MD512798a1537c4ff2173442525009ff1d0
SHA1e89e4b43075e9fd32ccf551b378dc0b61a67e19f
SHA256953ce3dc1b15e6f14937c092d065e3efd1cb7881050bd41a1849996bc49129dd
SHA5122ade50b7cd9cada5ef3a8f9ec7a472682fdcc30233f11ca5e57efb8a181281ba01c2ec872960645c3d3bfa6b00b497de0558d22a39a58ee2255e3fc4357f104e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\debounce.json
Filesize10KB
MD5dfe66f6acaf568a0130bba36613e2c5a
SHA1b53f6ee4f1994fe246dc346b341ed9c4ef009e5c
SHA25651427ca754354027d6391b8bbb0ef62be9c22774e7ea58dbc5b4ca5be4cebbb5
SHA51231b44e38a84b5fc50a61ffe86559fc7d9216d8e037ff67d6a9d60c5e5170f49becbef8257c93c5041629137b9638cf22237cacc8e6d5c16b2ff433c55eb8da71
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\https-upgrade-exceptions-list.txt
Filesize86KB
MD5b8ebe8c70e14e1bdff4bf04cee9055a4
SHA16a8eeeb539eb5f630091a971585bc77731c24b12
SHA256a9c464c1aa17ec9958141c020c30badddd4801e15b9c0a0d430859df0ad1955e
SHA5129240b1d7ae17b6d20cb21a466335471d3b62ee2866e6d07dc62c1a288def513cedb5368891e4c8beecd135140a221bf8a16e048cced31b29fff9f8d0d40c7266
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\scripts\brave_rewards\publisher\github\githubBase.bundle.js
Filesize2KB
MD5e7cb1f457c1972065f9a5a5821ed022e
SHA1e8d135731d52cee0975327c99d1a6b745937c36c
SHA256a00d426c743f719cd74ad64441a8f7fdabbea566893c29b756754db91f05355a
SHA512de79db36ae1e042121cc440b21a5f175b7a679192df11883f304debfe3c1256955e13724d47ee3cc874e63fdc9a0b50d4b57f16d8d127d8106dbd0dd73cb5dce
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\scripts\brave_rewards\publisher\reddit\redditBase.bundle.js
Filesize3KB
MD50e7d831110979936c383c74b060388af
SHA1e9f8511b9862cfbbc27452a9463a78b44901de4a
SHA256d046760e839f120547d179a8eb380cdfd07db89ed256d3b95bc975161d075ea1
SHA5128a449257a396b0df25a19211cca28162dc12e5a22144b48996d09111181340d28b79c49610a7fcdc702b5571b0d4ad21efec890d39bf0d678f4842b1d93e629a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\scripts\brave_rewards\publisher\twitch\twitchBase.bundle.js
Filesize2KB
MD54dff02b3222f25ae7138d884fefe8e8d
SHA158870f0e2511a66b961ee893b332c1241d235ea6
SHA2560a21a4e6173432a274ca9b9ed8c13a4845675f20933a44a1d053c0d12a633447
SHA5120d031ed3c86c8268dd3c01219b3690948f43dbf87870db2af12ab9c60b02b1c8212109848d358a5870a17b8d1d2599f71918690fa0e34aa4194f210e326485b8
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\scripts\brave_rewards\publisher\twitter\twitterBase.bundle.js
Filesize4KB
MD50fdbb757afceb684f8041000d9b80c30
SHA1698834f7d787914f7155d7a1e0d8e24d91ddbc0a
SHA2567dbee02d2b4955afef95ac5ce8445ebaaf84c9fc55d16521bc598303c6521cfa
SHA512bbdd0fe5f8dc576f236d991cc7d29ba2a2929e2a78c86c5c4eb3f04c362f3f612f32a05b9a17762f6563fc7ec705ac83ddc0c97ad0e0dbe1a0d389b699f46dc1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\scripts\brave_rewards\publisher\vimeo\vimeoBase.bundle.js
Filesize4KB
MD5bdf49604c55dcc6e0af6281c83158f68
SHA11352d66ba7ba76efc4f7e4bd9e8d79cf1142b275
SHA2564978086aca3e6ebf5bdc84494f31a388ce7955fe8bfc043d75cc8306aeb437bb
SHA5128c3c7d69ed8aa2177bd3e56b85e1cf51e98ab97a551df2e11d9b2fb1907503e5ccace21f895d5a61189d6c351ebd828a779e64cef5114c18905d19a1964ab648
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.696\1\scripts\brave_rewards\publisher\youtube\youtubeBase.bundle.js
Filesize6KB
MD531c947a91169986cfa3558f1ef9faec9
SHA150d23ff4bb00edce79a4160ede1545c2c87b5a08
SHA25690f326796832682ebb6533eec08ea34d29e8a864f949e767e3c047b225189a94
SHA51222f66c131abaa03d3a3aba5f1b03a9f0bc355e528468d9740262218e855c4219e891cfef463e4ab5e4e6559f6c49301fe2a70e8b342f5d3eb9c577ed262bce63
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\afalakplffnnnlkncjhbmahjfjhmlkal_05215241db8326de370f25ed25f1254dbd1e64caeee70d827cd3814704e5b186
Filesize68KB
MD51ebdc207c5e706996b28351649aae039
SHA16405ac8c26a5836fd75315f3d3ff36d43ee10b17
SHA25605215241db8326de370f25ed25f1254dbd1e64caeee70d827cd3814704e5b186
SHA512654232a6a20b3bd1d4ed94ccb06691ddb95856430b118a5ee2912ce6aa35533c4dd9bc103d3ff7adece7ae62e28519b23ed2724931bae04307eef27a735f8085
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gccbbckogglekeggclmmekihdgdpdgoe_097c5622893a666318fc2a5d82ac8fac6a4535761c0ef389906a236243bc0062
Filesize3.4MB
MD5182cc1e31c6c4638413e878b58782c20
SHA1decb83bdecd3ee84919b52592833dee486c40740
SHA256097c5622893a666318fc2a5d82ac8fac6a4535761c0ef389906a236243bc0062
SHA512d7eb90fe3ffe29799520b7941b1c61bd1c9f5dc21d348ed842119f32fc5d5c6248121a083c0411fca9c89437a550f267c4d80a84a7fa7675b6f0edb965f4bc94
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gkboaolpopklhgplhaaiboijnklogmbc_0a9609f9c81652a5f4b5c5bd92d16f0400087fbf09fccc53510f158e2969c30f
Filesize70KB
MD5e4a026ee59ba6139c340655094f89b2b
SHA18af8ace4650e2864a94779704a02028b712e801e
SHA2560a9609f9c81652a5f4b5c5bd92d16f0400087fbf09fccc53510f158e2969c30f
SHA5124e59facf564c58cf27c521f2fa83acb594795d9ffce8f7d290031fc0fe56d7f6c1f4028d06432a6a450b56b9a263444f854407766b465d31f35f2ecb7b66d2b4
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\mfddibmblmbccpadfndgakiopmmhebop_b40cc38219b9eadff6aebf460ae81d51af2851305cc1f30d01df111298b09c71
Filesize128KB
MD53e7c81488a609167c171eaeb8e0bd7bc
SHA1ff5263aa97687c60bde1a3d5fbe4d693c18f87ef
SHA256b40cc38219b9eadff6aebf460ae81d51af2851305cc1f30d01df111298b09c71
SHA512c8701cd0991267bf1ebcf5fe824fb3df1115f88988ecc24ad0a8eddeb5abf70d5cd5c9c49fa3c4733eafaf886094382339c363ef3399fd1f8d5dd899753a8ad7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1563\photo.json
Filesize518B
MD5a2869bf64a11286484f998cac85ef1b3
SHA189dc6238eed8d49997ab7cadff6ecbb8919531c5
SHA2564b648fa933a49eee3156975e5d4ee04a50ea9a3ec529d3bf8f6469832fbb59d8
SHA5128ee320732dc11d0e84c87da05735faf9521c7fd006b021074b5dfe8d4e8b5af02c260edd43f6e4d2a5601d3fd32b9d48fc3d12bb4e2cdeec86a055b349371ade
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc\1.0.53\list_catalog.json
Filesize71KB
MD5431105d4b58b5cac824c5583527eab25
SHA1df613c0954673e032c0c6412b76b585ea7cd04e1
SHA256d658c278b89bb2d5605d5584a6d372633ed28d67136f1f2489f69cf774cbf4c3
SHA5129f95fab7b5e8b2eccbddbbc155cb530f859370d617656d69a4f3c77ecda2019ca3e62f8c471ef924b7f610aceb406f654588919254937e712cbfd61ca7d2b7ba
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop\1.0.84\resources.json
Filesize724KB
MD5705cbe7102fc8e43c2dd699bc84d1bc5
SHA1802127369ae9501fd93635f3cf08fecc7a58966c
SHA256e88ef61d2ae85c88ec96d78f080c66fd950952c72e4ad2b1b860cbb01b8b1647
SHA51260a174e44be2ed193a0daa5024c4f648917e13a21725c64fc61b51ae6cf7183072f43d78c4ea5ca77acf05c0cbaaac3be0cdd7e5721cb5c478dfdd9c2cb5c4d4
-
Filesize
1.6MB
MD5d24074f9a357fe5a58eccff4f9bcabd6
SHA1a808b1a5b71d9279e45ea36f2a91c103c9daa756
SHA256fcbceca8ee83a2603cc8a06d8466c44f2cc317102522775c053b2f185e092e6e
SHA5127fc6b156652e282391dabf89e4468424574347ba55e93ae7cc632c1b5af81ac31d1bdf7d415d20a12c22e7f44bf8aed88911277ec6c6e89f819618282bcb118b
-
C:\Users\Admin\AppData\Local\Temp\MW-ea4271a8-713d-4099-987a-85975499cc5c\files\BraveBrowserSetup-VER979.exe
Filesize1.2MB
MD542eb61652cab74e10a299c1e131bd411
SHA19ab7df40383cbd27f015ef45cac22e7009a6f595
SHA25623e3ce03feb8101b0593e2cdcc922a8c6e857c3d96766ee3259d2a0e89c0e494
SHA512fa8b2ba22defdc080abe8093b676a11addbb6b16c42fae08349f7b333cf1fdef1c3fbf87f84a8e993eb7e8ce4c8dcd16a91cf6b4ea680fae21900144085b338b
-
Filesize
421KB
MD5008eef0c6451d5dfaee2b1e702ae347c
SHA13c46394e7b321b894b7665b6b4839c5aa16e9fa9
SHA25690406d0fc975f342f0e20b49e7946e891392eb06bfc8cc5f3b9b8c86b7c1b17a
SHA512c133f7203d1647a3e0ebd533a0c9e616f1e50e5e7fa0925313e41da42fecb1063f63dacd59e9c69c0dbaeb887d78dae9a386993a618a926d34dde7d9ec98286f
-
Filesize
239B
MD56d9565a140a38c01e286b7fe70bd9407
SHA175b2acc663522a9b604064d9d15ac1a9ff4586b1
SHA256e829155df8e444ed96a60c9da849bc3ae80a4756760b69bb4bb28330140eb460
SHA5127d0f55facccddac24c45cfff4fe030effc177408db4ba1d08726b36b6ef2240a95890d2ffe966f0083dc53406d7ca4a354836669eb10a2d48dc8ad19dc450a6b
-
Filesize
1KB
MD5e9fbd0c7516d71945afbcd27ae12b949
SHA1f7dde0cae66adcd7792f99a1a01f83bff0aaf846
SHA256cefd0c8aab5438b6820485a79923ffe8fa079ce2c3cdc079cda0e6cacc2cee74
SHA5124626a389ace37968cbfebe578338b7d62e4e922b916a92b6d6a6b4275a6f65ff557b0e1c4057a00335356d6a7e8e73d859b66b8bdff43854c52d6130215eb2a3
-
Filesize
1KB
MD501a99acc54db0d23325913d2330bfd3e
SHA132f60a57108699109f7bcf14147bc6a22ed12892
SHA2566a7dbcc7bf911ad8c98b1b750060bc6707a6b3c97c9610a2d3d20fda9286dc22
SHA512bbcb1153a442ddb618d4307b714c9b8d8279aeeddf2bfe77a41a23048c2b8b7929d40d4dd3ae93687551bc7df185d1381265ed44be0c8c1ac7bb2ab97c055c9b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Brave.lnk
Filesize2KB
MD5dd8ffa047a566c7ea58f3a44d259e231
SHA14d4d3f308c29afa7fcb94d7a1691c5e399ec3edf
SHA2561feb34a72022242b1d69bc56f3975c037dcfdb7b8fd124329e27ab63ee973768
SHA512ebebbfb1290c95cbd963d59dd48d55dea05c6c56d97ce0b9496a8f1d50ba0615b9c5b694b673bf4a12ebeb8326926f67550cd2e37c406a415a80dfe18affd132
-
Filesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
-
Filesize
1.9MB
MD52bc783b5193fa2dafe58065209be31f1
SHA17b7f31705565570dbf095a251769f9b73c3cafb7
SHA256be5dc0d38251a54350c462a7f4a6c70028ee05c01bde5c1974342893bf12ba5e
SHA512b82d58793679153c54106b5dfd851926aba258c64334a4a107d91bd9feb89a91e38320cc28e628b4ea7a32efe0a2c3ce401c93d93616fed1e6325383c8cf6be6
-
Filesize
23.7MB
MD5cd0619b92b1c131d431d02458a70963d
SHA1f3cd468d3b41b7e70d236a3cc03f27d4dfaf7206
SHA2569d1a3d5a9ff768cfb09a0485943ed510f8bf6d78f7c24abb4f91c97b37e1906a
SHA51282c47eadb9dcb52def9fc6887e9e895249d54edd5e980cfcf43568f59de60872666fe1b41b02cb0435a17ecd5a0c534bfb726232bd17c7a1fc90a237b938a3b8
-
\??\Volume{5a066776-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{eded74b3-c6f5-4636-816b-ac3040d419ab}_OnDiskSnapshotProp
Filesize6KB
MD56299f8b64db70da579e042ef9b889c0d
SHA1571f3863c5fb73867e14de8afa2cd91a414944cf
SHA2560a0e4cd3929c935bafc220a0a857f37be9834b3c3ff0988cace913f0f61a2c98
SHA512faa4967a9783b1ffda4e3c309f244db69cd056c5d0fc9f8f45dc5e6bee29d0d9f3b8cf67eec74ace8918206b21ccf4814a93521a1d83da8d1ffffa0c8aa5c475