Analysis
-
max time kernel
717s -
max time network
716s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-01-2025 20:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://YouTube.com
Resource
win11-20241007-en
General
-
Target
http://YouTube.com
Malware Config
Extracted
C:\$Recycle.Bin\HOW_TO_DECRYPT.txt
hive
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 8 IoCs
resource yara_rule behavioral1/memory/572-3811-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-3810-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-6028-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-8371-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-10316-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-12802-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-18017-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go behavioral1/memory/572-30805-0x0000000000FE0000-0x0000000001243000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
Hive family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\131.1.73.104\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 20 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Hive Ransomware.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.VTKcWE16_xUpXws53pcti16Ld0Vn9pJ9soN2z9phnxg.hive Hive Ransomware.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 4456 BraveBrowserSetup-BRV002.exe 2124 BraveUpdate.exe 4836 BraveUpdate.exe 5960 BraveUpdate.exe 3536 BraveUpdateComRegisterShell64.exe 1216 BraveUpdateComRegisterShell64.exe 1348 BraveUpdateComRegisterShell64.exe 2424 BraveUpdate.exe 1604 BraveUpdate.exe 4856 BraveUpdate.exe 5096 brave_installer-x64.exe 5060 setup.exe 1472 setup.exe 4432 setup.exe 1096 setup.exe 3788 BraveUpdate.exe 2384 BraveUpdateOnDemand.exe 5344 BraveUpdate.exe 3220 brave.exe 3740 brave.exe 4796 brave.exe 3736 brave.exe 5940 brave.exe 4848 elevation_service.exe 5840 brave.exe 5716 brave.exe 3580 brave.exe 5568 brave.exe 964 brave.exe 2236 brave.exe 884 brave.exe 5464 brave.exe 2452 chrmstp.exe 5420 chrmstp.exe 2184 chrmstp.exe 5884 chrmstp.exe 2840 brave.exe 4428 brave.exe 2936 brave.exe 3984 brave.exe 4528 brave.exe 2128 brave.exe 2920 brave.exe 5084 brave.exe 1276 brave.exe 4260 brave.exe 3196 brave.exe 2392 brave.exe 3636 brave.exe 3172 brave.exe 3504 brave.exe 5480 brave.exe 748 brave.exe 4860 brave.exe 2812 brave.exe 1864 brave.exe 848 brave.exe 5592 brave.exe 6132 brave.exe 4688 brave.exe 2912 brave.exe 3956 brave.exe 3008 brave.exe 2588 brave.exe -
Loads dropped DLL 64 IoCs
pid Process 2124 BraveUpdate.exe 4836 BraveUpdate.exe 5960 BraveUpdate.exe 3536 BraveUpdateComRegisterShell64.exe 5960 BraveUpdate.exe 1216 BraveUpdateComRegisterShell64.exe 5960 BraveUpdate.exe 1348 BraveUpdateComRegisterShell64.exe 5960 BraveUpdate.exe 2424 BraveUpdate.exe 1604 BraveUpdate.exe 4856 BraveUpdate.exe 4856 BraveUpdate.exe 1604 BraveUpdate.exe 3788 BraveUpdate.exe 5344 BraveUpdate.exe 5344 BraveUpdate.exe 3220 brave.exe 3740 brave.exe 3220 brave.exe 4796 brave.exe 3736 brave.exe 4796 brave.exe 3736 brave.exe 4796 brave.exe 4796 brave.exe 4796 brave.exe 5940 brave.exe 5940 brave.exe 4796 brave.exe 4796 brave.exe 4796 brave.exe 5840 brave.exe 5840 brave.exe 5716 brave.exe 5716 brave.exe 3580 brave.exe 5568 brave.exe 5568 brave.exe 964 brave.exe 3580 brave.exe 2236 brave.exe 884 brave.exe 5464 brave.exe 2236 brave.exe 884 brave.exe 5464 brave.exe 964 brave.exe 2840 brave.exe 2840 brave.exe 4428 brave.exe 4428 brave.exe 2936 brave.exe 2936 brave.exe 3984 brave.exe 3984 brave.exe 4528 brave.exe 4528 brave.exe 2128 brave.exe 2128 brave.exe 2920 brave.exe 2920 brave.exe 5084 brave.exe 5084 brave.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Music\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Documents\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Links\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\desktop.ini Hive Ransomware.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3973800497-2716210218-310192997-1000\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Music\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Hive Ransomware.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3973800497-2716210218-310192997-1000\desktop.ini explorer.exe File opened for modification C:\Program Files (x86)\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Hive Ransomware.exe File opened for modification C:\Program Files\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive Ransomware.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3973800497-2716210218-310192997-1000\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Videos\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Hive Ransomware.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 205 pastebin.com 237 raw.githubusercontent.com -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName brave.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer brave.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_55a4564b7d07f0ca\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_a5f08d2285e888ad\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mshidkmdf.inf_amd64_d55bad1fa4b303c5\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_28522251903b4825\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\OEM\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\nb-NO\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\wbem\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mtd.inf_amd64_126cefcd5b250225\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_34bd43b9835975d2\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4devicerouter.inf_amd64_8d9a17bd8e5b4b11\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\wbem\tmf\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock5.inf_amd64_d7e3f61b70de13bc\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\ras\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\wbem\de\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\bthleenum.inf_amd64_1145b9e103f6845b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmosi.inf_amd64_ffca298fa8c88825\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_7a48ac9d759c7ab4\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\GroupSet\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\setup\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\wbem\ja\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\de\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0c0c\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\SMI\Manifests\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\fi-FI\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_1d979ad4405f0bea\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_fe1d2d30b2b5e8ed\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_346f3764318c1681\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\DriverStore\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\Speech\Engines\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\XPSViewer\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_e483b4d6fbab8545\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_2eaa07d02d0977a3\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_04b60d124553a40f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhay2.inf_amd64_6b35ae132cca4253\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\APPLETS\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
resource yara_rule behavioral1/files/0x002200000002b094-3751.dat upx behavioral1/memory/572-3779-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-3811-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-3810-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-6028-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-8371-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-10316-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-12802-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-18017-0x0000000000FE0000-0x0000000001243000-memory.dmp upx behavioral1/memory/572-30805-0x0000000000FE0000-0x0000000001243000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg.VTKcWE16_xUpXws53pcti-ZfzzenUyUbmxAEGrTaiBM.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri Hive Ransomware.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-256_altform-lightunplated.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchStoreLogo.scale-200.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png Hive Ransomware.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.VTKcWE16_xUpXws53pcti1t8kDdFJ6wuHbYzgubaXWY.hive Hive Ransomware.exe File opened for modification C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe.VTKcWE16_xUpXws53pcti3IfOMB5T0kLrTclw4ABqQY.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.VTKcWE16_xUpXws53pcti3w9YLiozvkGtWNygDab8Fg.hive Hive Ransomware.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\GetHelpBadgeLogo.scale-100_contrast-black.png Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_checkbox_unselected_18.svg.VTKcWE16_xUpXws53pcti2rSaT4U9csqLjGJhTjyOxM.hive Hive Ransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-24_altform-unplated.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxOutlook_App.dll Hive Ransomware.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.VTKcWE16_xUpXws53pctixjOtWm3yTAxjf_rQpMASVQ.hive Hive Ransomware.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt.VTKcWE16_xUpXws53pcti6OrLI0zPsdcPaSRu6m-RQc.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubSplashScreen.scale-125_altform-colorful.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-256.png Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA.VTKcWE16_xUpXws53pcti9xNInyzlhd0Odgoi05LJTs.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css.VTKcWE16_xUpXws53pcti_AsZ6kEgblohVu_ets2eEk.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.VTKcWE16_xUpXws53pcti2mGcE3dLWJnzx_4NXS6IDo.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-100.png Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css.VTKcWE16_xUpXws53pcti2HRisDQ5CYwfuz7mNRHShw.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js.VTKcWE16_xUpXws53pctizb3iwBcBvsf9h_bExnGKBI.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.VTKcWE16_xUpXws53pctix072tVpcalp-gZpDKsK5jQ.hive Hive Ransomware.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\avcodec-58_ms.dll Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-100.png Hive Ransomware.exe File opened for modification C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Locales\uk.pak.VTKcWE16_xUpXws53pcti00YC8XXUqBfonKj3J5jQlE.hive Hive Ransomware.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ODATACPP.DLL.VTKcWE16_xUpXws53pcti_EEsnOhkdAXZgtmAtupXWY.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png.VTKcWE16_xUpXws53pcti4Yg7MmD6XNoygK5YfYgRlU.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.VTKcWE16_xUpXws53pcti6jBo2nxOP8RSQ_ICx_sjBg.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.VTKcWE16_xUpXws53pcti8MrJLAus0YPnhjjW84k5X8.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\vcruntime140_1.dll Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA Hive Ransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.VTKcWE16_xUpXws53pcti-XfZw13MT5FWACdf0r1Sy0.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\IDisposable.js Hive Ransomware.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll Hive Ransomware.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\ui-strings.js Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.VTKcWE16_xUpXws53pctiyzGpF1rFDxYKrcNilkm5Vc.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.VTKcWE16_xUpXws53pcti0hVKKaiOXh2BTlqD9RTzko.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-16_altform-unplated.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-white.png Hive Ransomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-200.png Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg.VTKcWE16_xUpXws53pcti71suHni2z8QjJ26c704TjA.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.VTKcWE16_xUpXws53pcti-AHwe7Kc89GauKToaFbyGE.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125_altform-colorful.png Hive Ransomware.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\Microsoft.Ink\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\guidedsetup\network\area-content\sl-SI\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-local_31bf3856ad364e35_10.0.22000.1_none_5f59e1d0d015baa5\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\x86_netfx4-microsoft_common_tasks_b03f5f7f11d50a3a_4.0.15806.0_none_4f15c3e4763afdaf\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..dminflows.resources_31bf3856ad364e35_10.0.22000.184_uk-ua_27394943624311dc\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\msil_microsoft-windows-d..ivecenter.resources_31bf3856ad364e35_10.0.22000.120_ru-ru_81916a0ba77a2f6e\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-core-library_31bf3856ad364e35_10.0.22000.434_none_52004b521cbc876a\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_tpmvsc.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_3f01487ea94fd3ff\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_wvkrnlintvsc.inf.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_c7c1f54003fb98fe\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_hyperv-integrationservicesext.resources_31bf3856ad364e35_10.0.22000.1_de-de_8015796aa0b8d56f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\ValueBanner\Assets\Images\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell32.resources_31bf3856ad364e35_10.0.22000.184_lv-lv_cba4d888ff9303c1\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\Temp\InFlight\8f2f5d94af18db010b150000101b9013\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rofessional-license_31bf3856ad364e35_10.0.22000.348_none_7744f0e97b18358e\r\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.22000.348_sv-se_0ebf8996bc615ec6\r\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..riseseval.resources_31bf3856ad364e35_10.0.22000.493_zh-tw_26fdc6e7ce67066d\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_11.0.22000.282_none_f3c17f9f859ada7f\r\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.dsc.mpeval_31bf3856ad364e35_10.0.22000.1_none_80ae67b7aba5c9e1\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oleaccrc_31bf3856ad364e35_10.0.22000.1_none_cf6d8cf48c2c3136\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rascmdial.resources_31bf3856ad364e35_10.0.22000.1_es-es_2727da06ed32f8da\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mmoncommonproxystub_31bf3856ad364e35_10.0.22000.71_none_4f4cc14c6d504ce7\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_10.0.22000.493_tr-tr_ea1b555e3f937e97\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icsigd.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_0d4a2a46cdc4e2a3\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-onex.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_e1d5cd7e03841a9f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_a307d1a0960effe5\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..ault-core.resources_31bf3856ad364e35_10.0.22000.493_pt-br_f53ef19d6be8b8dc\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.22000.1_none_fda650297ae62c00\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..orization.resources_31bf3856ad364e35_10.0.22000.1_de-de_34a6a7a7cf3968ba\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\diagnostics\system\Bluetooth\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..-gmsaclient-library_31bf3856ad364e35_10.0.22000.434_none_317118301622cc91\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\es\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-office_31bf3856ad364e35_10.0.22000.1_none_c21253581df69869\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..isesneval.resources_31bf3856ad364e35_10.0.22000.493_en-us_2efed3ae9f6bfbdd\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..i-pcshell.resources_31bf3856ad364e35_10.0.22000.184_hr-hr_b9f818d0f9691b7c\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_hyperv-datastore.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_c993c5f5cd4cd913\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.22000.1_none_dd54b9f3e19c9c05\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-spp-ux.resources_31bf3856ad364e35_10.0.22000.1_de-de_a638b8eb116d76d2\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_system.enterpriseservices.resources_b03f5f7f11d50a3a_4.0.15806.0_ja-jp_a82396af936937e5\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.22000.1_ca-es_a8e299fb8660e9eb\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\x86_microsoft-windows-msmq-runtime-core_31bf3856ad364e35_10.0.22000.1_none_4f867ae4056ec505\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ests-onecoreuapbase_31bf3856ad364e35_10.0.22000.1_none_7e0a224cf3752066\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-taskbarcpl.resources_31bf3856ad364e35_10.0.22000.348_nb-no_2b23fbd64ee242c0\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.22000.184_sk-sk_04230a0e455fd591\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..s.utility.resources_31bf3856ad364e35_10.0.22000.1_it-it_4e91a2175537cd77\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft.backgroun..r.management.module_31bf3856ad364e35_10.0.22000.1_none_39e567c2d409b0a3\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-whitebox.resources_31bf3856ad364e35_10.0.22000.1_en-us_90797ef89f93d41b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..riseseval.resources_31bf3856ad364e35_10.0.22000.493_en-us_675c83a03176deb5\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ado15-rll.resources_31bf3856ad364e35_10.0.22000.1_es-es_bd3f488cc2e20649\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..licymanagerprecheck_31bf3856ad364e35_10.0.22000.37_none_4087fa67bb441048\r\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.22000.184_ko-kr_45e3906c4f54e903\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft.appv.appv..mconsumer.resources_31bf3856ad364e35_10.0.22000.1_es-es_e412f249e8ee4e78\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\security\EDP\Logs\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_10.0.22000.493_ja-jp_e6e0eca87e4ce73a\f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.22000.493_he-il_3f4ea7bfb7fd835d\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_vmconnect.resources_31bf3856ad364e35_10.0.22000.1_es-es_a8bc25174ad43ec6\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.22000.1_none_845be02a96edce3b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ionflyout.resources_31bf3856ad364e35_10.0.22000.1_en-us_fad964202e6c012d\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Desktop\test.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\Hive Ransomware.exe:Zone.Identifier brave.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 1440 4236 WerFault.exe 180 6140 4436 WerFault.exe 184 3936 4104 WerFault.exe 187 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdateOnDemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveBrowserSetup-BRV002.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2424 BraveUpdate.exe 3788 BraveUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz StartMenuExperienceHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier StartMenuExperienceHost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 StartMenuExperienceHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier StartMenuExperienceHost.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 2456 timeout.exe 1604 timeout.exe 2552 timeout.exe 5356 timeout.exe 4204 timeout.exe 280 timeout.exe 3964 timeout.exe 1064 timeout.exe 2772 timeout.exe 3596 timeout.exe 716 timeout.exe 4312 timeout.exe 1412 timeout.exe 656 timeout.exe 2584 timeout.exe 232 timeout.exe 2836 timeout.exe 2376 timeout.exe 3340 timeout.exe 3196 timeout.exe 1536 timeout.exe 4932 timeout.exe 2940 timeout.exe 4512 timeout.exe 604 timeout.exe 2940 timeout.exe 5476 timeout.exe 1516 timeout.exe 5292 timeout.exe 1716 timeout.exe 6076 timeout.exe 2076 timeout.exe 2284 timeout.exe 5904 timeout.exe 716 timeout.exe 1044 timeout.exe 2584 timeout.exe 3880 timeout.exe 2116 timeout.exe 3140 timeout.exe 5048 timeout.exe 2748 timeout.exe 5880 timeout.exe 5556 timeout.exe 5824 timeout.exe 2816 timeout.exe 4392 timeout.exe 3992 timeout.exe 848 timeout.exe 3780 timeout.exe 5084 timeout.exe 4268 timeout.exe 3568 timeout.exe 2720 timeout.exe 3888 timeout.exe 3500 timeout.exe 1184 timeout.exe 2272 timeout.exe 3908 timeout.exe 252 timeout.exe 580 timeout.exe 444 timeout.exe 5516 timeout.exe 1968 timeout.exe -
Enumerates system info in registry 2 TTPs 48 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch explorer.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133805824517259905" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry brave.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CurVer\ = "BraveSoftwareUpdate.ProcessLauncher.1.0" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassSvc.1.0 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\NumMethods BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService.1.0\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods\ = "12" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine.1.0\CLSID\ = "{598BBE98-5919-4392-B62A-50D7115F10A3}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BraveUpdate.exe BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\CLSID\ = "{3A9D7221-2278-41DD-930B-C2356B7D3725}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachine\CLSID\ = "{00B16F95-319A-4F01-AC81-CE69B8F4E387}" BraveUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.html setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FF255A-A593-41BD-A69B-E05D72B72756}\ProgID BraveUpdate.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods\ = "11" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\ = "IPolicyStatus3" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ = "IAppVersion" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" brave.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BraveUpdate.exe\AppID = "{08F15E98-0442-45D3-82F1-F67495CC51EB}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\Elevation\IconReference = "@C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\goopdate.dll,-1004" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ServerExecutable = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\131.1.73.104\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\CurVer\ = "BraveSoftwareUpdate.Update3WebSvc.1.0" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\.mhtml\OpenWithProgids setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreMachineClass.1\CLSID\ = "{F7FF255A-A593-41BD-A69B-E05D72B72756}" BraveUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\ = "IAppCommand2" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\ProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher.1.0\ = "Google Update Process Launcher Class" BraveUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B042DC7-1633-49A2-8255-7DA828C32CA7}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\VersionIndependentProgID BraveUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13B35483-DF37-4603-97F8-9504E48B49BF} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\NumMethods\ = "11" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{28C83F57-E4C0-4B54-B187-585C51EE8F9C}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine.1.0\ = "Google Update Broker Class Factory" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\VersionIndependentProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassMachineFallback" BraveUpdate.exe -
NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\Hive Ransomware.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier chrome.exe File created C:\Windows\SystemTemp\GUMCC4A.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA BraveBrowserSetup-BRV002.exe File opened for modification C:\Users\Admin\Desktop\test.exe:Zone.Identifier brave.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5412 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4736 chrome.exe 4736 chrome.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 1604 BraveUpdate.exe 1604 BraveUpdate.exe 3788 BraveUpdate.exe 3788 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 2124 BraveUpdate.exe 3220 brave.exe 3220 brave.exe 3284 brave.exe 3284 brave.exe 5928 BraveUpdate.exe 5928 BraveUpdate.exe 1884 BraveUpdate.exe 1884 BraveUpdate.exe 3860 BraveUpdate.exe 3860 BraveUpdate.exe 572 Hive Ransomware.exe 572 Hive Ransomware.exe 3892 explorer.exe 3892 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3892 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: 33 2120 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2120 AUDIODG.EXE Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: SeDebugPrivilege 2124 BraveUpdate.exe Token: SeDebugPrivilege 2124 BraveUpdate.exe Token: SeDebugPrivilege 2124 BraveUpdate.exe Token: SeDebugPrivilege 2124 BraveUpdate.exe Token: SeShutdownPrivilege 4736 chrome.exe Token: SeCreatePagefilePrivilege 4736 chrome.exe Token: 33 5096 brave_installer-x64.exe Token: SeIncBasePriorityPrivilege 5096 brave_installer-x64.exe Token: SeDebugPrivilege 1604 BraveUpdate.exe Token: SeDebugPrivilege 3788 BraveUpdate.exe Token: SeDebugPrivilege 2124 BraveUpdate.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe Token: SeCreatePagefilePrivilege 3220 brave.exe Token: SeShutdownPrivilege 3220 brave.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 2184 chrmstp.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 4736 chrome.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3220 brave.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe 3892 explorer.exe -
Suspicious use of SetWindowsHookEx 54 IoCs
pid Process 2724 brave.exe 5216 brave.exe 3892 explorer.exe 3408 SearchHost.exe 2996 StartMenuExperienceHost.exe 1308 SearchHost.exe 3892 explorer.exe 3764 SearchHost.exe 2904 SearchHost.exe 4616 SearchHost.exe 4516 SearchHost.exe 3892 explorer.exe 2428 OpenWith.exe 2428 OpenWith.exe 2428 OpenWith.exe 2428 OpenWith.exe 2428 OpenWith.exe 2428 OpenWith.exe 2428 OpenWith.exe 5336 WORDPAD.EXE 5336 WORDPAD.EXE 5336 WORDPAD.EXE 5336 WORDPAD.EXE 5336 WORDPAD.EXE 5476 WORDPAD.EXE 5476 WORDPAD.EXE 5476 WORDPAD.EXE 5476 WORDPAD.EXE 5476 WORDPAD.EXE 5816 WORDPAD.EXE 5816 WORDPAD.EXE 5816 WORDPAD.EXE 5816 WORDPAD.EXE 5816 WORDPAD.EXE 3160 WORDPAD.EXE 3160 WORDPAD.EXE 3160 WORDPAD.EXE 3160 WORDPAD.EXE 3160 WORDPAD.EXE 3688 SearchHost.exe 5756 SearchHost.exe 4072 SearchHost.exe 2720 SearchHost.exe 5644 SearchHost.exe 1992 SearchHost.exe 2812 SearchHost.exe 3892 explorer.exe 3644 SearchHost.exe 3748 SearchHost.exe 408 SearchHost.exe 4812 SearchHost.exe 4676 SearchHost.exe 3388 SearchHost.exe 4804 SearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 3000 4736 chrome.exe 77 PID 4736 wrote to memory of 3000 4736 chrome.exe 77 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 2392 4736 chrome.exe 78 PID 4736 wrote to memory of 5100 4736 chrome.exe 79 PID 4736 wrote to memory of 5100 4736 chrome.exe 79 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 PID 4736 wrote to memory of 1428 4736 chrome.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://YouTube.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa958fcc40,0x7ffa958fcc4c,0x7ffa958fcc582⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1628 /prefetch:22⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2088,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:32⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2376 /prefetch:82⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3020,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3036 /prefetch:12⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3032,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2996,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4544,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:12⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3348,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3344 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4820,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4288 /prefetch:82⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5092,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5264,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5304 /prefetch:82⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5440,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5588,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5620 /prefetch:82⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5620,i,1054425683326922127,3870325460316255961,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3764
-
-
C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:4456 -
C:\Windows\SystemTemp\GUMCC4A.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUMCC4A.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4836
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5960 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3536
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1216
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1348
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntENTRDODJFRS1GMkM2LTRCQTktOTREQi0xRUI3RUFCMDVGRTB9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MUZDQUQ5MjctRUE3MS00N0ZGLTk4M0ItMUVDMDY4MzkzMzFBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjczNCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
PID:2424
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{D54C82EE-F2C6-4BA9-94DB-1EB7EAB05FE0}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4636
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2776
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\gui155A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\gui155A.tmp" --brave-referral-code="BRV002"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Modifies registry class
PID:5060 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff71534f418,0x7ff71534f424,0x7ff71534f4304⤵
- Executes dropped EXE
PID:1472
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\gui155A.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
PID:4432 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{7CFDE755-5444-47CD-8EE4-F6229B995E44}\CR_66E82.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff71534f418,0x7ff71534f424,0x7ff71534f4305⤵
- Executes dropped EXE
PID:1096
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntENTRDODJFRS1GMkM2LTRCQTktOTREQi0xRUI3RUFCMDVGRTB9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MjJBNDRCNjctQTA0Ny00MDA0LUIyOUMtRUREMzMyRTcyOTFBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0FGRTZBNDYyLUM1NzQtNEI4QS1BRjQzLTRDQzYwREY0NTYzQn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMS4xLjczLjEwNCIgYXA9InJlbGVhc2UiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwczovL3VwZGF0ZXMtY2RuLmJyYXZlc29mdHdhcmUuY29tL2J1aWxkL0JyYXZlLVJlbGVhc2UvcmVsZWFzZS93aW4vMTMxLjEuNzMuMTA0L3g2NC9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTMwOTI4NjU2IiB0b3RhbD0iMTMwOTI4NjU2IiBkb3dubG9hZF90aW1lX21zPSIxMDAxNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzQ1IiBkb3dubG9hZF90aW1lX21zPSIxMDk2OCIgZG93bmxvYWRlZD0iMTMwOTI4NjU2IiB0b3RhbD0iMTMwOTI4NjU2IiBpbnN0YWxsX3RpbWVfbXM9IjMwMTQxIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5344 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3220 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa905f1d18,0x7ffa905f1d24,0x7ffa905f1d304⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3740
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2028 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4796
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1928,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2164 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3736
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2296,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2536 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5940
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3476,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3496 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5840
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3468,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3644 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5716
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4756,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5004 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3580
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4864,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4876 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5568
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5220,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5256 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5240,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5404 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5416,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5560 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
PID:2452 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7898ef418,0x7ff7898ef424,0x7ff7898ef4305⤵
- Executes dropped EXE
PID:5420
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2184 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7898ef418,0x7ff7898ef424,0x7ff7898ef4306⤵
- Executes dropped EXE
PID:5884
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5708,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5720 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5464
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5732,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5816 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5780,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5496 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4428
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5632,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5604 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5628,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5952 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3436,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6132 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3984
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6344,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6356 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4528
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5544,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6332 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5540,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6632 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5084
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4184,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6612 /prefetch:14⤵
- Executes dropped EXE
PID:1276
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3716,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6740 /prefetch:144⤵
- Executes dropped EXE
PID:4260
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6716,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6700 /prefetch:14⤵
- Executes dropped EXE
PID:3196
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6524,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3472 /prefetch:14⤵
- Executes dropped EXE
PID:2392
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6660,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6644 /prefetch:14⤵
- Executes dropped EXE
PID:3636
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6584,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6128 /prefetch:14⤵
- Executes dropped EXE
PID:3172
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3740,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3728 /prefetch:14⤵
- Executes dropped EXE
PID:3504
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6084,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3472 /prefetch:14⤵
- Executes dropped EXE
PID:5480
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3696,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6676 /prefetch:14⤵
- Executes dropped EXE
PID:748
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6452,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3656 /prefetch:14⤵
- Executes dropped EXE
PID:4860
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6692,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4200 /prefetch:14⤵
- Executes dropped EXE
PID:2812
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5792,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=788 /prefetch:14⤵
- Executes dropped EXE
PID:1864
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5336,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3700 /prefetch:14⤵
- Executes dropped EXE
PID:848
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=3472,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3712 /prefetch:14⤵
- Executes dropped EXE
PID:5592
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3652,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5452 /prefetch:144⤵
- Executes dropped EXE
PID:6132
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5680,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5816 /prefetch:144⤵
- Executes dropped EXE
PID:4688
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6100,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5300 /prefetch:144⤵
- Executes dropped EXE
PID:2912
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5700,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6256 /prefetch:144⤵
- Executes dropped EXE
PID:3956
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6152,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5688 /prefetch:14⤵
- Executes dropped EXE
PID:3008
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5232,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5916 /prefetch:144⤵
- Executes dropped EXE
PID:2588
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6396,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5932 /prefetch:144⤵PID:4828
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6260,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6196 /prefetch:144⤵PID:752
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6208,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6236 /prefetch:144⤵PID:3896
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6608,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4860 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
PID:3284
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=4736,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4916 /prefetch:14⤵PID:1276
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=5696,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3236 /prefetch:14⤵PID:3656
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6400,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6700 /prefetch:14⤵PID:1864
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5248,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6180 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=6264,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5332 /prefetch:14⤵PID:2820
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6164,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3332 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5224
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=6076,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5264 /prefetch:14⤵PID:5812
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=5788,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6176 /prefetch:14⤵PID:4048
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=6336,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3688 /prefetch:14⤵PID:6004
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=5196,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=1600 /prefetch:14⤵PID:1956
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=5332097777984012572 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=5764,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5408 /prefetch:14⤵PID:3332
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6232,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6428 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5216
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5768,i,5648940946886092303,10416694497528043452,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6732 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3504
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4848
-
C:\Users\Admin\Desktop\test.exe"C:\Users\Admin\Desktop\test.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 2922⤵
- Program crash
PID:1440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4236 -ip 42361⤵PID:3620
-
C:\Users\Admin\Desktop\test.exe"C:\Users\Admin\Desktop\test.exe"1⤵PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 2602⤵
- Program crash
PID:6140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4436 -ip 44361⤵PID:4388
-
C:\Users\Admin\Desktop\test.exe"C:\Users\Admin\Desktop\test.exe"1⤵PID:4104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1962⤵
- Program crash
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 41041⤵PID:4832
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5928
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵PID:3876
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵PID:5084
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- System Location Discovery: System Language Discovery
PID:808
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3860
-
C:\Users\Admin\Desktop\Hive Ransomware.exe"C:\Users\Admin\Desktop\Hive Ransomware.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL2⤵
- System Location Discovery: System Language Discovery
PID:6020 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4932
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2940
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4512
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3140
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:656
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1184
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:3892
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:5476
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:4848
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5048
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:280
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2272
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:5756
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:1964
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2720
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:1064
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2376
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3340
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2748
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:848
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3908
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2120
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3780
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:4560
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:5308
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:2252
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5084
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2284
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:252
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3964
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1516
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:232
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:5476
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2456
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5904
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1064
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:3692
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2772
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:604
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:716
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:1608
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1044
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4268
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2836
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3596
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3196
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:3896
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:580
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5880
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3568
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:5568
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5556
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:2304
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2940
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2220
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5824
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2720
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:716
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1604
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5292
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1716
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:2380
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:444
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2816
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:6076
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2552
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3888
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2116
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:5296
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1008
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4392
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:5924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5356
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5476
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5516
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4312
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:4680
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:5072
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4204
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:2116
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3500
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1536
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:4852
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1968
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1412
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2076
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:3392
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3880
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
PID:4192
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3992
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL2⤵
- System Location Discovery: System Language Discovery
PID:808
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW_TO_DECRYPT.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5412
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3892 -
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\New Microsoft Word Document.docx"2⤵
- Suspicious use of SetWindowsHookEx
PID:5476
-
-
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\New Microsoft Word Document.docx"2⤵
- Suspicious use of SetWindowsHookEx
PID:5816
-
-
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\New Microsoft Word Document.docx"2⤵
- Suspicious use of SetWindowsHookEx
PID:3160
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2996
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3408
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1308
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3764
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4616
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4516
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2428 -
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\New Microsoft Word Document.docx"2⤵
- Suspicious use of SetWindowsHookEx
PID:5336
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3692
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3688
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5756
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4072
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5644
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1992
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:4892
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3644
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵PID:4108
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
PID:5428
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3748
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:408
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4812
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4676
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3388
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4804
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD580207d0f8ea42bdfeaf9f5c586230aca
SHA1747481fe2b0b6d81c3b19ba62d1e49eab6a5461f
SHA25625edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131
SHA51273f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304
-
Filesize
4.3MB
MD594483ea960f9bee9044e0a8ca31fc33c
SHA139e29cde48af84b3efdf16ffeacdc35be3e0e1e5
SHA256e308f70103afbfac265121f89759906299213e88fb9802352695f8260bd3d31c
SHA512d189adf07c6715d38547bd8873234d16596970d671ba3fb9c222d6a9aa10a5fc7cdcc6cea6627c5b0031b93e60e6db18e45b2661532873f510151a9b3f1fcb94
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\CertificateRevocation\9456\crl-set
Filesize632KB
MD515e642888f7a240f9c4c86642449f5ad
SHA1d24b7bd6d06ee999d05776164e306aba73312bf4
SHA256cecb66b924416eb94806f7be4ee3688b745f0c9b2bc5f1a28972d86071b4d72f
SHA5123eb8024150ed0bff768a16d3df8f3ef0f204c6c755de3211e7db6270ab6c913a8c1787ea9caff14ca5c8d934deaaeb26da0cda5cea48a5614b95003183221c8c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crowd Deny\2024.12.19.1218\Preload Data
Filesize16KB
MD53c97222c910c2aa1fab0c39a1c8d2b11
SHA1c794a8758b4fa74c7aa9536effe9bfa774822e7a
SHA256c7b91efdd09d75b47036e241eb55a238065ace2c26cd8f31328e8a9f4b4102b4
SHA5123220065c655bf174c466d9ac03d3040e419f30d081983c23a757d2c0c5e4720aed2c71e88befc0d8b6987d6abd6a25289731d7f4fc9ed6348a1d762f67032153
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000010
Filesize496KB
MD52ee7ab4d21ac0918cef950d526621af9
SHA175f806ba6a212c75ca402a5336919106d3b025b5
SHA25608c6d2a7f3ec3bd7b4a440f9b6229d43de33c10d84235e3d4eb7d60318db9648
SHA512be551d275ed25cc487b52ac630bc73bd580ca8eb05077a9de01f35b7c0778c8ec913e669b6268f264560007ff63929c16a0701c217c86a38222b9776d3c89386
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000021
Filesize186KB
MD574b7b92479a7001d83dd268c27757211
SHA1db862f5370c000a49ed2433a95cb812ba72ea941
SHA2568b6f32ed4dcc963144b05f9e13321372cc2defe9d305978f714b0c13ab893815
SHA512308176c12fbac8c826258e4fd6b3179a1940d62f76207eb325ef0a68f862719d53101752a27d0ec5fbc8ecf95c82474814f10a06cba8440b2226c34caf587c9f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000035
Filesize112KB
MD5f91354dee893e5b5f7eedf08fb503e05
SHA1a291685de177c087466c10c920907d99b3472bf4
SHA25650d56951f0baa312d62451574206a628c60e3a195361e373a36543eba12ae8e8
SHA512f31b12d4735a4be4a4934cb816d210be9b461afd36b69d931cddb74cdd3b2ca1b04e955c801b7d8978db40b6b4d496b667cc73d54c61a3f5fd249204433ce42a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000051
Filesize174KB
MD521f277f6116e70f60e75b5f3cdb5ad35
SHA18ad28612e051b29f15335aaa10b58d082df616a9
SHA2561537b0c18a7facad4bdfa9ae3ec84095c91467aa5cfc1d8af2724909703c2fe4
SHA512e619f92b1ec91e467e4b11d5ad25c99b62c7216f9da81c159ae0c9ef3f9e75f48dde7bad09ee38727b5a14b827f3b813c196504057708cbfaf4bc67dbd032816
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000052
Filesize36KB
MD56cfc088ad67742f06393447fef9f4892
SHA11ddc305102d51905466ae8ebbb505219287db027
SHA2563107934f94204dc3ab78e6e61e7b8621633bd32de793972457ba63f1db7dd57e
SHA512a934becc06feb36e800035addf89780f3b705ec14e192d3cbf95e277b071884237b96f578d58e26bc915b35ecf2ef09efb5770e7f5c19bb19dd41b00e6042a5c
-
Filesize
160KB
MD5e9fcb41b1fee21cd572a91184c8c23b8
SHA1699099abc30e0d96c364a68f967bd2e26a1535b7
SHA25668590788b1ba533d2f2ca85f81dc711238a37a095722823f5651177b38fc2b61
SHA51230393a706900f3ab4f16ff326a7a9da68863ee254c2c9bb5d8bcfc95239f919b8bb3c392c064c1bfb86c23344769ded300f2c11284ecf89ee8a09d5284f968cd
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\0de658187385c341_0
Filesize2KB
MD5da1e965a7630e567b3d8b7c94e1ab7b3
SHA1a52c03989189149381ebd389eeeedb4d371a0814
SHA2565b02203bc2d0f994d88480f6cad07386e363f775f9121ffeeec0f05042d5ce0f
SHA512c8a982f2d6ed433f2aa874abe623385a034e79f5e4c0991c427e430610e3249cf4e537ee3cbc3d885580abf3ce98c4022cf96eef0a4c0366d0abd316b78bd2be
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5b2f8817a4269732e4e5673ad9aef96e3
SHA1f89d1867a8e3ba54d843b7677e3d5664e7dcaeae
SHA2569e0a964af0f2f675efae45158700eea12ecb479356a4250e2b24cd8702fad17b
SHA512cd832aa1b9f527bea9e44920de57dbad6a3bcdd3702e60838fc2fb689d341ddc44d87289a3f46afa15211064cbdb335d70cd1f0077a6e640c65c8a14512f9f81
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD56cffd77807e7ffba2f7990d27036d4e5
SHA10ce4a6aab51b93a959ff02a5c391b8834e8e22dc
SHA256706907b63baffb0cdda3ee9dc9d4f17272d4817e71c1cb837d63d75e59f16417
SHA51200973643206b0b71bd4da1b62af562dbbe98b9601750531bbdf6b28a4f296b935d37f7647c1e397bf524141559fdaf5f5006aa54b2dcda374fd9f31f8c5d3efe
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD535b2ee793a6515e808d4c774861c1c6f
SHA14c0a6fbea8af3be4d39de6b73107c93baf7a6136
SHA25604b870321b0a5fa5dce3277f12e573d0320b93f0800b92a1868b21ae29885762
SHA5125a573c098bdb4613cfd11fd1bd2c730ccd3405ec2d4583f5fa1815b833133fdc53f355240dfb888234becb3de953c3fa6851fb576e62fd953146b5a2284560e8
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5237e7556724f0b026a3ec8ea015546a1
SHA1c33f7a4ca52d8f3b5e4184df28dab4e139552b9e
SHA256ef40226eae04701ad8a88e05a5dbbaed04b3550a8dbf41ea16bcd3c07403f09f
SHA512e33c2acd93dcf1b0fdeaeb42fd0ffcb42fc7afcab522cc07f388b3343a7dc1391830d5069e4b91f33fb669639bca23d824a69a028d7624c7f2a2c57c0772192f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD53785a68b09da4389e17621a2444912c7
SHA12903e529a4d010785ae480e82e11ae27cf476cbe
SHA256a0c02ff10ac46f1ae62f1c41fd26b59cccc1c9c58a217ee1450d48a894b2acab
SHA512da3328e2fedfefe55b9df0e93fa444db856f4d3a555370d2087339d3f57c711387d5f970826d3791c8e9e594fbefca3164473f4c28aa4fdf733ac2370765e07b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe6132c7.TMP
Filesize3KB
MD546c1e0ca9c58f52d694194f91a652e0c
SHA130cdcf80aed8ff1dc7d782389e5e91953c66bf8a
SHA256c41957426bbdfbb2c0da6827455b467f8cc3720815aa808bf083d29ef0b0e20f
SHA5128492e79719658c28f1605a4df88f8ffef6d0d0127af68dcd717f26b0a05ebd6ff456fb118e857db24397bb8000f33c4d0858f134f632df4a7984657825df8099
-
Filesize
584B
MD5e5ef5346777ffa9eb30170227efea81d
SHA17213e8364603a7b66d3d3ca4daab75a369b87334
SHA2561ccbb1959cb62aef7063a48099257b38e267f1e94a32fc9fec1f1599e279e888
SHA512dabc17d99e27d886f059a281a9784eed2e028d70bdf77516c099cd9f94c1558014a08b863fb2843249dcb01cc874d61e2537cbe1cd3f251df2b78800052d423f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata~RFe5d3952.TMP
Filesize743B
MD56094ba7e3553be2a15aa25b689edc515
SHA12a26daf0518c6b05e000fd2e288173af995d0e81
SHA25680c7ec651a6898480b332f69dc80905e187df4fd4d6ee7d0f519a9f008320554
SHA51214a82181b9fd6fc8393b358f0a54d893d53471c41e16aff4049894bd1ba000e26fc3e2fcda58225f9650439d3a490deba003a731ef719b78d61fb59ec528ba82
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\6f301599-0088-4891-8102-6f827f9669f4.tmp
Filesize355B
MD55510a28970f55d9c5728c9ffa5f02555
SHA154e16cf1d31d9cfc9157866ce0f994a9fa8905dd
SHA256ff6dc787f38cb7411955842dcc3a7966c9eee30fcada6d9a2d82dbbbb88aead5
SHA5121b4ac5610acce4a7d1b35dfad8c121f160fc37b38191bed07aed9815c00608f188e1e65df43f89db241ecd315011c6923bfa874326f4a09c5cb8a51c22805057
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize2KB
MD5acb67a861ce384097529ecc9c92918e4
SHA1ee1bf95b061b8d94a4b22bcc3ddf5317ff9df004
SHA2562ff92a5d160a103157f729b3167bf5e81326b7b08f04f790ec16044d761a4748
SHA512b8231c3fb8a70eb547252d986c4b0e296c1e01c8ae6a4ebd39ce0e4fa7b216f753053f45e18990c07e14204e6bdf1eb3dbb120b43b5b1fe670abe0b91d86b947
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize3KB
MD52b6106bfe8b5c4549e28ab4dafea7fba
SHA156093bf89f08899a2bb70fd0cc7c99d3506a0d3d
SHA2567e5974b6892438645c4dd631666475c8ceb01259befa187ae98181d440531d6d
SHA512fded74d81ce9ff5c5bedc1e13d40479d6c3e7572da8cba4f7c6578669c8e4b40d5d52bfac4fe7728d72ffda627102e064ce08372f59508ea84e6f0c04008cea6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize3KB
MD5472e31e4d8c03ca918e41c0a2ce5ea5a
SHA131d9b1597256dc2672ce0eefd3a5db87e0b042e3
SHA2569339a74a65118c8ea5aa70f50d363075f7fb3f89a43e0275e25e16c5f6d05f79
SHA5125ffbb9242b3d24cd74c0d55e69e047774eba68d134c0dc8e380be7de07cac210e8cfd1373a46a588a4eea89d38eab936c27ea028f84076e393bfb06795649832
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize3KB
MD5610b8dc528dd4a148d518c4f18360fc3
SHA10020bb0e664a6b094c046ba50f8ae5819f0caa31
SHA256965d5e55e92254f876394a28947d0776dd03baf61cd4b02c48f7a1755992d249
SHA5129cf24fe22fac15728913a216ee18f634e15020c3a24f3a663252af3770ef059874f5267dbd8d28f8c7dde3f013b3358fc15144bcf438e1957be58d9ae9359081
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State~RFe59b52d.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD58398a6a7811f39e621c83bc0e349078e
SHA145bfa9ca10c6f6f501f3dd5ea9208fc0908c17c2
SHA256286c9318db237e27d1e3b2074eecfdd66182797415ae18f7677e50f5f56b5578
SHA51219e06758ca9223eede3bfd2ad59fd830e5cf990b69125b376a3f51c08a33985b60912f62423d65df5f4e6297c3d8afd971ff32a3e9c9d31ecb748296de01571e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD5f45aa08a06144ee9b8fbb171e5eb198c
SHA107f9af08549455b32a8fe7893b06f4e049a4c547
SHA2562733556cd52485f5d10146d0faa4c148b6bf9c184ede0e56cf304d938d025c36
SHA512b302dc5ec067fc4527811d0527c2a449d0a96e2d999f50f73cf6ff4d0c8ec0d3d42c500d3c1dd74c07c2388476091869c6870fb27962a9e31e6668b9591affd3
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD52111c51109fa88cdcc304e0f078842d3
SHA179310adb882aeb4a7a61f82b1e5b7a48606c6d40
SHA256b9f4dbcd848907d92ae879e5a6ae8ac4b4f4cd4f128fb65ec348e7bd087761f1
SHA512804f006547cbfa46d6f3eb0b3a36cf07732b5ef5a2526660e5d1456433bb973c61651667d850a15f220c2f0bb60502f62795e99f7f0fa82feea64e323678822b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD52c7eb455c3d95d319dfeec921d0bc167
SHA16a847ca43839bdc005b824526eafec58a218c5bc
SHA2560606f32d4eae5ec0a6aaa1531b8de11b5173990306a8b5edf0357f8f343786a3
SHA512ed262193594a40ee8d6c7c898dfec793847ec17684520a73b4e6fa3e0a5c19c4756db45247ff7a95f68f83338950c14e8210da3bda027dba2610635c88609ab8
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD5ef7bf8aa11e0a6371379095d2a11db92
SHA17d3719838ba74ff01fdca5eee2a9bb79896f82b3
SHA2563e0fdad9e618045bbb9533feb9dace0daf1fe14bac7bd118845a99d79b7f9e80
SHA5121a35c316e4aa487c61f0e13eaed6bcc8e3057ff408359a56e4c73dd081c4fa8907efd0d8f9cbf513aee71edf5e7629d93f76ec13bbcbe9e732c9e09a9376b957
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD587e6adf42318a9f86ae429d383b62949
SHA1069e43c96d9cfeb6e9378ab64937d069260c0187
SHA2562f42acfe69a72e10a069a19bf34ab2b8ad63699742594421a70d968ffac2eab3
SHA512f5c26187493cc1cbb88b05230a6b2eea772991da6b2bc1f4b828a7503b278cbd2cb81305999e8873a933deaab5b00ead77f9e4eedb637ed470c253eacb2837dd
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD5a1f8e0b8374b85c65d6ae1ea0e0115da
SHA1aa2c55b21e88ebff08ff7072aa0de064d011be33
SHA2569dad8a4a2f43ddcc2a18b4f2d1f23a14c0efba533a2d42342aa1c6df95c745ac
SHA5127fc5c2685e68da05d5b8100d8f8b5cc4d6b712a431dc700c75a335317c50f0e50bc3b9c7a0e3b5c5e6af8eb7d9ba59b418b673a4598693f7f92d801db7fd750d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize355B
MD5cfc3e7bb047596f8542b256298952207
SHA1c064ee1f460ddc64d395af67193a3dc9388bad7f
SHA256ae626fec3fa86006a27291e4544c85d580d95efbaa88dda39c7fe55000672516
SHA51217df5f2661b147b0f7167aac1893aa0777c07db6ef6deb77d72e98c809c542140edd8527d52fe0486a7109fa48b8aa9323a03d2dd01c2195559644753915faee
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5dd0767238ee23874e26e3ee87d17d981
SHA13cbe5e9654e153f8fdd4349ee766503e672fb149
SHA25651988f86860ff360e89d4679a4ff5e8af6aacd0f564a43166609ce7bae1a7dbd
SHA512fed5b88b9e832b23867fbb4ae51f51a2ac8ee1eafdca3f9f55e09d2c1045fcd2bd6518f7a16987cde2cc9939cd7682f47b059e371c2e2b491b5df0f67d7f9c4f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5b4b9408ac3fa75d5f673f921021ea853
SHA1b52fcdbea2690e03c7a815497433694aca58e358
SHA2566850dc3ade583146039136af2e3374ef83c6fb7030a62bdd305ead7bef86b109
SHA512eeaf31b118cfebf20df2c9cdf31ae24ce8bcdba34a10c4254faefb00101482f2945a43e0c3bec9d4b2b4e15987af2e16dbff52803fad68b90a4fdfa53c336876
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5f986bf94e1e2713e615cbb272f817a6b
SHA19adccbec9d9aaecd42ad86cdc04c8dfb269a9dbc
SHA256230235b0f81dc440b8be278d8d6c515f1c256954f31bd1df6bc1e6751199d322
SHA512ad9a4f9110bd1f69fac72d7e9c94c0113eaca2aee9237e096a146628c1bc43fff24a17f4c75ccee9f84fada7e64cc21c0268307ff0f8e289df29d9c7d0928612
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5339ad7f48e8a80057a4ce30b57d36ec8
SHA1f2a2de374d40382b0bc6a8c266e921e49122a109
SHA2567cb03bf4d0da754b9171ef7630f1c1bdb2e2bbe7ced75612a9b70c282c88b1a0
SHA512d6121beac42dcdd984a89f3eb793860e5db71abdc67da8085db3a0a124add5f9ab229e6422fa6633a251c72e319498073726510adbacb33c1b64731003ed5075
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize355B
MD583b1cf50100b618e68fa561c9b28e5d1
SHA18175b093df4f99befbacc8dd56186f055c23c473
SHA2567c4448773d984f68297b5d9ab0551e5f2a4fa0e0eced2352b59b9b0b329453b8
SHA5129cb926dfc670ba66f8021fc815fa42b41bf672b9b82d469b338f9f9cae8bc89e1f2bc95e3552ce4aebe191b0c06c09c6c3102e6b92d648355754d7e9875b15aa
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize523B
MD56e6fc9399cf6a19e81c2123935846130
SHA173e89109ab78ca772e5469c63993864432834463
SHA256093db88b1bd1097877111fc3d19505b15028e79e6522beb356e1e872095e106f
SHA51280ed3b399ab60af93e8820e9e98366a72bce8f42bac71868e3b4d3c1bf5b4b6e71105e5409dea88a09a1b9bda4b8c1780ad2419bb769286735c91302c815ce8d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD55a09cbbc3c32efd3fefd338cd11ecde6
SHA16d068a9da0e39ca5fb9c2da8bd4851cec54f07c2
SHA256b8391358b1246982c3b5d4c7c5021b67c0bea0b376488cfed097b931201228f2
SHA5126f9d3fd1ad3be7efb42da23aa93ffda75c2cfdbe53e40520af09aecaefbf58467daad790e5b129218ae1567bec3c8c426cf5932c9be700dc0dff6440851cf6d8
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD57074c9d35f0892527895e4711fe90a70
SHA17909b231fdc7cc48e390be9c655f115c0fd61bc5
SHA2568ef80abed2b04fe9279c777bd9eb315499834ffa12c56cdbd736665af6cab45e
SHA512f1387eeb48da5ca76a01ae944108cf282fe1e5cb36d185b71d5b84c46771ec87bfac1534dc9fbebcba24100d63e8ccb0d1eeb6187aa98ae97528da6a9f6564ef
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD531fe1c5a1f2104b79416152916e1a832
SHA167554c9dae6d189f8bfcc8dfc0d5149b21bb0177
SHA256ed2a964e862587e153f1b2e17721a4e25a7413f70c059aca68dae8245519628e
SHA5123d1da643fdfff3e964546db1ae136526dfed2ece1b0f5f95cebcda0f3832cad8105d24a1aebf4f35e83469d47d5c0da8333f0263d3deb0b167c147da23e74ed6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5501011c15bbc2b85ce1727f40ba2a142
SHA171368bccac30d28516e053de5a6b7f220286d120
SHA256b9553e4c5e3ccb300794f39db0497b97ba492952080c32d86196c1c6ab8e0804
SHA51229214bfebafe6323ddfeeef8ff3d895415a046ae4751770277b9f230596689922a7f3bde47b0e3a67e2e3ebd8a58a0c8e5e0a04fe728c6456200c0845ac2a029
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5ac58d0ad2470c09116e25e24332967c4
SHA172cbfa4f6d6847cb838d6cf2504192a7de34b0f7
SHA25637f30f355a9dd1669e3f05ba21058d4721b894e73c4e871bd857ca45af20dd1e
SHA512a192d55c41b8bd2f6cea3c2afff0ef141ae89eb7f28c7a6e893fd702a02ae000765ea1136912b36fc92f15259aa682b939f60f4c0cea5b2a694ca281b0872851
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize859B
MD5847a7a90b6f1b692c9ea47bec45768e9
SHA1b7a35a928a1aec2b0fa3f06dc618501f101303fc
SHA256297b6ba42e0f2afa73bdc7e6f7078778efad8f0a01ca6894a8a716cc0611a47e
SHA512df79ec66b121d35a03a52469e333d9b59f38d7bd98439117aacd2b36c2c298f4e238837620134d085643fdea3890e05f0594e9991f6e40a3bc4d5af6e0214f48
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity~RFe5900d1.TMP
Filesize355B
MD565b80e67bb731afb1c7f40a3f3d7f787
SHA1617913983d64f10eeda44308bd6aa1668ea8646b
SHA2560ff144122a89cba460895e4bb00d29a82d14e99fc7147e45c14eb0907a8acde8
SHA51275cc9aac2d21298b63f8b6e96f61eee7e2dd5a3e3267963c5bdd58557fc4077e45271a183837abf6927d841dbb8c7fd26ce3768e452ad83a74c4bc66e2197870
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity~RFe60671b.TMP
Filesize1KB
MD5a66d280873f3f2b9ad3a8759d2cbd02f
SHA19f9c8d2fc90b3cedaf16d328d31fea85bcffc78a
SHA25601b06f0b06c51d5e2f3e693ac82dc57f32a8c1c8271241ad3e24a329a64ae17b
SHA512a37e4015a12b0bebba53911f5f683f527f39f3dd6bafe83d21cccef8882def38c88c549b004485c758443f2a839b3df7a801a89798ccf624291b51c9c83e06fc
-
Filesize
17KB
MD53186b75e2af5f0fadca1e334b33c9ebf
SHA1784ac2379899293db8cb06a8c464f964755d9cea
SHA2566c41140afcec4e0800e43b8c03bf55607a929d731c8fd53742910eeb2c09d06a
SHA51231f38ccae208350dcbb4fa37d149fdbc61c643009a928e16bcb29b241eb15d3dbf2ba01aacd64931b7443b0741ef5703f10f667a00f35b94cffadee013461e41
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences~RFe58b6c8.TMP
Filesize2KB
MD544795f7a17887a3ff530075cc173b5f8
SHA15aa398919bc94c04da56cdd06b95e189f4ee57ef
SHA2565160d52f7865674c29ccff9948c524252dccfe9fe5495d4be4ff9bbcf03ed8a1
SHA512323cc014f9ce82fc19083b63660541850af75b5331d1ecb69070d8d4fc76738fb7c012a53a19b188834439fc3fc48dbf0c40ba3b6178069bd071900d25e059d4
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Shared Dictionary\cache\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\dbfbefea-f1a4-464a-8969-82b3861dabb7.tmp
Filesize165KB
MD5dceb0cfa9b61effc8788488f43747572
SHA1c43235ebfd21469a747e8a264b67f874e0400cb9
SHA2564f6f8abe6e2a6bbfea1c79b495019e80015343160d7fd99ecd0d428c9a8fd57a
SHA512a4f5775c654fa4f31f53cb6fbab084939bd929feb95740b904045cd1f0a52c819e90876e56e66f7d1bb38db66fa0cb49c7365511f8346eec3cdc610e32b02c6b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\FileTypePolicies\67\download_file_types.pb
Filesize7KB
MD5d28b6246cba1d78930d98b7b943d4fc0
SHA14936ebc7dbe0c2875046cac3a4dcaa35a7434740
SHA256239557f40c6f3a18673d220534b1a34289021142dc9ba0d438a3a678333a0ec6
SHA512b8dbebe85e6d720c36dbdae9395fb633fb7028fecc5292498ac89276ae87bd6de36288fbf858f3476e18033a430f503acf6280596449dd0478b6ab7139f3cea6
-
Filesize
44KB
MD5d485078f7d518f0667c97160bb8a7352
SHA1397b4baccf238d8cb03338a1bf1ff7a67a15fe45
SHA2560b27442abf9110956a9912d0d879f890c35d86a415dd40eb4cf69ca127d9ce68
SHA5128eba0906bd1c98049c02677803d932880bb131b12fcfdbe784d6f14271d2e7e7990d135b6f35aaf44628942411634645663db67f356f2e3423cbcf54271671c4
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
4.0MB
MD50612c12fc161380d8e486bf2edc0e3e4
SHA1f5314293fd37342ed9ad5a777d64132eb26c8d9f
SHA25647fdeabd2da57eda69a4a6e228c8fca4647b1136a514333b1300208ed1aac63f
SHA512e1ab4257ece331a22c8793c2b88ef1e015a9d45841c28ea59dcc0ce3657adf48191f5c19b0ac42a46fc9e24f4196fa1720d5f2e225cec0c0b7bc1002842f5c97
-
Filesize
51KB
MD5f3b379f8074bab228f96ba53bc56b6c5
SHA181d42f02c18075ce4092ed9eee81fc18c81eb39b
SHA256569f25d3ab5870bc11bf2404c1b38b46d3132c975773cb1ef81f8afcb0ef3a50
SHA51231cc22d6b5ffc43d2d8e372b538aa22f255d23dfcdab0c7c9e4c0230daeca5b62f577118b8cd903ac3d8970a847115d88f874553a65fd2ff9f8ee423de828c36
-
Filesize
84KB
MD5c0f3646e8e2828db9154456fe6edc7b8
SHA11c41f8b60f49dffad3bf5d7e59da0dc348362157
SHA2569c2dbb11b2ae324bf5f6ce7fa2c06adaf76389ef2539598bcaa9192bada21578
SHA512c45ad567e390b0348c3f0fd956d859d5039df4040b84d64b78ee2fe1cf2cbafb3aff4ea60dd076cad5d79d7ba1e740a3ccdbd21c254a57170ae220517a994e47
-
Filesize
77KB
MD5925bdcfc480057bcb10cd2381868aef2
SHA1f7d085e14d17b4f665f9b3504c0e50e7f49781e5
SHA256d3281378f9a4c210ce3b95796129ead855141dd400b119ab23a4b770ad168287
SHA5127511a674477bbe3fe7e110ee06e5fc3b6f1a8b943379289e2d11aa4f49420b156882519b775443106b6ad0dfe4420cd04b46eef0c973dc4b677d71e4844c5cc3
-
Filesize
84KB
MD56ca5bb29d1458643da7a91472ffd97a0
SHA1bd46b60d3a6903312c3d41f7c68f9172f4dbec7d
SHA2562e0211e5b6a0861067c1bc85909cfdbc6bd18049f6a85ec09a0ce8b87b3ede02
SHA512bbb6d85a78b3fb7c076ed2d01c79932c3746d239adbef4dc60b3f8359a8dfbf2ba89044006a3eedd24744206cba0edf00f6001805841bb60d7f9f1518d0a4718
-
Filesize
80KB
MD5df2e5350420d4d68089cb1808093c16e
SHA1e3f385b9fb963a4c1e15f054990a5d56ef340ec5
SHA2569966e2c010a1316f73afcea858b4106fa59d6d747d71fab98421514a9bd787fc
SHA512f403aec07b2474b008d8cc54acbf854ea8698b2415c9b2c4995742039bac49c246647716edf75a9622afde0fc9662f5bd3535762cb5a1adc50dd68a412928f02
-
Filesize
80KB
MD5c64ad71c116264202def7a785fef3269
SHA1b2d1fd5a438516cc368060bc214acf79acdacedb
SHA25663b0a01e81fd3858cc76b394621e471255109cce44c12a1e72e5fc30bc255de2
SHA51266329284a7ea34039ec47a6e9391004d2a0ef61754f905ea3cf6354d4e754b2253a4aa5147596c6eb3ea1e9872876e2fdae8254d8160792203eb0c05d926b10f
-
Filesize
80KB
MD5df0ad9c413253e404d96a00e191f7ecd
SHA16348a9a384793810daaa1860f64b0711b8da5087
SHA256288d4a084b1afe34b4c6bab18279c2c5cb836032656954bce8c6548de67a9501
SHA512012feedb2554fbae506094624e21d87271d785201af43dda0ca01e4ec9c1b4d41bb9b8676c23cff5e993c1a251c4c769aa3f05bfbabb681be8cfeda49a410700
-
Filesize
80KB
MD555ccc7f957efb3c777b55c75dcfdfb0a
SHA1a485a5b26e82e192bdd9c365e1edc6f9f5afe26b
SHA2563c875fc4cdc392d0e788d8f0c70db1ace965909fe79a8905eefffd30bf51bf25
SHA5127e98497d57549fa610ec635d08348aaba473b38cf6a38254c205973e0f900d94863223caeb918a805a3d3d03c327bdd855c952e370cb14084beafd0140745cc8
-
Filesize
77KB
MD5907fdeafcbfeee57d1e572b5c5c1b910
SHA14a34728dbf6c68475f9a44164f8da12588767a94
SHA256ca743ef1c12ad7965588b57f1ea2411315e0efcafee2bc48b722fd2329cdda3c
SHA512c639a74dc9d730a84ac46a12bc2adc35effecdced6b6a8db5b637baf3dfeabf8682b7050881770ab791f3444caef897b993d3f5d056d64534efe57c249615403
-
Filesize
87KB
MD5fbeed107345f75bf0ce4a51cd0b60982
SHA113b2c39ff91865936638bc76952122b534f95d1e
SHA256174a3b1f45575e5829404abfe4b25bb49f183f7099f639c1ad56a857f3c4f65c
SHA5124926f6820a45cedddd6faca3f74139eddb339cf1b7d2623f0d2bc10180c5697cfee58ad872f40b676d26e6b4dc031176c0aa93664521bad03bc3ee7926a9b98d
-
Filesize
90KB
MD551c5d0ebefd920393c8f9ca469df6c79
SHA1994197acd40db608d7648eea0e8a48431232c87d
SHA256aa76344c597794004b206454fcdfcf44f8f3b8b26d3e906b8b07ead991e5143b
SHA512fbe362b39840bfc6e9d1ca4e3d51b5a24c607f546171b25f917332c23efe530d09208b166f8d32bc48348e7fd1cd9b4b31eacea5713d4cf0b9564754e2e008f8
-
Filesize
87KB
MD5877cd4feb65d536ef968c7192ae2c255
SHA1c09b2dd3c753ac52cff17198f45ba7631d8c4bf3
SHA256f4919192e76f874a259b46d927a9c14609ea6d947a616119ed01957e5d49f186
SHA51250a9713a8f1629c332f58ec29fd1b00580b09dd5e4a8678b794d222f07d974f671a42190e91d96567ed23a02297cc4ed2ce09163e11fc36d8a27006d20a8e580
-
Filesize
84KB
MD503ce6e5ddf290fd0cb9620a97bacd6fb
SHA1479e313721dde0b5380b3bbaf25a32afcf5a42d6
SHA256dccfba8a24a322c7aed45e8d4df394ff42199fc3e16d9f95e926d6175946993c
SHA512de08f3e39d19373179b15007b2e3dc7601fcb3d7b788244cf6ccfc4b011706415472646dd49a29c2ecf1e79f803d21473c78f755e7a8bdd56ce371ebd7a6e1bb
-
Filesize
90KB
MD5b9d9f97cd40c854a8ad8fbcd44c4907d
SHA1000bcd361260789e60ab0479d604a35f5101a722
SHA25696682ee3c31ba7a59dd0d84fa44c22a99ca25d23125e0db24e63897e8f3c9d1b
SHA512e5383fce3639f3611b9477f9e4e754191e263e1ba6c8cc1f2748bc524e255aeea41e116396751d77022f9599ea872941ca8e6c6846422d67a70282c87414b0de
-
Filesize
87KB
MD5ae3fef5ab0a7b86ef9d5dfc702d7c0bb
SHA19ea08390794b461b99d25ba81ae48b6e2aee201c
SHA256052d27cb8844e5f39c0f675eac385b952c03ba4ebe2fcf44f3d2ad897d3527ff
SHA5124a60253ee600100e2b32a072cc4c114eaf3dbe8c641ca778d01254bccc9575f393059f5ead6499d5f45dc30b6b2246b1feda17d74652b5de883ecaaaa7769961
-
Filesize
90KB
MD50fd5698ea115a274b9db449b1555a2db
SHA1725f65856ccc88b64d8111d6a6fccae613530f26
SHA256806f49fc8dd004c259c6ebd290b78f09b9f73a023b732e25bcc013d9dc2d1769
SHA51294b0536dba789f01a8aa50c6d66f1907a3be9efa09e631fbb44a047ce732dc0537fde4c5ec713f1f9f392d9e97a102105a224c35453b5e6939e73a32acb9f2f0
-
Filesize
51KB
MD55ceec193d38cf8402417be561c30e2f4
SHA151b4ab1ffd6dc0684922e5d19c15e2adfd0d749e
SHA256bfe4959dba07df529d27db816d0fb1f1b2f925bdb7387cad583988472cffff71
SHA51212122e3a9e266d2bd8697d332dc8e3aef34c9ecf76e9050cfb7e863e62129e2806771781d73fdf562ffdc1f240af5c7378289174c0e07efe5c3bd88b5fb61814
-
Filesize
51KB
MD595f1a21a3612d975009c14c0dbddb440
SHA1b20bfbc16b00caa179ea95bb902cc4dac0b1b904
SHA256d550fb091f04cc372cd6ac3892c0ab271c032fd2a0549547276c54c2dd577760
SHA5127a3676458c926a22aa30e69abcb6021f2b6e366c41fa9d85fda79ea8cb4970b3f291465e32a0fa340b1863fc5d3bf087cafe5a1c11219f7cc40ed76948797f23
-
Filesize
72KB
MD53e8312c1ac08f90b8a128285d0c9fb17
SHA1df18fb24a9a655d656c9a445516e0b1ae22dfd02
SHA256d70a26b05ccdc8929cf71a36449f15668c990fafdaac40f7334b5ef4b7d40911
SHA51228c8ac1273a545947d10f5996d2c9bdd43d87c9dfff1afbce3443fbd4d92d3e46d16d7b7a30af827076940e1ccd98cd2724f102727fe6e7fb66267fd027119f1
-
Filesize
77KB
MD5b89216449978b9fa9978761ce838fb25
SHA116116132bb788d8f306dc1ac623dc18672065ae6
SHA2565ccdb0b71b973fd9473c1c04c6a9eb0a78266bc569a91dff7afd6dfc966eaee5
SHA512052d0cb78fea244d905b2d5f9fb07a268778183bf88c6bbc6e02a446b93562f31f041b3da8778b4369fd1dba21c33e60004829c6a5727036a3b69fe43e5efc53
-
Filesize
6KB
MD53835a272f697c2180092e49d699be291
SHA1ec463c64d5847915aec1402d58a7562f16da18f1
SHA256d937055e453b82b703aad1dec274c20d9077f759d155d3d6de6bcf69d30a3923
SHA512419f1136f5bd6fc2165e51333d048537be73e1eda11713a9e63bf6d4b78907097d153a6c802fba46123e05bc4c4b70058e37040208a3b232b05994dd96cfa933
-
Filesize
66KB
MD5ae0034a7c7c3c7b24a4739744f349b52
SHA1140cf12e82321930c43fecf3851865b7c044f45c
SHA256c26ab88b940e8919337a4bad6ec25ff43ed90cd4504f5dde31cf76ada216f934
SHA512bfd3b2b005d57be5f266013f1874458fb3df2ebdc38490b9b8eea1861cb3252afbef384d709179869e5520c8441eaf96c7e92db60f2a22624e90b01cbc2ef090
-
Filesize
59KB
MD5b5a6f13d5f071518614cb21e503ef9e1
SHA1f2ad16dd6117fa6923ca20141b0c17f28391a12f
SHA256e8c337b7a87edca62fe717a81f538f219fc14d8a9a9548ea792fd9bb3b1ffe44
SHA512769270b004beb98566f0d6060675f85005de37bd4f0f04806836aa7cd2f402e10838f6038500b039979d41a024fb279b55008c5965474fd2f4b21b19b3cb4774
-
Filesize
77KB
MD5f4bd62ca68ed59de063ff7311e35fc34
SHA1e1558c9e7fb6dd800722b60a99308749c0a7dd74
SHA256f0e161a3f29a6b2be59cfc0fcb2c856cd8e3152c5e5ec4305a00e5bffcfaf9df
SHA512e08d293d0daa4b8badbf8a66d802fb0ef9b4b3064c9f0b83f0eb5f42880762a8c735d500a267a4eb0ef8f64cc164268da16660b4d1c4d3ebe637999b8d85c0e6
-
Filesize
51KB
MD5e94d78747c12d08a2ae7f44441375a76
SHA12b61d10d4204f0b615bcdcf17fb7d1e78b6899fa
SHA256718b42e3ce194cb30816bfc8de0356612b0ab2a670113cf7e8044dbdbf19266b
SHA51247639504c4e5e281997edfe737df00b2d55b6b54e19560950b18e3fd5c6fc52ecd0ef8d11de01bff96fffb0bbec7e387b44263adcfc68712e0b626e00a557e45
-
Filesize
80KB
MD564022482a1efb7e6f4c3e740e849d075
SHA166efb9e975c5cd11f91eab8fc0fd9f496f942456
SHA25686b492d53efa2a4bfe7836490e68f7862fed4f37d62b4cfd0a065119e716d0e4
SHA5124c64a01b33f1f12a566a08b80381c2fba3b7f23dcc5728886fd3953fc449e3e24d63b38debf8ef47532398ab5beaabfc6d3c929b0c177b72019f3eae1f5ffe64
-
Filesize
62KB
MD506ca4ad9f8c8432bda27cdeb149e80cf
SHA19a9b47f12cb8e903d876fce805813fda42571f8c
SHA256840da34ac309ee0a039b24c90be36cff0831c715e798fdaf45ceb20985847bcf
SHA5126d20c0bcd3862fa7495aa7efe22dffb3f448732644ae1dfd19cc0b372ee0aa9390de02ab12307cad218af474e8e25a4d2df441ac07cc85aa5c77e0d20338af67
-
Filesize
72KB
MD552a7f831994e43a9e0dd28f6cf0c1d02
SHA13a3ec80507ed03f252da237d341115b897377a01
SHA2561bc2f11601b458ea0cc16bbfe97eb95e375bbb0d93a38e6bc9fe750ac0e192a5
SHA512d350168f0e8256cc7c37159dfc24a6292454a109a11c724b91374d19046c49d5c63cd06c862d4b69131050e7a426fcdbf32db2f023664673249f69a6e3326b92
-
Filesize
83KB
MD5cff64fac1194aa8140c8e7f49e29f774
SHA14aaf3837ae5773228700feb1cd42ecc6875d3511
SHA2568fda44983e9b306dc104432fe4db40c154d3f0e28e5fc61ab86efc70df81de07
SHA51234e7f6b1a314765da7b81622003c42758eb981d8e91e9c07ecfd1f352ce8b00f279dacb800fc12e744bbb8aa0c7ab48d2b49a30c74c36da41b4657a3c232726c
-
Filesize
83KB
MD59a2a7a846e1b17974d2177b9a1ba6f69
SHA14efab9e46c04c91250819a13dce3c77aac75dead
SHA256a0e807577ff81361b4476a69b2ae03635534437a91afb4b67b925d896395aa84
SHA512c18650f526b488504c7932ce7f5c04f798caa6003ba071957a9092a2b67a62104b37749b3b750761c18ad5760878c1bf7d79962ffd35efdcab1c479a9ef9396d
-
Filesize
84KB
MD5dcd1ad162e5c7478ab14f2f8c5e4676c
SHA1fe2b53b6103837458111d0d697bdb7bf22eb5aea
SHA256524b474659d1569de2fa7bc4ab5eadb9776f5c3a40443d7185ba9d34410ed72c
SHA512a8573fb4fd6096115b5067afaace835bbfd8ad01cfd1099d4daa3225e1ee8c57fc34a7a1e66f5d9445ccdf0b8ba1c41ec8c94c778e12c497222b7336f2b6c26b
-
Filesize
51KB
MD58d663f356e4930bc9f412c52fe1189fe
SHA1eb8251f16734a2c9b230681baf3c44e28bcf708a
SHA256fa55856dbb6b806c32642eafbc35babab5ce5db7e26d1b84a100c2c529baa8cd
SHA5128631c82dc0409757bf33e443c742a3dbf3ec146c9b6cf36844de49550645f16605a2b1b1a854bd45ddb6d442f13d6fb4d96e84a3ad38115f8b0f199b89ae2524
-
Filesize
69KB
MD5faf59a3b48db983cec0335cd37214f91
SHA13a72714300cc269ec22b06738359d3095ee37c36
SHA25633193fb8d31bd66a4f0bc481defaefc7c6ce4dd536e4a2d18ff841ace3ebb977
SHA51206604b346061ed6088c1031539728982695e2dfaec5b61f6e9c7afad9884315a78b98f006ce89781855876251279bace419e556b4bcb7e9fa362a2993841fd3f
-
Filesize
79KB
MD50c94b10edfd0254d648d1686cff6ab7f
SHA1769022b10c7a6bd0ad46f317cd5c4b5ca3ffcfd3
SHA2563d315be77ffed0da1619fd76b9e7c1ff41e84f277148cf2a63ab37db224ea1a2
SHA512dc7aeddefac9024aadb334ffacfff9363acd949c13107c54fc4cdeded977704fd0269661353ff4023316844dae95c85651946c31ed3ecd6882208d82870e2787
-
Filesize
80KB
MD578d4e95f859bc49252765679329f0e6e
SHA1b30382d91388397e9ab1283033d77136346e8fd0
SHA2562578a098111fb324175fb9675e98a054ebdd46218e62d5efc2e2fd4d388c62bd
SHA512403d3284a870ec3dea19e52aa192d1076d0cb05ac70dd544b5851097ea3eb11dabae652bca28b1cd399767fd3dfcdf90a0cb4d28a883a9831d0e87b85f7ccffa
-
Filesize
77KB
MD571dd1665c77f8cfec2134340edb186b2
SHA1e2474d060102da4e3ec21054d407c2416d7e36e9
SHA256971cb7fcf2859aa985c09ebf22de3a9999b268378dc9a3b845d2f998ccd58d59
SHA51218f1e06590aa0e3f8e83aefdd0643f2d5f85d77829485765ad8c5e319b51cca6e18012fd50ca250cae86641aeb005386461f8f168ce78cf2545531df237036a4
-
Filesize
80KB
MD5dbc3c6d7d7c3d92e77b73286d5836e39
SHA183070f44f8b9172ad7c9ee00cf35f82017d53864
SHA256309a2cdc313543d869e496576ef78263fc61a6f7a6589d0fffe017cec8db0ae3
SHA512bb862a6092a266ff2d1b74de11199cb14d467d9d4d89a72cfb360635e80e04f7cf87db05fc787ea019bd86ae15ef75f8fd8aee59a1034013e84b463c4ffb3e6b
-
Filesize
6KB
MD50a42928234ad2d6de4fa86231262421e
SHA1d7fd79e43b219beb679718db4aed9def74bc017e
SHA256d1ac498d5b1e7732e866692f9fd744d750a055bcbeb49594fa2f01489fd1b1d3
SHA512b0549903866b7f86fae3eea394de155547bc85803b69181970a45e146c224f596fadb9c06c0121520a83d0aed3ea96f3d4e1e8eba6e595cb517a9879bc0f55be
-
Filesize
141KB
MD557086b02f74c3fe7b79a5e2e3d852322
SHA16420387225ddcd5210175de4f3fdb0ab2be8ee9c
SHA256a1b5be8d4aab349aff58ed34e1f3bc6647cf440830da0a12a8bd5a1c976c6407
SHA512b195eb9a9129863e75be603b00b85ecfe46360910529fb38513af6940f9d17efd56f234b47963452329cd85b16bebb5a85ab5d304743e57d33bafd5b59900468
-
Filesize
50KB
MD546b4d311088a1b5476ef5378009fb040
SHA15f4e068b959d6b52a46f4ce9bbca3149fd3178bd
SHA25633f556efb669f0078999e06d42d3d29393a3909e6775f3fc2eb59e28588b6c14
SHA5123f85d8f6eaea9c8d39df16a527b9d78faa67549af4c1e4ae59fa7bb6bc0acabfb35ad808cfe94fda07e60ffcff26e0c0b508f39e1aa6ecbf63dd9da845128400
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\SSLErrorAssistant\7\ssl_error_assistant.pb
Filesize2KB
MD5e2f792c9e2dd86f39e8286b2ead2fc70
SHA18a32867614d2a23e473ed642056ded8e566687f9
SHA256ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7
SHA5126a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580
-
Filesize
163KB
MD5bd6846ffa7f4cf897b5323e4a5dcd551
SHA1a6596cdc8de199492791faa39ce6096cf39295cd
SHA256854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
SHA512aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\TpcdMetadata\2025.1.4.1\metadata.pb
Filesize33KB
MD50f83ea8aad2d94a32037e90f2812611d
SHA166a2879b881176df793c94f6833441fe153e5135
SHA256628b2de57b5dde868a30e9c45ffc6ff35a820c93a90d3f4ff61a1ff5396eaf54
SHA512e676aa774c099e43c00ecd42d2f10ae194910d9b694629abdba763aefc1d2c541cb1133ad3bf74df08fc6f8fb32b3f3047c07375977ee8d0f8bad9eddb7bc388
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei\1.0.281\list.txt
Filesize149KB
MD56b76b6417714bb0521be7ba195a44916
SHA1b42078040db9db8fc4efb630486edca3d85db410
SHA25663a90f3dc6bc1904e66b0ab8dead0467c7605143f87dabe920522a5decd67a42
SHA512da81bc7635caf2872e331dbc9ddde58a3470838afc71320f64eac6c200f545aa613f76a1424d83dff9bbcd54a01036d2ea61f6534ace726f01c8a3cf9be6add2
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1021\1\Greaselion.json
Filesize3KB
MD57a611abbb6a9a924867db6020cb190d0
SHA1e2f19e2ef273b9f5ae247873ce3306e774961d3d
SHA256b080bd46957a74b2d321e701237222980c202f4139bc4c33056e8b8824f64402
SHA5126646e87023a890e63c7c7aa6b006b41dddfc7b9005a9d70fc114e45614e8bb652fcf4450f7bdf6326d31611d4d4c12f40cdd690313d56d6b214682d98a5ac898
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1021\1\clean-urls-permissions.json
Filesize268B
MD500acb0f14b6b6c11ce80107110ead798
SHA12a40b0217ddea6d507234f236d3889b46ee35baa
SHA2562e666bd0d92b08bddac4487b184c5612dc408f21fe4f3fab78a7ce1b2fa3f8ca
SHA512c3a53397be2fcf41702524cb42c8d2b49d4cbde4c5479c6d0d6e92152cd213dd7436d7729906d76ed003d64e806cdf66dda7f3ca8dd4b9f9efabe25ffb76c2cc
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1021\1\clean-urls.json
Filesize18KB
MD53e6714a16e04d03f205a85f2563eb1aa
SHA1a76641cf3a4745ae2e4426fb10b73a6af4f1f272
SHA2563c09ee2c055819d0ce5368cfcb19cd5384e2916d7a5c2332f59ed60b3545b0c0
SHA51205062fd40cf019b7367c2cf65d2fd219fd4e602111e9bd20b76545dc890f20fc4d1ed798d630bc0821d52ef4c35bd83e63bb84971d10f162d4c6c12eda8526b0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1021\1\debounce.json
Filesize11KB
MD5e0df2d0dc75d2deac9eebbe0ba8db9ab
SHA1d0636e518045a34eb081096f86609744fa47ddab
SHA2565f05b84687de1011614eb1ededfe23d6f98fb2be47ea1a04bae0c95d9a3113c2
SHA512c086e251cac5c121b8841f0dbfd2a45af99991a8b4bf584727c6bbe7e1e52d2361d2ffeb099be5da937b17d3ea36882d7516ebb294b5f2ccd9959424c2a5a0e0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1021\1\https-upgrade-exceptions-list.txt
Filesize86KB
MD5b8ebe8c70e14e1bdff4bf04cee9055a4
SHA16a8eeeb539eb5f630091a971585bc77731c24b12
SHA256a9c464c1aa17ec9958141c020c30badddd4801e15b9c0a0d430859df0ad1955e
SHA5129240b1d7ae17b6d20cb21a466335471d3b62ee2866e6d07dc62c1a288def513cedb5368891e4c8beecd135140a221bf8a16e048cced31b29fff9f8d0d40c7266
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1021\1\webcompat-exceptions.json
Filesize6KB
MD554b1343eed0640cc4b415bd1ef50dba1
SHA1df0a9d4bc264e7c9325a9d082ddb3ff8dea528ba
SHA2569344abffe1529919decfc08c1f171600319625ef7ec9a6d63dfac4927d6246b4
SHA512c7689d95879d890425e95322613167cb6be9c04f207e847fa3f6da4c752413325968a667fd3044d8cf08a74537a1affaffd02dfa33397079bdc603768f757e92
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\StudentNTP_Sam-Richter_x0825_WINNER.jpg
Filesize544KB
MD5f66e5fa138432af6b40849484545b809
SHA125942df987649a1bddda636686064d29dca799a6
SHA25665b5f21ccdcbdb23f39baf036ae5eb3999f3e88e241bc57a3a4d1bf0fbfda605
SHA51229a512f0f028b2c4e53f492f6a4fe27cc88b547334466341b08b70724b16e7eaaf70cb0308e251f404aa6b80db972a553438afc3894440e1b1ed0962ec7a5319
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\photo.json
Filesize6KB
MD5a7e80c8cc5121a2febc654140e53ac32
SHA1c3b1b578dcbf91aa19e65d0ef6974c165723828e
SHA256a2595174656b59176071c0b79b404efa7246a9242c2bd19545155194c6b8cf99
SHA512d7ef1e8df49956bc212388ef7a5343b9836e825c4ff066aa65bf0f3a136ecee4b63ff807dd63eb33e6e812e470d644eccaf3a7f61a816e441ffc44a982690577
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb\1.0.10518\list.txt
Filesize54KB
MD531f0e4780e6c1c701c06e2cae1e05888
SHA109d4b64450159f9e4b8c1a11cef0b6daa110f8a0
SHA2563c67735fb26c98b11e9b86ae99fd1e77f58edf31faaef027b4edf76e9edaf1df
SHA51273d7b2b3b3f36e28e5459205bc38d760b1f932ce091e46a4aa89ffad0c44da4af0e5ad5940cbbd938572001a46838a43aa58b214ba9aa52a07df319daf30cf9c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe\1.0.11676\list.txt
Filesize1.4MB
MD5413a21463fc9a099002c631d17cd7cb5
SHA1876e74c6c8bfdac7e8c17dfd1d461b0526e8c1b1
SHA2565dd3860fd4009699c5b713491b2f68bfa1ee7b040d2e01adabeadd2f5bc7c022
SHA5128120bcb011bf61ea0d6cc7ac840b544b5d0f32a6c11499de6ae885b5cbc777cc440b676a42f6b52f4fdbfd58c0ae66d6569844454dab85a51dc25e2545286faf
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\adcocjohghhfpidemphmcmlmhnfgikei_c851d38174f9e19e8ca8604730bcdc3fb14e973e5e288d4d5b3dafe3584b1f93
Filesize50KB
MD5e2ee3abc76f54642a1e6e02b0035e55a
SHA12d2f964f7dbb248009d1dc31b7e0194b7a140ae3
SHA256c851d38174f9e19e8ca8604730bcdc3fb14e973e5e288d4d5b3dafe3584b1f93
SHA512915f70f8c301a9f5f46138e965f621e5b361b5d569e168345a87c0bcb7e1b48e6778c9bdbd37213ccf1e9bff8741e51f4396f3ae3865ea7caadeebc2e4a78359
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\afalakplffnnnlkncjhbmahjfjhmlkal_a2d8ed4de3d36d622822a456a50d3d1af489b817a9258c85e11bd0f010664e15
Filesize71KB
MD50ba8ef6f2b4463b6ea5dd0c429a988a9
SHA192963fb4410455c423c332e210d3ce25aef8bf01
SHA256a2d8ed4de3d36d622822a456a50d3d1af489b817a9258c85e11bd0f010664e15
SHA512962fddbf9abbc63432377d693b0b82e32f4fc565ddf6ddb8fb7fb6518bd9491b9acb86b6647f6df83e4db3430d12e766caeb03c6368de5e8d4dd3f1f4cacabcc
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\aoojcmojmmcbpfgoecoadbdpnagfchel_9f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a
Filesize12.1MB
MD589c01a540e21a6012c4292eac6100dbb
SHA12bf600a9d372f38d37c64a9df5cb26d5cb046cf9
SHA2569f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a
SHA512abd83f91b97c9c9bba4cb82501a6d316ef07173e4916e87a13f888ad32947b424d18bd6186a36245b2bd9f6c6cd29ccaaaf2445b3e5754c30ea53f1ab6016f25
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\bfpgedeaaibpoidldhjcknekahbikncb_571a8f1b10c44b70488eb71a42e4d30efb7fee3640bee0f7d621bfb36690a48d
Filesize18KB
MD5a9bdc4ea072026f4b78d35619e1860ad
SHA12428fef4e8442cd2a00465e93eb7727062a6dcce
SHA256571a8f1b10c44b70488eb71a42e4d30efb7fee3640bee0f7d621bfb36690a48d
SHA512db2eba6474e5f0be6af9b8ccf3375a71a924abc1c35a36fec130dcc86806564d97374783eb9389e089702b8325a7d1f17b6c0859198398cd094b422316b59f71
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cdbbhgbmjhfnhnmgeddbliobbofkgdhe_044d547a728c70e08ef6dc63ca835fd5823ccd73f9bf08eacb40c455bf7575a0
Filesize412KB
MD522b0899974d636b6abc3c01bae3f39ad
SHA1077607eb0fd31d6a3c653958da5ff0154d40ddbe
SHA256044d547a728c70e08ef6dc63ca835fd5823ccd73f9bf08eacb40c455bf7575a0
SHA5123b4c07c9844bd3772fc18d6239bad3d7d09adc290598cffe9033a312a02176fb398c5453e08875f8f7c584d6bb267534eb9b9ac6e3ed6ed5e7f4de4e437bad6c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\efniojlnjndmcbiieegkicadnoecjjef_1.9645143596dd859c7d9cc843cf13378660ea1b16e7689770d229142a0a3724c8
Filesize150KB
MD5e1900863188285f81af2e44329c5dfc3
SHA1fc1234b818d73e3925c9e308644c39b7b0a1eae9
SHA2569645143596dd859c7d9cc843cf13378660ea1b16e7689770d229142a0a3724c8
SHA512be5c29c05ba5a79118e5b4d3223c27b50a00e89b429865267cc468a447fce91ec6e27fb5efef108e362a9d5722ef915cbf453199253b8b08560247be2566ebe0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gccbbckogglekeggclmmekihdgdpdgoe_ad18e8a6c7a0ccd7079e576a808a701a5ec64fe344bbf02bcae2a53161b43da7
Filesize512KB
MD530535c209a686025c0ef9dc2a9e2ee84
SHA199bbbe59ea66b96a988e921a22612256e464c0ad
SHA256ad18e8a6c7a0ccd7079e576a808a701a5ec64fe344bbf02bcae2a53161b43da7
SHA512d116a0e9a9c7d9342587fd3953a61889efbc127f46387bbfda94bc788a8d6bf7b67f2d0193cc2fe7d05200a6811820b2c05ddd0ab284ce785aad77329b52bce4
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ggkkehgbnfjpeggfpleeakpidbkibbmn_1.3525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f
Filesize10KB
MD581c39099b5a4e221569eeec0a746af7b
SHA10601105a54e905370e965cbf8cf78bd6d8e300c2
SHA2563525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f
SHA51242011c20c52733df0116c4661efdce06d8ec70dd38cfae2cad45e4b4eb7cb24ab4061e968e4d5766e4203b8c4caaf2b6727e55bdf78402157a19eca0f2e89140
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\giekcmmlnklenlaomppkphknjmnnpneh_1.3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
Filesize5KB
MD5636c653ec2c30bb767533901a18669b2
SHA14b5a01cfea4c5deb62f3aafa01ef24265613b844
SHA2563eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
SHA512a4128fb20a5df9e573e92b45f5bc18dcdf4be6e7e39172d08847882f17361320141e89b35deef337e40c365d6f1ccdd1b991eb4593d805dfa2e39a5257c335ee
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gkboaolpopklhgplhaaiboijnklogmbc_9b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f
Filesize76KB
MD534f31f85a6b2a69a074939e4e231a047
SHA197f6d1a966baa94e686aef7fece23bbf099fb8c6
SHA2569b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f
SHA51220f4d9efe5450e1f02608d382c97bd4269298c87763a4abcf63a5fe0ba62dd0c391824964084cc011ed6cd7db99c19c9b6411b04d42539081f3737dc78a2f2ed
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\heplpbhjcbmiibdlchlanmdenffpiibo_69d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f
Filesize4KB
MD53a03f3ab4119a23fa6b70a32a6fcd4b0
SHA15d047a5da7c7f388416aa50b5fba745bf5f36eb8
SHA25669d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f
SHA5128caa4e94e831b25226e956a8ee87c5b369547081df863ee34e7f80d686259eb9b7bf75757043ecc5b0eda3a603198da060f9b6f30be755350ab912fdc7681819
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\hfnkpimlhhgieaddgfemjhofmfblmnib_1.02fcbe9bc5cc84cfa840f47dafeac6b31d3a786425130162a2ec53d4915fbaca
Filesize601KB
MD5cbf2f39ab3042ae6a5e016f2bd82dcdf
SHA12c20c89d8795fe227cfc964915e4742a9ed0e420
SHA25602fcbe9bc5cc84cfa840f47dafeac6b31d3a786425130162a2ec53d4915fbaca
SHA5122de3de8ec6278826d717047aa304114b9408fb0956742a362ce99aff654787243ff9319f4b1c340caffa644674da54c156edfabfc83d13638c73ee3548d7af68
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iblokdlgekdjophgeonmanpnjihcjkjj_44fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72
Filesize17KB
MD5a1b36d762732f9439efa78708a40dafb
SHA16533b78ae795077fa711c67347eabdc88b5a6c6b
SHA25644fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72
SHA5128dbfd514f87e7b929ab9d2b61f99939b3cf687947dff980ce3378b56127785acacde7b8fb4ff034e2a31f8cec1901605c6216b6846f5d2a199a245bf6144e05d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iodkpdagapdfkphljnddpjlldadblomo_b4fcbfdc9f88d36d536ab45ba8a5f5666aa14d4207587d47c103f899f6f99704
Filesize1.6MB
MD59cc12100f1c07043ac24656331bbd5e6
SHA103c0be07ff5a8074508cc4456e545ea7f3a313d5
SHA256b4fcbfdc9f88d36d536ab45ba8a5f5666aa14d4207587d47c103f899f6f99704
SHA5124c0ae9a07bca918e1b0a4c90d90762cf1e17161a009e95471b4915765809ba4dea23e4281e6dea81147a05a5933dc2c5466de51c306fa45bd503be7c499fc187
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jamhcnnkihinmdlkakkaopbjbbcngflc_1.c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
Filesize1.1MB
MD52ac309d48a054c8b1d9ea88bac4dbd6c
SHA17507922d88a9cb58759b5326fadae5d0c87f40b2
SHA256c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
SHA512870dbb86a67f36a43ad4c80db904e76b602bbe062cbb9fe4222d1cc69d99aa4a60aae91c094a65a481d8c62cca4942f178f1b2744ed21836a526c7ffe3409969
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflhchccmppkfebkiaminageehmchikm_1.f21a59184fe4a151d88be7fc17155de7749b7ca9fd926b442906d722951bcf43
Filesize9KB
MD5834f1b218698e9303e139c7abf2f7f23
SHA1383bfe4fe21cce3e0d7c55c0e44f5294e3f17d57
SHA256f21a59184fe4a151d88be7fc17155de7749b7ca9fd926b442906d722951bcf43
SHA512cc07403c621e4f169360a02df9960a2435c7227c09ce1f453910b72220cd2d3ded38d953fc82b5125831ba0f7095d2448fce1b07d3316b06ce8850f5a1ceaced
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflookgnkcckhobaglndicnbbgbonegd_1.e698359726dbebe13881db2d3d53856d8a3a1ffba048ac94773036cd08a60240
Filesize77KB
MD51068b68cfdad67e39e13fb7b97adbdb6
SHA1d3dac92d9c28b948ec33699ff69ae75a900de6cb
SHA256e698359726dbebe13881db2d3d53856d8a3a1ffba048ac94773036cd08a60240
SHA512da6c4d63d8d22e231d5101d93429a3ecc33c89d62b5fc969c7276816d79f8cbe45a16652507581480edb83b61f0e1c57f41e4432f6fdd67c878f38e0d4eef64d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\khaoiebndkojlmppeemjhbpbandiljpe_1.44c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319
Filesize5KB
MD593e97a6ae8c0cc4acaa5f960c7918511
SHA15d61c08dde1db8a4b27e113344edc17b2f89c415
SHA25644c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319
SHA512e61727a277d971467e850456fbc259dad77a331873e53e3e905605cd19b01c2dc46df7400ce8442e39cfac5ac3fbcd833ec7310c7ab1c3380d900dd676ed1679
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\mfddibmblmbccpadfndgakiopmmhebop_bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3
Filesize179KB
MD562af22ce07e0375e66db401f83384d5d
SHA1468b255ebdfc24ff83db791823bca7e78b09f3b1
SHA256bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3
SHA51254dd31001427a97665dad169b0d5f32fdb79a89eac7fa23a164bf78095be2d2e5f9195eb9ffedc2d1998f839781e32515baeae482ec74d8409b0d58fe53993e1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\obedbbhbpmojnkanicioggnmelmoomoc_1.a7d75b5f952f57a8028dc799b0f15e0fbf2862a2c1bf3746e612a6e4c9d02c89
Filesize5.1MB
MD578ff02d395683665735952ef365605b3
SHA1331171dce711732b8b50736aa18af2d882ecc878
SHA256a7d75b5f952f57a8028dc799b0f15e0fbf2862a2c1bf3746e612a6e4c9d02c89
SHA5121d04ae64e8d899ec9f368145b0da6753dd2be8f2c76c11ae86c6b31316410d847f6b482d047551fca5099ca992248d70dfec0738cc9c6cb31b6e966c15c5aaff
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1841\photo.json
Filesize2KB
MD54d4e625857a93978e93d63fac38f69d8
SHA1857f062d0197ed13c3f24d55b14163a72df00faf
SHA25682181ae69ffb870bd43cf3adc4a092948b743b4f221666ddd17de19fa7f0a246
SHA5129641efd8df5386d3dbbee6987f9c3a987a7cfc15cce2b087885228573a29c6b00a6930e75a16206fab29d9c57990e71e225e3a9e55e2a0f621b7470b25ea1135
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc\1.0.69\list_catalog.json
Filesize76KB
MD5d1d6a9d9cc2ada3f3bad8b0da607f4eb
SHA11d286de6436a8a28584744f022af73077ed64601
SHA256f1a889c0f11e2642c299774f601b72b5cc51e86bb1fa7514cfa9f4fa1a9538ad
SHA5124c43a10995b91d2791a8274813f005feab48d83078fb8b51f026266ff524ffbc53c41d507d801101a9a7f765453ab4b08398f4e743b6beb08036b72e40b82934
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\heplpbhjcbmiibdlchlanmdenffpiibo\1.0.11\mapping-table.json
Filesize4KB
MD557ff689022f2d93d2287ac3b48daec73
SHA1937b7dc21193a27607340af7fb7b987b8ea50582
SHA2564665c8cb39b1fd0131b72097484bd3a8309992821a21de9ee0420434cc3f7d5c
SHA5121b81c2c9df45875c2f563b99bb2d29972408e3d449fb2e8793822dc0cf85c41cb48eb92510f4940343ae4826ec9bb4b98093d64f53de635ccf75b5307b92ca87
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iblokdlgekdjophgeonmanpnjihcjkjj\1.0.106\resources.json
Filesize269B
MD520effecf10eeb0456cc6f537c802f172
SHA18fb3968af27ad30c639f45a6fcee99b48ef79878
SHA256044502a67e39049b4cfe2b80295ad396fff4d1a28e7f2a1200abf21061aace8d
SHA5126a002b205519c0fc498c139d1efcab2f26bc03f3fa795a5bee9b3358c9796088bb6419e2b95afdbb84c5ea36a328dfab01b33c148c84dd8e3b9d21fa07fb6dce
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo\1.0.9921\list.txt
Filesize5.6MB
MD514bfff83e8bf52d56a493122b26b4309
SHA12588127d132f529af46e7f4bf684fb969b8d82b7
SHA256d4da5f36ccb20a9e04bef1c1591561c347781e53ad6458a01a998dec0d515907
SHA512a0e343305e06a5827a105d36fdde5808a1e69a45c7eb0d81f93200e567b1b13d9d6fc96013469a6d75ed49a906de932cdda9dd76fd43b454ac98b0eab4c9a2a1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop\1.0.104\resources.json
Filesize1.2MB
MD5f7e232619fcd50a55c3df6ffbab0245f
SHA1f26eff68192fa88acc08ed97979c258f8f534a33
SHA256f4e1a4ce5d42af762210fc9218115a1048d3564ffbc987b4c47f1d9321dd35e7
SHA512bbe0d62000740c6958e8630af812bc388011a225785e3f8b3b7ccdf2e033a42d63db566df030244ac22884d005f5f2048b4a506ae64a8e7062395b8bf08430f4
-
Filesize
649B
MD57905eef470b2737428ee5e7bf4c2095a
SHA1f7c72e0c76ad8442a82c3515bc9fd36064a6f40c
SHA256cba73a2ad947ba83940fcc8c9250c4c8f6606f5d725f9e36a0ea4dcc60482075
SHA5122915462479a0df0fd5951c305fbd2a9469f8d54a99f2a318b363c2ac4ae08e238b868f62bac1c5a761dc7c80acb071ef74c5e66dc9a9cc2095f42af683d1f0af
-
Filesize
792B
MD5f0c64e887ad4ea58d70445aa8b15cd64
SHA144054d57d83e64389893068901023562e1b454ed
SHA2569f6e724ac6e72be658999e571f6502cc4329a02e71673368242c25082a222fc9
SHA512d4fc992f033a85a8548e34ddb3af3d79fabe3fbef947a04e53584e931db7a6fe9b96c47bd5086853e278a5b94c8833f843cc849aa257003285e4a4fdec6f26de
-
Filesize
5KB
MD5931da654d6b3a85185b9413516dcd41a
SHA1853dacfe362840bbf0f4b99e80caa68278b1a9d3
SHA256c9eb438db5ba017f0aa54c1737d009b2814fb5d5d0db9b9372b25ce22c185196
SHA5123112e59c39f36e4b5315bff540a8c30d2b665d399cb06c990b270553aa433426448d064f2a9b22e54c82e7bd5aab7b95cddcfe2b99793953500cc02e2cd5e3fd
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD51718548fcd57812570d3886aea111df8
SHA1f130632a089c478b675868d8d6f86927c1f4058a
SHA256179912c9f621180c679bcb38779da0694344443bb8eff866664b40c1c143dfdb
SHA512d8ff9036f65cce55adba310307751cbeb1cac208738ddc83857afda95c50a937a671210b013530142b8b8e04dc7bf55fcec38bcfcfe1146ab59c64d859d0ea0d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD512cb8e5f6f756966572d9db14d57b15b
SHA1a6e418586018b2f2a471f15bce962dc152498e79
SHA256a3abe06896342b8068753ef2c010ff33376499083a24a00cb26bd4938d91bc08
SHA5121022c9ba59acf3e69fa2f46c8c637b580236f74ad351ccc18196bfb3b05786ccdbd48025c07b2770262e103ff91f4a63277a36364209eb2c359e9257fa768c78
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca13f358-99f7-4c87-a75b-aa7666286d9e\index-dir\the-real-index
Filesize2KB
MD5b6d4016202ad015397d185991a22d5b7
SHA14218d887644fe23146b5da878e969c7c506e3373
SHA256515441d97d39baa6e3d3f73e24cc2729f1ce7353c564691b305281f0f70ec14e
SHA512b41ffed8f1851ca2a0f8471d842e40e9b0a44cc728ded04a579377ef6023ca71d7a1593f16036df6771edfccb3a3d74ce1204b755bcd5c8bdc81464d18759a23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca13f358-99f7-4c87-a75b-aa7666286d9e\index-dir\the-real-index~RFe57a325.TMP
Filesize48B
MD59605647b59db7c55da5b9f4bec328588
SHA1d0c86656d769d9be993ed9e385f0274a07da999f
SHA256998376445cd72a15082af3cb886f7e7a2c55dc993b225d28efe3523284344e0b
SHA5127f65d2f345f373f3fb7ee0906eda0be26b03903860f75905b624ffa9c1b61f4e58d94e8403fa7380eff330fadb7b9313ef5a4b08414b55d7f00e1abd725f6328
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize114B
MD518806146090a886ab8d21a059bd07504
SHA186e25c250bd663596b00f93b040f607128596321
SHA256f93cb4332291ce15fb2e5b29cc87b3cd560fa1dfe40e838cc5b5cb5c485c92ce
SHA512fee1450564faae8b2b3dbf03f987bbbe4fcd857eda8b2457f36bab3bd409efdece3c1b570f0947c0cf229b2b44971f0d65ba91675d436e7256d41a1659668283
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize176B
MD59a32ed602df6e7a391daf3bb0867c408
SHA149212b3d187ac4266ba8ffa159af712a3daf9a77
SHA256fcc8d85d7f1cb7cc3f477546f42508d3ce7676aad27442d92590dceb5b96c1a0
SHA512d8cdf02d30ea793c5ba0b43b0205845c63d1637a8bf99cde6baa0435ac1437494ed0986998c96a5c2ad3ad5853a960e3dee13f11269cd74ac11929b1345ecc11
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize112B
MD5a7f547e1c6c52603104d71973e1ba266
SHA10d489d76ac4174c296aaabb12432bfa811f91b55
SHA256a562b5ac75605d9bc06fcce5c5b484a9b6ccf4453ba60ce807fbf4b561ac7a0b
SHA512b8fa8b5e0b594d532f255cb817badb284bf552d080442859b133ef1f7e8502d8304574a31c7020d91a8bb7bc647425ce0cb16bdb3a3d2506242c06245859d7b1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5798f4.TMP
Filesize119B
MD5b8edd326625642150e82026c08272619
SHA1fda3277e06203140ae3b508e81230bf987d1ced3
SHA256e042d53041d29bdffdf2978e76ba1ecd7373dc02bc9a8a9c225c5876b97e2ac5
SHA51205a005327289b3b771b9cb024c1bfde47824e9788cedcb8abf62d3e797183e76d0ea0deb4d79e0a4b58fd6630d8c15d8724dbb4cca9b8f009d687bc4913c114e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5a12f7d4c7a0efc889b67c359652479a8
SHA19fd574e6155b5de5e9086676f726ebd5ff929391
SHA2566a7a836c1ba956b47cac5cd6a0422ccc9cb5dcfa1b875b1a2a25e156d2980e88
SHA512e11cebd4a34843698f42fae57b4e7674cdf99b201708f4cf8fc3f85aa91b7ac18304aa1db8b0374bb60a900af395f0492f3d255ef34700120b43f448287ae3ae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Filesize1001B
MD59b4d2aa85bae2b94477371dba6544b2a
SHA14dd2d97aa25b2723a91016ee5b403619e7a4eb99
SHA2563af45701fd97bc8ae6ae8e9f999d5d8b9d61a9a7914faf6518450f454e884223
SHA512f6351c370d91a87a2b0abd8da8460e65a8149700beff2e819074004101133e750b1e60ecdf6ead73d1de19f37258e7853084d65c6adfeab8707c480d9caabc93
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4736_1919068258\Shortcuts Menu Icons\Monochrome\0\512.png
Filesize2KB
MD5206fd9669027c437a36fbf7d73657db7
SHA18dee68de4deac72e86bbb28b8e5a915df3b5f3a5
SHA2560d17a989f42bc129aca8e755871a7025acb6292ce06ca2437e95bedbc328fa18
SHA5122c89878ec8466edf1f214d918aefc6a9b3de46d06ffacff4fdb85566560e94068601b1e4377d9d2eabefdc1c7f09eb46b00cf4545e377cc84a69edf8e57e48b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4736_1919068258\Shortcuts Menu Icons\Monochrome\1\512.png
Filesize10KB
MD5529a0ad2f85dff6370e98e206ecb6ef9
SHA17a4ff97f02962afeca94f1815168f41ba54b0691
SHA25631db550eb9c0d9afd316dc85cdfd832510e2c48e7d37d4a610c175667a4599c6
SHA512d00e2d741a0a6321c92a4aab632f8f3bafd33c0e2875f37868e195ed5e7200a647b4c83358edcef5fc7acbc5c57f70410903f39eac76e23e88a342ac5c9c21cd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4736_1922833029\Icons Monochrome\16.png
Filesize214B
MD51b3a4d1adc56ac66cd8b46c98f33e41b
SHA1de87dc114f12e1865922f89ebc127966b0b9a1b7
SHA2560fb35eacb91ab06f09431370f330ba290725119417f166facaf5f134499978bd
SHA512ce89a67b088bae8dcd763f9a9b3655ed90485b24646d93de44533744dfcf947c96571e252d1ad80bdec1530ff2b72b012e8fff7178f1b4e957090f0f4c959e0d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ea3757d0-d355-4f97-aa3a-315336477837.tmp
Filesize10KB
MD57c42405b7c83197a54a593efb926e891
SHA1255f60f6125da8f0bbce48fbbfbe546f35b17217
SHA256dc706292ad6358c3db5b9660b9ce64781131c5078aa2220ac34c9b5fbeffbdce
SHA5125f2e8268161091a381bfd629bb698ad3071481f7dae01b546af29ed38014f11cd906969f68b1acaf7d030d5b00b2363b0938f43d05cca2183158830209de8f66
-
Filesize
228KB
MD55a73d9e7152e7fe2b5e1209ad83e92e6
SHA17a234e354b4979fc10689a1f5599624d7438a76b
SHA25638ba16ac068dd56de5b574149c75e8b241158309a67821cb9e46af362632471d
SHA51238b52a31bbfe83e87e6a6916fbca39a599f5e3af5382d6c2d081d542663c5e466d0c395ee82954fa12ab427431a265d7eb7542ea7ca99ea6b6a2ea1302622135
-
Filesize
228KB
MD56e949404ed6e37ab3bf2725bfc4b3fe2
SHA1df8d9ea6b68d5b45bb79eace2766dbc78550411e
SHA25640702491afb6e0c87db67c730d5c52c05dba97e2b49d458d0287647a254440af
SHA512d53803948154e8e4c058d470cd18fa8122f1b4c2e6af704f288f362a2af09f619ff653297ad60afc7a38bf3f53f6eb3ae4a44ca5d126174d3b8f71ca0548118c
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
Filesize
28KB
MD5d5085de158e21b537da362cc41cc8afa
SHA189d2c47d607341e06e41322b33588b06047ae388
SHA25623eb888a2797194d5d88e58c44bbf1f84386d62defdd5f236a4ddf933ffdad5b
SHA5124bf9e5bcca2d50ac06842fcd39e4fc7ad134e69ebf1df1c99caa7b44145d94874c0eaf67bbe993f651a2c17a9a0c6cf1d277da006bd6317e507a17e87df0aedb
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize16KB
MD5082ad5d858a64c08b429c338ce78aa23
SHA1d7f4cefef791218e94d273f6610429173488c9f9
SHA25628e2e2fe7a1c26807746fcd7052f47e073bafc0129143fbdca02ba8d6ccd5f86
SHA512839320f552d1ca18c0fc944494e44d0b5d6d3ac2d52d3eb3d8beb840a263b87c49be1cdeccce5ba12cac4c2dd91cb97ecee80d60a38f2bb6e09d94e19bd099e3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD52109bb40882aba47145920f5d1a9b65c
SHA1190c160f391f7c3930bb7b50a4d7dfdb9b355f5e
SHA25684e5d4d231466ad5b68e90b6510a85919d4a7ee5aed69c13e9a4c9d377520e9d
SHA51261a685b65757be3c3fb49977bb8f1af62e3084f557aad30dab7ba0f6694c85f96f6c045ef417408dc5079e09a97a657f7c8f65b57ec6d8b882772a1007a5b622
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize17KB
MD59c170aa570875773c59a814f62704b2a
SHA14ce8f5b67b239c8c01f06fe2054cf080a3a5e43d
SHA25633ac73e57e3a672537cce75b5628d484357ca6a80af7b852a86304371f158d20
SHA5126267b0ac3f65a1522bb69237aab9060d3178d0ac50dae47646af4e5c92dc312df3f3e3cbd87867c1cb8e6e37b1a67d76100c0d2794fda93e50d147306beba135
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133805829117453741.txt
Filesize65KB
MD58e285d45fcc3a0128ada8891f6baf5d8
SHA19b4f670b15fc9af069320b3a156d668f37b2c902
SHA2561aea388d979cfebc98190d04a29b12f64b83dbab3a6d82a9b6887a3c6a6a4909
SHA512d4cc2bf678316ccd27b46d45d75e8388a466506c0b3a5a25dfb8d882b8acd9819c01ad44e4d650dc079f29e24099d77f2b67754481d5ca229e75c7ea7a291b80
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133805829148118983.txt
Filesize65KB
MD59ad0807e1a80feb5f8d96528a88970b3
SHA163918f7d450f8244230265bb438e83fc0c5aa63f
SHA25661ff9068657034150619f8102a29d279790656311ec4dcd90f0fbd5715f35c5e
SHA512d3180c6bf4cb0999fe48db521b0d27327515004fdb3ab94d9fa92c12658f05da0a29adde2f1d71763e2c15e8e0ecbd97ce1ab9804b897e85355a3dc19f6f9748
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Filesize9KB
MD5c914a75b3203f7444879d65d75c49ef8
SHA1e00513f0fd215c862e7ae2525d536682e148a0ae
SHA256ae993d95e50ab798d57937398dc72f7d2e7f60cfe97215894106229c43fe71a5
SHA51229e3f81e2ab6f24da8047381aac5ac8c9bd7b9ce5d1d37eed2d5515edf5b5d8c90ecd9365a6838feaaa546ccb6fc9ac4ba4285b03bcc51863bfd6516cd751957
-
Filesize
297KB
MD5314558f9a6da39ffd12cba6c1064b3b8
SHA12c416cbfa8aeee687534b7c0888d411c0a837c59
SHA25664a45b42204cf4412dc2891368a4b72670642a008b13f3d99f6d3d42de95a842
SHA51241fdd3cff2e4620c0dfc7adca6a985ba5af69c1e72be409ae8d206534e32e1d3d34358f3f90521f57969c3cdf391442f4dfeba2a174b3abcbe72257d36706947
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Brave.lnk
Filesize2KB
MD559be67525c5d4418c22982a23e8d115b
SHA15d5c197828b1a0e67633b3e3717b4079793ad286
SHA2560a31c8d7fd306b3d258f2379a4d740851b706c0cf108be6a3d8f052f520105df
SHA512cdc40b2c6fe1ee4b6fd645b9f3e4891b5372e065fe0ff53ffda763038e7d734677e6f6cb04d775716cbd18dfca7ae9e0afb98f978a82195093134fe6ebb55c9b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize8KB
MD55532920ab7672ede13ffa5c1aa29ddf8
SHA198f175b140bf60fc7506399c516f71bedecee1b1
SHA256013dd6a5c01699cb0ed67cd2daa1073fbb687061a2f73bc48e89ded1128347f7
SHA51282a2c228e6f929629fdad82b837222425fd5d0529997158865a4c68279f645f33b874a2f6ede43cb33daf754a0032f36bcc1c3661e91841f4c3998a71cf45ade
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize6KB
MD584dc2bad6a8e9667f9f5c33090b9e589
SHA1ab967264416c0e8e37f7bcb205cabe8dd54b1609
SHA256ade95e713e89671cae6982095ec66dece4d8249c54f9fe14d13e3cd4493c817c
SHA512b10a340f79b3519a649714cc43cb5a895d6da91c776599f452052608b445e498930185440f4e226a9ce0c247571f0c06c8cd736f27560ed670b75ff79c2037e3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize8KB
MD52497580adf60003235e53fda22d4001f
SHA1aba86bc18f5f75665bcfc85885a17922ce6e38f0
SHA256137d1b526de028d5e5d7e0aa904575530064580a95bf20f5c449784c4257d7fb
SHA512fcc0b53f6ccdc587c35b41c7bfe1e72bfe36e7e762826b4c8ecd777263caefa91f3cb35f9412073f1e4ffcabd1eee60ef7fafeb7a594634b1c85673d54e7db3b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize8KB
MD5f6979d578660fbf94a5550ab88b07964
SHA1f3d2f3ed3c427a2dbae42d7fa0fea9710d637914
SHA25648891824c494559d0e4cfddd2e875bbd66c919d4aa50a42541f331e2570f8497
SHA512cc1b5c84cf0d19509f08c63ad27474b8804c98bdc2f4f7b73860d80819bc3c23e970d9c20f583139f3b98a79290f4a100cef5abbb31ca8db186e0bdbc9314e9c
-
Filesize
14KB
MD52257fa8cef64a74c33655bd5f74ef5e5
SHA1b9f8baf96166f99cb1983563e632e6e69984ad5c
SHA256ead48b70e048de6ccca219a229ca90b49a9d1b9c14bf3a7c5eaad544294fcfd3
SHA5127792be9b935a46a923e97bb76b76957070e116dcc4cb6fcd8b883c2d6f142285ebc9fd26cdf29bd19c8bdff412487f586abaa1724332b613e71afa45d7f3e4f9
-
Filesize
1KB
MD5fa9c9cd8e43a1587b13910b41e21ca9a
SHA1b5874274cf980fc05d9ee75d9c287eb3a4c712ce
SHA2562e629f87416a089a279d024e9d59c93baed4e30a805571c6113ae675d622b8db
SHA5127e0b1e645f618b1c8b743214acdd9f02d75a17e510418e8449631c4d30175bcd1705f82c5e1655f2515fe551059fe2ee08fe291fdea8fea4cc8756af688b5108
-
Filesize
764KB
MD52f9fc82898d718f2abe99c4a6fa79e69
SHA19d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA25688f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA51219f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
1.2MB
MD506f058eee50645758a81e8842353f372
SHA115e9010bab33f1733ea41b7c45d2da5d74ed721b
SHA256854d06a90dab54e7b69882925886fb24be711fdc21884e13c77e29048b21a098
SHA512920d5b6b902a742551dd0003c3feab430c3648a36850ceecc33f5baee365bf3f938420f80695618e1ef604daf3e215112938a57f3a7f6420c286ec430e89d817
-
Filesize
270KB
MD51215366af12337d0c6df30cf1e8d8703
SHA1c068c7c67c7940a8b54f91878a41d7d563b89b52
SHA256afc14e01f32986b8fdf70abedf20a4fa4f8617197164eda2486e81960a4c82fd
SHA512159f94185a34d0f7eda4bcd7a3428a47df7bd380908a3cd2e8f3793740e2be683637279f248c78ba919e2e9eab7f1196ab6e1c3f090e51ff0b84d5e152e613fb
-
Filesize
355KB
MD557a36d4a82d48dec0b84dbead5af407a
SHA109fb2a73be8171a3d0e4fe8202c8b5aa8e0c662e
SHA256688fc87c2c8659b03a4e356b2e0d60d644b4f91865afde2edd0b431fe3e9ce6d
SHA51235cce78ec9b0fef3836b543f3737f71403cdf8d4b084f37276dd9eec63dcc958ea2e64197a09dda9bb85c69654b5d9d65992f7509c9ae542786e49867102a0c8
-
Filesize
353KB
MD5e2c7fc3a842c66f204a71680ea65be48
SHA19770bd0b297be216651330f5dada585bb9ab7280
SHA256024e34c8d8ec714e98a82a6df2de2252f2e0028f91b3ccc928f53498179a7ca2
SHA5125549a1478cd09cd00525d56dd4b162a3d42a1284c9f811037f02c6c0aed6094e6be53f7580b62226cc9eb31b8b5048435e6225ead7de996c4f3480f5852c7089
-
Filesize
163KB
MD5ee743bc7055cd46c5dc436c2e31fbb2f
SHA1bc2ecc65e2de6095306d752ad8d4005c0abf0a95
SHA256fb5355f32b99974fcce4eeaf47eb285b7a5eeed743389ef86cd781227885f7de
SHA512de549940080e22134a462061b05c19b71224f99d88748e161626c15c10b0e6dde73f614d2b73e7c667883669ef073da249066bda7344e8832f2db3f4ca771b53
-
Filesize
170KB
MD50ab8bc5e7781d4d8adf8e9042a092b01
SHA155b8f5c9eb6569684d3dcd5a9eaf307c130a9096
SHA256413516c1b9256ac6091789ab02ee8374720a8e4d3e4ff02f9dccbed707e1d5e3
SHA5120e2e3c94f7d2c7c7ee7ee8894b97e7d45fec8869ff31a6202b2316a5122570036455b4a6dfb9419c7d21d3dcc90f92bb5297b4e964469ea656b4aec82bc25226
-
Filesize
154KB
MD5d0ac42d1758fd7d7c358ad2afce07b01
SHA16714c0c29fc240f6173baaf61876836bad18ca9e
SHA25635dff5c835b1e56f004fd744c2e9c66495130bf8de1a35bb216fdd21d012d12d
SHA512e2f27b1c4463de2046b3dbb8dd0cc489ad591bdb0be2b566e1bb909c6409cb333da3905f3239a45560aaebb3ae0760dd12854b6ea1d48ec43fd2d037bcaa67bd
-
Filesize
195KB
MD5bbcf651a95a8ef4de64e68aae60739ca
SHA163c219727f867525ce1f3bec122117427ab17e74
SHA256fc081f3cbae71ad895f77ee661b8eb8d6adb7f7652ef072572f83a21024f3e52
SHA512e77bda759b5330a4084d1904273af243bf3667058eb71494f29413e0ce05dd2800eca3b6046d577a648c9e4f9c582b0b88e07312b9ef0cbc30b1732f2a371856
-
Filesize
1.0MB
MD5371ca63d32e87dc52fbeb61e32f0b5ad
SHA1ac6a727a473c6e86a940ffe5b2e159f643f14c8b
SHA256509d0da97daf68177e9ac67768bdc249069e6c524d016546413df78f96ca5b71
SHA5123273ba366d91288cfff6dcdac96f320048bb0e9eb6b721b40aa97396e04902d7d9cd3b5374314a7cad06ae1622f6de83189ce0947b6de97771f2651c3cd5f275
-
Filesize
42KB
MD544f5b5915e90e0ea92230935ffdb387a
SHA1dc8a855da4ce00d1e7fe6666ec5517f1b9251d46
SHA256b424c70cde21c207c7a0ce50c528a07916f3a23e729662399005a9c2101a4572
SHA512802100300f9227aae6e2a68c88bb8ce898f54ffeb5a1291e793fb05e8dd5eefba43cf0d8ce6729e3e2b96b8877703ef96e75ccad4bf7b7104b3c4ad98e9fb520
-
Filesize
41KB
MD59f4fd820285020cf27e98e887a86b371
SHA1d02a83746eafea50bfab3f2c376dbc7065901e6a
SHA2560211e33039e643716dae115bbaa7fe48712ffce05c5cd93e430f0920944dc0a7
SHA512f2a2e58f59878ef0a0da39f55c49eab2252d1a239a2b528e5f24141c9624ba70c7a0b116b5f7260d7642fb639ea6b02267a86d87d80b7040f01a3f77b2d30df6
-
Filesize
44KB
MD5a1d35e34f46dac72a6d9828fc684342e
SHA111e8620b430713d2a060e8b00885406406999ff5
SHA256ecde99e60a06439b6efe56449b574e4e3c72bd2866435057ea96bd95a37475b2
SHA512f3e4fca639692c375c6bc5da8add571d0321a96b108ec4b5c8c066fcd66dbc03d13466e1ee2a6999c8a3295d4dbab196e4201676d33baf23c0d7e1910005e086
-
Filesize
44KB
MD5d2f9b8a15531dbc23062d36a32f2785a
SHA1fb91c68d9169e3395d08a9e0d9206ab9eeb4a9bf
SHA256745a678f24bc4bb23fee635f7208da54c611c4dbaf3d6ced8ce506e6fcbdfb33
SHA51271cb4fd02e23f9f5ebc07b78073b33d22ad2d0f63577cb60f38b42af1da451b1738f77edfa2c77696963ffcd09d3eaf07feb69814ac20b43c65bc71b720842b3
-
Filesize
44KB
MD5c6c28c37de5679872165d8081eaae611
SHA1a6314c35d35abe6da7cc21a0cb3b3ae6cb8cd868
SHA256b6569295bbb95a2b7ef2a203cb2e6328f57afdb60d2eed7c91b9e0c140492f89
SHA512d8ebcc4edfbbba20e481e02a1abf8d135c0028abe6afd05b67748175b2683da5a22b31c19251180072e2daebf3b8ad1006d07973432844e97fab7fb141e00bd6
-
Filesize
43KB
MD55f1801d5a4313f38b0afe77780ff418e
SHA19260d0bf49fac341682e26bf333d90a02a9fd383
SHA256f220083e8127200342cc2a8b441a711f4b08fca1c0bad08f71e65fc755fd5903
SHA512833bfaa2a1c106492878e36f455dbccb592686168dc9692311423c73b9f09b3ab0df67c4248be529e72fa27bfdb1ebbeb16a3dd5d5ff56fdc29ef0f7c8511101
-
Filesize
43KB
MD59d31f68f685b47a909056410e13d9b67
SHA1ab65cf05a95d8bbc3fe4e4dcd4c5e67cd1082e4d
SHA25681891dbea99c47f2590259ce9b5a3fda7a80b7e9305dda387b2f6447eee7175b
SHA512aa7ea8c086b59690eb3ac7a2e334aaaf83e0cc1b3adbbac53b2ba04cff67392ac87d175a88ddbf5c7b53f874fda203b5360494bf628b0c563e7953dc11553907
-
Filesize
45KB
MD5c699c7cdf4be1ddd44b093e1f6ccd4ce
SHA123976f3f86117d4942e3d4010d8a2944615275c2
SHA256f8f33f39f47c9bd53ac6497cdb2c7e10b4f5aebf70dbe5c8422162047730c727
SHA512930a757630dde8659a0d3dbe8c09ddcc2d7c5295809e22e1c071b8a6e83feb9a88c66131c9d889c51636b8daa68c06ebcf32c935626fda2a5ab7630e16309f26
-
Filesize
44KB
MD5638491d6e7411ff991caf3593ba96bca
SHA114e6fb5ad4a66800fd56be8d0f2bceaeb765eaa7
SHA256964614d4e55cc2c61962777e23509aaeafcd3d78939aa148974a4b2fa574487e
SHA512245de32e72c3701cf58d4260931d4450d4bcb204c72bfc92ffc37a06c00bdb95e9231d86c47da1e2927c8ec4f4ff4fc8a2948a741729a2276f3d3fc7f48250ec
-
Filesize
42KB
MD51731e2a7c6613805d563ce6dbd7029e2
SHA1855a96774de85edb2d42ed62f4a930389020d1e2
SHA256b52ba05b0a6b87b62544b68cba8790c5d823baf93da0fff65696f3def0e02be0
SHA5129b846e535e86c2e023806235ae78ed4f68a984bf4c3c3d8779232a88dba449ad0484003b2c2563cd89bb9e022c2a3068fab90e4890614bc6f75d4847738028cb
-
Filesize
42KB
MD51bbccbbbeafa25d677e1accf13fc7e91
SHA1522cba760d745a78f9d2b1af43431b749ba525dd
SHA2568dad4dfdddb975321556a1f1b398459dac6d68d6b29ea05e96d280b256cf0109
SHA512f06b803b293a7a3e4b435a741179ccc64b41818a890a62d75dde459667c58db17b4b3a24529a654a64322777941218885a2b6e7b72e6e334386c1dfc20d0da38
-
Filesize
43KB
MD56320127c77432434e44a89e93e2a5dd7
SHA144ed93983ee3fff1cf36b12d46450106429f6174
SHA2564a02176ad398ba84f2420249e5a6afacb6bad12fcc810394d476d149bf889619
SHA512a386719934fd85b6b1d7fa5c85e5214b29d5d6daa8853096ae60c41c2f99b87fa4518406d4d6fe942bb04f650aadcf905501dd0e41eb614ab11038a12026a707
-
Filesize
45KB
MD58ca90163b756e2703eb5f92e520d4ffc
SHA11b6b24a5b2cca36c90669add9c0a0104df8aec86
SHA256ac60eece8c5458a6110eba9fe47f703828da5999408a5e9c9c689365c6e4eef3
SHA5120a38c7b95b8cfc8d17de80da77af898c395cc709a207787bda6e29681357d4c160ef11fcf80adb08558866872f34a525fd2b737f7d640d8e936cce48da8f4505
-
Filesize
42KB
MD51ca6f5c39615ef0f16976a34a47d48aa
SHA1f3983a754f6c8e857829b613d08d726b5a3de59a
SHA25649821ddc2d2af2d21fb9cd7747c618f6ce9b8fb69e110dac017b4d41ad0bddf9
SHA512715acb72219bea384115419f822290f145c89dcd35d2d5a14d14890aeb22640866806da9b01f5e6e0778fa982283481325d5d8ffa91933a976fe889c78222c73
-
Filesize
42KB
MD592e7886205eb3792cbbd3633a183cb12
SHA1216564647a07115d839c885770d1c360475279a6
SHA2562b630895ba3b973a2b1264c715b6744c277ff55031aefd4c26dc9d2360a3357a
SHA5128d1a294fa164265de6621586efba9ee775c2819d662837cb3675c4335a106db74fb8fb1758ae5bfd9c78dc799590656018a20d4448ebf2077cbe2b266f73a776
-
Filesize
43KB
MD5e45b0c0b274f1aa93d559590998c572e
SHA110f6e82ba3c00e5435b447bffdf7bf9ce48ba263
SHA256dc0a8ce05108eff46fa2a5cd629d23693c826dcff45eb86e31c4ce163fa9a465
SHA5121edf3cd05eb01a9317434218fca95839cfc5147c8d11c69a0d5c9228340e2c558fd3006b8daa821bcea20d54b2c7ecb088225ae14f8b380a4ccb43482e048136
-
Filesize
44KB
MD556cc233b80def41a589fbd52fb36626f
SHA170bf16bd33e95cfb894075c5d5ad30c3f9d39bf8
SHA256864ceeb444e065766fb0b7f0ba4938e6f56ea6fda8a62c9530657abb7fc2fa78
SHA512290fd8a5b39c8675d3d41bad0cab7410445a30adef62591d26a5da03723f86486468e3eee95926f0788fbb7959347f0e4c0db76ce7a78a22cac01817b7c44e11
-
Filesize
44KB
MD57b2bf17744445d49d1b61fe75d83e14e
SHA15402f1f0957f844420483ea3754807c4cb2cde86
SHA25644d264d2654c059b777bcd7d011024b8104c028556e2dc9cc470a80d5f3a1f9b
SHA5121b79e79168f9c1af4e736b5996c64f10fc8dc78960ebe9163b34230a11e0c9bdc58a799d963fcf31bcf87fec433e8abe88ba3f0ed01a6ea8e1f132f296bacd5d
-
Filesize
44KB
MD5d3150bd7fa51c9aba84a2fc43c440983
SHA1905c95de9153b94c4907230f16def4b214fe0385
SHA2567adfd3b65531abf14f74b5d72ae29d5baefe44d0d2ea2991f6e4c949da088a67
SHA51202bc2fc52ab74f0cb46e436570a5c099d5295b587a9952d1aa6f5e28c79b1a19d1245e05229ad5af568875d53ad2700dd97ae9a97d95d7869a4180f63da094d0
-
Filesize
43KB
MD5bcb8e81f1363784b2c47ca4c8643219f
SHA19244c30660b017edda9d3387edcfeec25875b3e5
SHA256545c1d69d3f9b1b512812dea31ad890ba95feb4ca3bbbdb98ce72a801919d116
SHA512463c77b2daaaa30a0a3260eef19068da3f6e0c2d0099d628f72d12b5e49b69ff93d48bf3fb130bddf415b5941f89d2815afc5d917bb4df39f69adebdbe59bf09
-
Filesize
43KB
MD5f6c25c1a214bb598f111cf4fa8b3400f
SHA1315786decee66575abb87c1cb23af2dd46baa0a1
SHA256a584889f453cfa9e8f9e03aa91187a00b2b1fc47161835bffa1f88423e293c3d
SHA512f5c1c8f31c9bacfab4c91ec22429f202649012aad200078ceaf207b001cefa452c5ee75b02ff076b980d4cd25fe675447ab09a61b648a640fe6a5fb58a9d0ca3
-
Filesize
43KB
MD5840e859d33976a45d9aa79b4c5160d33
SHA16522f4d21e80b7f83ab920640914dab9ac2dba5a
SHA256edc63fc935d0de9fafcb06ef7e985009653f3650e3460a6e74272aa518ae3db1
SHA5128f4c71265d0f01a88960686cceb8489eb2be2683cd6de697d4474553debd4646d9dc23f9bec53a028375f8da9cbba27dccb8b861720865b285e32bcfb0e8828a
-
Filesize
42KB
MD52bebedf7006e01182b4724cdccdf8209
SHA1d29e8371a2fd2fb5673ec26bce9a76aec61fcd0b
SHA256a57a4d3f382f02ef972dcec0b92ff766e8dff63638deba1925e4360a391202ec
SHA512605cb76437c2cc7868f88e24a09fb61d9ef81e104d1471443806c7cc31500b92d90b8f014d8aecbb85cdbbf2d9d6950e95da1d0f3ff6e6f5b195c54c17df7b1f
-
Filesize
42KB
MD51501833c6ba1afd0be75f245359aaef3
SHA15380a6501658d195008da7fe4934d3f229fce5ff
SHA25608adde568bc6e0b19da788fa5de81a5817faa7a750c926989e73f1c2be40573d
SHA512bd0ac891af264c25e264bb7562ce0ed9ed02a6d34488fd684c9cf8a4936482a072d30e1939a5042a4e10b399454804f00d45af24f2c8fbddc01653b0d90236f1
-
Filesize
44KB
MD5a70215145e52353fa80de6604ce5095d
SHA126cfcbf62d47c7830f53135f321cf559c9cf403f
SHA2569f7f4d8a0683c64a3657801cfc399ce390ba1138fd90120f49c601afc9a88cdb
SHA51227872c2cc2c0fa49146ede7e4061b3ce2322415ff8f9ff5703491c8b64ca0735207a64e520237d8174706e0e915f28862eef71a2f9d804ee02512095f87d4ab1
-
Filesize
40KB
MD5052f862b897a8e59a203ccaacd5ad09b
SHA107734dcf9c61c51389836e04e3b0125d7498b632
SHA256c1bc29fd83d244a5d20674d90e98d995a255c9dccf90881f028bf35eed8b6276
SHA512949378b1fa5ec568b99456bd475570565ea8adc01dfa387d3f87808a9c2037b82613120117e0f582bc65eb619ce7d0b2e447148236bd0262bcab5e3d475fd202
-
Filesize
39KB
MD5ee568bafe0eaef79ec54688d04816e42
SHA175c46969898fe1326a211c99ba03bdf2f42fa4ae
SHA256adbdb88fac6f4b7af1c845774e870f356aa7018ccccdd10196b10f18b9b0b2e3
SHA5122cb1568bbff7d338baeee2f5c82a003aad0e17671857afb956cc7026e19f28a1da1a5b3d3b362f0ea70bb9a1365a07445278f658aa9cab290a9e8b97ef7dbf9e
-
Filesize
44KB
MD5d876ced6baff678cbdf14031fbde9631
SHA1fda2dbeca454660ecec9ba1337b0753f89c75549
SHA2562613a42698211413ad94a5854e4e3fac172abebfebb4eac12a75a042aefa971a
SHA5121cd48b49ba164491bff2a8e3a2c5a033d4aae30b2722f601f42db7d58284be4630c8bb45f24b505cc066171a9eab7700707d4ae91a5bada2644eb1a4b36798b5
-
Filesize
39KB
MD52b67991318d781869538f48452bdb153
SHA1d008b609e56568078cfbff28b6e549f940c6fe96
SHA256520345af1b837d49bfeea54de3b7957334c998dcdac77083fd5877a494250168
SHA5121774a4bc5da769cf2f3593feabb1a5561ecb4606916d6f66b097511595a5a0718f839e55e7ec55052451c5d0f9320a3c64c43adac103c3463b3c0ff9d8cbc191
-
Filesize
42KB
MD5c3b9e9ac6cead1e698c30dbc081b89a6
SHA16ac2b98c80decf71f328a65c894365cede7f732c
SHA256da25075045e7caf14116921758ad7071abd16ca16ad30aeac51424ebe2fc8059
SHA512e4dc34f339f3a465f46d7f7cb26852e65455016d6fa1319ab4b5d04fc80a67035c87f50bbe4afcffb3b0a4912669b9b0a441325c40d0ce522d2286e794200c41
-
Filesize
43KB
MD52e67805ec1c2f327cd75145dfb6c0b4b
SHA140464bd191080fba9c7287994f0ad171c9b9d0fa
SHA2563547e9a1cdb6f0337b704754504068cda39e4075803078e37dafaf474962e71d
SHA512da12838e1151a0673a043b3eb6a8d9ddf80e62da3fa1b872cd5a0d263bbb228330bb5f29b34c37a8e00f5e28b35cfc5cb3143d3132ea10c060d2bf4bd003831b
-
Filesize
46KB
MD577247706328fc4cc32b7547b1aaa44a0
SHA183816340fa190b967a6a2a34110f822a8732e1d4
SHA2563c78a482ee4f94bf5a3cfe231ccc7d96bca83f96f621f5f6f167113e651f8aff
SHA51222347f94e900c16bef181c3cbb9518b1b2dfe27923bb108d4cd39a497d36d5c3d515eee13a027c3398130e9defb389b4d8f0cef9d2bb78932a6f04b849c85913
-
Filesize
44KB
MD5dfda61f8be51a23ea3ceb7bf9c8de9fa
SHA172f703928853390656f70426c3537a620274579c
SHA25667de42666b554a07ba14c5150bbcae7f0af8f4e082ec7e9655e6a0cff0d8e061
SHA512c5cbbc5d47bad734d8317e87e0a1efc374f8a19656531131e29e5b7c202e810def3c0cd8ccba92bd913986068020a217fdee7b48eba952d2e71ae351f20f0f6e
-
Filesize
42KB
MD5493a33c40fc499a7209f88aebe5ad0f2
SHA1ad33ae69c5e62697a19fda48639726e35a93307f
SHA2567764fd60a1f384380b7e847466690cc5ff4b46b47db86e83f766913e5219a81c
SHA5126bacb662b1a3ccef53fe2d4731b9c27639fa1194b8cebbdd2f508b2b0f96ff09b0757570f1cb46657121f462bde0e942abb1868f331448b742324d37feb248f0
-
Filesize
44KB
MD5c520f19e972feda764ec523f8bbab805
SHA1457b874fc7be37be1c46d4733b805e1c0e83bb69
SHA256e4b5d114adad2794f245a300e8a4f18cfdee78740327adc7257cff1854319f9c
SHA51274747bf5bc875a65499bbf82d60f174a6cd8af9ebb103c6a5dfadf7a002c9aa9b06a53c27beb683efe38950303543b0b0a5b1919e48ccef5d5f685d17e5c1aa2
-
Filesize
43KB
MD5db94b8ee999225ba3a038477bfcd7547
SHA1bd2beae660a1cb61eeef93feccce4c22a8cf103e
SHA256e1e4e4ce58b61260d22b464799dee32127901dfaf9ca3fb452dc1d19208989c8
SHA512d2a656d1fa36a33583c223f3fcd53238966e7114004cf36264ceb25251a822b9e3bcd298967951292afa8130d6c3190023643a356c3521495d1a9f0af3d8e00c
-
Filesize
43KB
MD5c43936489f35c08b5346a5363570d1a5
SHA13a575aa598ef7ab45f5abf246daefe991d722111
SHA256496a08549921b4785f15a7547dafe15f83cae15bd47cb6fb78d0035165b236da
SHA5120a345eebaf08aa8573df1556da992830cdcda1071b24541cf331155bfd25cc64d3be020d28f2cd1be6ab5cc0f347f41efc7833e835c05d14dab1e8939444fd0c
-
Filesize
43KB
MD5445228fa9268f58dc2d9dddd80f5a960
SHA168e4f32b805652352653d6a07dafe138514c8bcd
SHA256f1732538b6b23f56ff6d89d5b553abb9a54f81b0cf2ac88185bdc9df64157bd8
SHA51208ec8963beea134893c650ccbe931b875ff66b20cc01002b2bbdb798a4c37ea59615bcb16bf5e601341763443e89c50498b53a309f465784385468cdbc83947e
-
Filesize
111B
MD5fecba6c3128a97f09a1173779924be7c
SHA141645675ff089fc6059bbe1ed4b049502241e7fa
SHA2567ef57c6645a8d144047d276b5d41b153c4dc63cf3627c32db018ae64b4e6d92b
SHA512c1193abe0bb4a9359e8e73332475995bd042149f62a67e67d37549993c7130589db809c53657abb7a0f9c518f975f270debeaf7fa70327a81b8bbee233035aad
-
Filesize
95B
MD5bb821c7232f0a147003061d151c6f84b
SHA10ac9f760b86e8af0fbef1d3b8cb7f09a632dc910
SHA256a2f7ab02d50ae6ba146304c9a4640d4cce351446a1bc8c9f6a122abef354f188
SHA51287255afc4cbc4d3b92cae9961a091868aae4d8ce9b89c2342dd204a25f7fef30abc3232a93cf5711f2534fea3b1f43663f9b30a39a332b3db24d491a606409cb
-
Filesize
592B
MD5c0f5c90aa7edaf47e04c1519b516ef13
SHA1f15c269c617f7b115ec969e311a3028e8f4bb1c4
SHA2566a035cc61f3fceedb5015966bee15f2bc85c1aad9fc6ee342430844de602c8cb
SHA5125de77f58ea801eea9ac32803ab767f3b50b1f1d7a6efa211de1f44c11d0540805efe360620fa548606903531e0ff66f61519026077c8a58df23149250908e180
-
Filesize
72B
MD5a30b19bb414d78fff00fc7855d6ed5fd
SHA12a6408f2829e964c578751bf29ec4f702412c11e
SHA2569811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
SHA51266b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
82B
MD52617c38bed67a4190fc499142b6f2867
SHA1a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA256d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
SHA512b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
-
Filesize
76B
MD54aaa0ed8099ecc1da778a9bc39393808
SHA10e4a733a5af337f101cfa6bea5ebc153380f7b05
SHA25620b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d
SHA512dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879
-
Filesize
73B
MD5d0d700d97af7329eba4106663e78eef3
SHA13edda685dd4c1784f4367145b4bc33c0931a3f52
SHA256e8d45358e5cf9c0d78c905f62747c374e28c0b3104fe63611f795271d68213f3
SHA51228c97cf9009557bdaba19edad046bbe1b0dc6b1c826402beddaa19412bf854fef8bd58f9faaa5091bcd43fa55c65bb69cbad9d2b9b222185e6a3cecddfd3650a
-
Filesize
564B
MD52efa37b5105fbed3014a7be8963dc2ed
SHA1a03fd940871c3a99836f8f1c3bb2edb5e5a32339
SHA2569961547296bbc34112d1c852fb61ada201f87230e56848c17af3df54ef8921b2
SHA5129b0b86e7c110b5d076d67eca5848e1847a8f04de3feb4a4c71e1d00724fad701b0b0cc3f7dba7450ab3392da4ea5e2353ac9f263b81a5a186b694b5a162db69b
-
Filesize
595B
MD5b87180b7b04d741e100e0d2a5589ecb1
SHA1d0445445d423c44d1ae950f30408c4656f840565
SHA25613ee7debd288fef765e19ea48d2fbcb08390b9d873fd507c0c41c2d16aa5a540
SHA512d3fdb94e12059f834f87fdd161a10ac4da1196ae7102498899dc65a979613ca0dd25a45b2d33aba14d6e2b2c09d9e9c7fff253e2d73ab8e3fe002d37e94e6b59
-
Filesize
533B
MD542009b4dd959e3bc13f18be4df9274fd
SHA1587ae3aa747b57ee96f44ff231efec1cc594dc97
SHA256c9e3cf0c31a16a1a4737fd30b166c6da0a74925590c75026af334c224c022f92
SHA5126a667409d99bfd69b9096fe322eac756e24a96d5a1cff2ff0ef30cbdb66b3355fb00e6914aebbd2fec35107a4e89a5b9981a030e505b8d88cc4a28a6feabc3a8
-
Filesize
558B
MD5f2ea88c3713fadc1cb2f57ffc5f763e5
SHA1203adbd539223c4ea2c2f0a549dd198d46bda233
SHA2563ecf70ef4593b2d7ff9955f6f62f656b1a3957b743972f1b615c91ad8b4acd62
SHA51232b8508cdb2b650abf06c6e1507769cca8cbaa99bc654d6ad528872aa1606bb66773142029f78353798c1ea73a4e2ade7c76582340b85206cda0a3de857dc212
-
Filesize
108B
MD512677df325000149c5a3f14ef1c34361
SHA1aaad5fb1224e1326a9dd061c91df58c24bbdb381
SHA2562394a0e025630f7a4a8b43438a1186c539184eda37f20becc01b0863e9a3a6c7
SHA51285531530a9165dd0a6ee17f01917ae38a5f02652fc8d8d140e528887e3c8e56273da1355ee88400e2e43b482599a0560c57aecb8d60a7cfb820375da48edcc25
-
Filesize
584B
MD5bf65a4224fec367166423812dd35a0bb
SHA1d7a4d5cee9092f4d208e6a24e0ab02e6cab8e73c
SHA2563f27cb27ac7a383bd20010078fca5c9db522636c4e9a33245d40bcc33cdcc6be
SHA51207a42dd0d469cd694923e9b3e784fe66b21c6e31316ed22943bfc54b1778851bd6064361e8a9f73282d00cb28b73b714ead1d55aeca2fb5d1db6c744a2fcb74e
-
Filesize
578B
MD52875fe113be6756f313d12befe11e4a7
SHA143473a6ba7d826df2a38ad6989625af8cbb502eb
SHA256a5a3e45ae8b6fbe9203a80071c7249e64c6157fcc1f5122d9be841d5bcb32327
SHA51214a54970b2ebb7543aaf7899b9c19d9c9e4652272f859681e899d2243d37f9a841f54d0a87a3c546ca5376bb83c76e0c8ad7e961804df2abf79405e287167d36
-
Filesize
76B
MD5c08a4e8fe2334119d49ca6967c23850f
SHA113c566b819d8e087246c80919e938ef2828b5dc4
SHA2565b01512276c45ecc43d4bfa9a912bdaf7afc26150881f2a0119972bffdbd8ab0
SHA512506f9f4fa4baaa4096ce10007eb09cfa95c9188082053b9ff7f2dec65164ff57506b6a8fea28d58783700f257c982aef037afc33f62da8da281e67636430dc23
-
Filesize
555B
MD532c91bf9b8f95b4b2330a1b7d8b6c359
SHA132589e12e041bbc42fb3a66c489b39ef380fc1fd
SHA256cf65a918306fa7763350fd8464fd2f3a049468424b6b89b15b15d824f0796df1
SHA5122f6582a63caf1d18298b6ff9ac65172609c3444d676c5d1988d329e2dfcca5293b6cf2838dd9a6eaa655cbff403989f47fc4811b41e9a2b4c10e7478b92f384a
-
Filesize
546B
MD5e8a231cd05616f1d1bcf0cef6908284b
SHA1a7a47b1bcfa15545bf134d28c1c61baf8b2b0038
SHA256df9fa32f3d7fc940b4d9f1c42b1d604d0351422fffe997fa6114862f9a502c29
SHA512d0240027ba22e9401de4cc3e9fee64454e707ce6d3b9d6d10b20b68b838a5f317fc74e2a8c62e5809a0126dc111375f6b7a5ca95b672787c201ea0e9bf826450
-
Filesize
107B
MD526c7e7fe40033b23fa11952e14526a43
SHA1e905f18aea8a40b4c101b0d442c7d4db43462673
SHA256b624989d48bd33dfb41f0396f6d61ceea585715a56b9e0415c3cbdf4a00e1c97
SHA512d2b48c94d08780bda219a5dbbaea22d7d99377d26e937405c31aa45482809cf3aab08d3318b154f4bbf9b484b0dddf74f840ef746c16b57412adca0aef08b284