Analysis
-
max time kernel
761s -
max time network
763s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-01-2025 19:22
Static task
static1
General
-
Target
-
Size
1.4MB
-
MD5
63210f8f1dde6c40a7f3643ccf0ff313
-
SHA1
57edd72391d710d71bead504d44389d0462ccec9
-
SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
-
SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11
-
SSDEEP
12288:WZgSKWk54jeg6lL5assQHtzV2KoLJ+PwXxwuLSJ8slf1zMr6iL/KNDx2PIXe2Q:KgoLetlLS8tz6V+PwD0XVMrXCNDxtK
Malware Config
Signatures
-
Troldesh family
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\132.1.74.48\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSppSvc.exe Re-Loader_latest.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSppSvc.exe\Debugger = "[email protected]" Re-Loader_latest.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe Re-Loader_latest.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "[email protected]" Re-Loader_latest.exe -
Modifies Windows Firewall 2 TTPs 4 IoCs
pid Process 5228 netsh.exe 4144 netsh.exe 5232 netsh.exe 996 netsh.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 4568 BraveBrowserSetup-BRV002.exe 4556 BraveUpdate.exe 3344 BraveUpdate.exe 2348 BraveUpdate.exe 4752 BraveUpdateComRegisterShell64.exe 4372 BraveUpdateComRegisterShell64.exe 996 BraveUpdateComRegisterShell64.exe 1472 BraveUpdate.exe 4644 BraveUpdate.exe 3772 BraveUpdate.exe 5032 brave_installer-x64.exe 2284 setup.exe 3824 setup.exe 3900 setup.exe 1288 setup.exe 4036 BraveUpdate.exe 5008 BraveUpdateOnDemand.exe 1988 BraveUpdate.exe 2116 brave.exe 2988 brave.exe 2276 brave.exe 3688 brave.exe 3128 brave.exe 2128 elevation_service.exe 1268 brave.exe 2860 brave.exe 5024 brave.exe 4176 brave.exe 2640 brave.exe 2480 brave.exe 252 brave.exe 1736 brave.exe 3476 brave.exe 3916 brave.exe 2156 chrmstp.exe 2904 chrmstp.exe 3232 chrmstp.exe 1496 chrmstp.exe 1892 brave.exe 1652 brave.exe 1396 brave.exe 4860 brave.exe 4052 brave.exe 5464 brave.exe 5748 brave.exe 5848 brave.exe 2312 brave.exe 3920 brave.exe 5136 brave.exe 3908 brave.exe 6124 brave.exe 2480 brave.exe 2812 brave.exe 6092 brave.exe 3020 brave.exe 3836 brave.exe 5268 brave.exe 5572 brave.exe 5592 brave.exe 5440 avast_decryptor_troldesh.exe 5796 brave.exe 6044 brave.exe 5136 brave.exe 2132 brave.exe -
Loads dropped DLL 64 IoCs
pid Process 4556 BraveUpdate.exe 3344 BraveUpdate.exe 2348 BraveUpdate.exe 4752 BraveUpdateComRegisterShell64.exe 2348 BraveUpdate.exe 4372 BraveUpdateComRegisterShell64.exe 2348 BraveUpdate.exe 996 BraveUpdateComRegisterShell64.exe 2348 BraveUpdate.exe 1472 BraveUpdate.exe 4644 BraveUpdate.exe 3772 BraveUpdate.exe 3772 BraveUpdate.exe 4644 BraveUpdate.exe 4036 BraveUpdate.exe 1988 BraveUpdate.exe 1988 BraveUpdate.exe 2116 brave.exe 2988 brave.exe 2116 brave.exe 2276 brave.exe 3688 brave.exe 2276 brave.exe 3688 brave.exe 3128 brave.exe 2276 brave.exe 2276 brave.exe 2276 brave.exe 3128 brave.exe 2276 brave.exe 2276 brave.exe 2276 brave.exe 1268 brave.exe 2860 brave.exe 1268 brave.exe 2860 brave.exe 5024 brave.exe 5024 brave.exe 4176 brave.exe 4176 brave.exe 2640 brave.exe 2640 brave.exe 2480 brave.exe 2480 brave.exe 252 brave.exe 252 brave.exe 1736 brave.exe 3476 brave.exe 3916 brave.exe 3476 brave.exe 1736 brave.exe 3916 brave.exe 1892 brave.exe 1652 brave.exe 1892 brave.exe 1652 brave.exe 1396 brave.exe 4860 brave.exe 1396 brave.exe 4860 brave.exe 4052 brave.exe 4052 brave.exe 5464 brave.exe 5464 brave.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" [email protected] -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: avast_decryptor_troldesh.exe File opened (read-only) \??\F: [email protected] -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe Re-Loader_latest.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OsppSvc.exe Re-Loader_latest.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 49 raw.githubusercontent.com 243 raw.githubusercontent.com -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer brave.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName brave.exe -
resource yara_rule behavioral1/memory/3164-1-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-6-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-431-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-432-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-470-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-607-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-826-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-908-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-1265-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-1268-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-1290-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-1314-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-1315-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-1497-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2144-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2298-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2324-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2419-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2467-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2620-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-2956-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3350-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3386-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3413-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3591-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3654-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3868-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3938-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3984-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3989-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-3999-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4009-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4031-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/5936-4077-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/5936-4078-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4079-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/5936-4080-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4089-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4119-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4201-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4276-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4351-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4359-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4419-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4510-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4598-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/3164-4652-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png [email protected] File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-lightunplated_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.scale-100_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-80_altform-lightunplated.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png [email protected] File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.boot.tree.dat [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsSplashScreen.scale-200_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_StoreLogo.scale-100_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\inifile.targetsize-40.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.altform-unplated_targetsize-48.png [email protected] File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96_altform-lightunplated.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png [email protected] File opened for modification C:\Program Files\7-Zip\Lang\sq.txt [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-40_altform-lightunplated_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30_altform-lightunplated_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-unplated_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-140_8wekyb3d8bbwe\Images\PowerAutomateSquare70x70Logo.scale-140.png [email protected] File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml [email protected] File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\KeyCodes.js [email protected] File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\spacing\index.js [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-20_altform-unplated.png [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-lightunplated_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\webviewBoot.min.js [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-200.png [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-400.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-lightunplated_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.scale-200.png [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-200.png [email protected] File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreSmallTile.scale-100.png [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-unplated.png [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-100.png [email protected] File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif [email protected] File opened for modification C:\Program Files\7-Zip\Lang\kab.txt [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48_altform-unplated_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-96.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare150x150Logo.scale-180.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-60.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-96_altform-unplated_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\Xbox_MedTile.scale-200_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom\findElementRecursive.js [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsMedTile.scale-100_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-36_altform-unplated.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72_altform-unplated_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-unplated.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.scale-100.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Graphing.targetsize-20_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-black\MicrosoftSolitaireAppList.targetsize-32_altform-unplated_contrast-black.png [email protected] File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32.png [email protected] -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-it.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-cu.hyb brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_ca.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdateSetup.exe BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_2116_1909870120\extension_1_0_290.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1834062315\_metadata\verified_contents.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1086345412\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_615535548\nadeem-choudhary-1.jpg brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\BraveCrashHandlerArm64.exe BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_iw.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_lt.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_2116_2097603309\extension_1_0_69.crx brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_de.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_311315350\1\localhost-permission-allow-list.txt brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_615535548\nadeem-choudhary-2.jpg brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_615535548\gordon-ross-1.jpg brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-lv.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-de-ch-1901.hyb brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_no.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_ro.dll BraveBrowserSetup-BRV002.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-sk.hyb brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdateComRegisterShell64.exe BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_tr.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-el.hyb brave.exe File opened for modification C:\Windows\[email protected] Re-Loader_latest.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_es-419.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_it.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_311315350\1\clean-urls-permissions.json brave.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata chrmstp.exe File opened for modification C:\Windows\SystemTemp setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_641890797\_metadata\verified_contents.json brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_es.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1086345412\list.txt brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-ta.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1696353255\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1841793005\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-af.hyb brave.exe File opened for modification C:\Windows\SystemTemp chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1795175305\_metadata\verified_contents.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1841793005\ct_config.pb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1834062315\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_et.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_hi.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_pt-BR.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_311315350\1\scripts\brave_rewards\publisher\youtube\youtubeBase.bundle.js brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-cs.hyb brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_sw.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_2116_608018405\extension_1_0_11.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-mn-cyrl.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-as.hyb brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_fil.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_vi.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-sv.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_495789107\hyph-de-1901.hyb brave.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdate.exe BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA BraveBrowserSetup-BRV002.exe File opened for modification C:\Windows\SystemTemp brave.exe File opened for modification C:\Windows\SystemTemp\chromium_installer.log chrmstp.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_hr.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\goopdateres_sl.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_2116_1799519076\extension_1_0_104.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1696353255\kkjipiepeooghlclkedllogndmohhnhi brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_803908380\_metadata\verified_contents.json brave.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4060 sc.exe 6072 sc.exe 5888 sc.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Desktop\avast_decryptor_troldesh.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\systeminformer-3.2.25011-release-setup.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdateOnDemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminformer-3.2.25011-release-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveBrowserSetup-BRV002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avast_decryptor_troldesh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4036 BraveUpdate.exe 1472 BraveUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom SystemInformer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SystemInformer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SystemInformer.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1444 vssadmin.exe 104 vssadmin.exe 828 vssadmin.exe -
Kills process with taskkill 2 IoCs
pid Process 848 taskkill.exe 760 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588 SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588 SppExtComObj.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress = "192.168.1.255" SppExtComObj.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133817017505388262" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry brave.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598BBE98-5919-4392-B62A-50D7115F10A3} BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\ = "IProgressWndEvents" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B16F95-319A-4F01-AC81-CE69B8F4E387} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6D9FE5-6ED3-43A3-80D2-EA8766D65352}\ = "CoCreateAsync" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BravePDF\ = "Brave PDF Document" setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB}\AppID = "{08F15E98-0442-45D3-82F1-F67495CC51EB}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\CurVer\ = "BraveSoftwareUpdate.Update3WebSvc.1.0" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\NumMethods\ = "24" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ProxyStubClsid32\ = "{431F0B22-1282-49BB-B84D-5D5D79B3B848}" BraveUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\Elevation\Enabled = "1" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C021D009-DA33-4564-82F8-BA95410436F6}\InprocHandler32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4} BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\TypeLib\ = "{F396861E-0C8E-4C71-8256-2FAE6D759CE9}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachineFallback BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\Elevation\IconReference = "@C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\goopdate.dll,-1004" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BravePDF\Application\ApplicationIcon = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe,0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\NumMethods BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{431F0B22-1282-49BB-B84D-5D5D79B3B848}\InProcServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\NumMethods BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ = "IApp2" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\ProxyStubClsid32\ = "{431F0B22-1282-49BB-B84D-5D5D79B3B848}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A9D7221-2278-41DD-930B-C2356B7D3725}\VersionIndependentProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreMachineClass.1\ = "Google Update Core Class" BraveUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\1.0 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B16F95-319A-4F01-AC81-CE69B8F4E387}\Elevation\IconReference = "@C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\goopdate.dll,-1004" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB}\VersionIndependentProgID\ = "BraveSoftwareUpdate.Update3COMClassService" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32\ = "{431F0B22-1282-49BB-B84D-5D5D79B3B848}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\NumMethods BraveUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\ = "IPolicyStatus2" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\ = "IProgressWndEvents" BraveUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.html setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\ProxyStubClsid32\ = "{431F0B22-1282-49BB-B84D-5D5D79B3B848}" BraveUpdateComRegisterShell64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\NumMethods\ = "4" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\NumMethods\ = "43" BraveUpdateComRegisterShell64.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E brave.exe -
NTFS ADS 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\avast_decryptor_troldesh.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\NoMoreRansom.zip:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\systeminformer-3.2.25011-release-setup.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\Re-Loader-Activator.zip:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier chrome.exe File created C:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA BraveBrowserSetup-BRV002.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3568 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4960 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3164 [email protected] 3164 [email protected] 3164 [email protected] 3164 [email protected] 4916 chrome.exe 4916 chrome.exe 1876 chrome.exe 1876 chrome.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4644 BraveUpdate.exe 4644 BraveUpdate.exe 4036 BraveUpdate.exe 4036 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 4556 BraveUpdate.exe 2116 brave.exe 2116 brave.exe 5136 brave.exe 5136 brave.exe 5936 [email protected] 5936 [email protected] 5936 [email protected] 5936 [email protected] 5992 BraveUpdate.exe 5992 BraveUpdate.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe 1192 SystemInformer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2116 brave.exe 1192 SystemInformer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe 2116 brave.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3836 brave.exe 5388 brave.exe 1988 brave.exe 4960 explorer.exe 4960 explorer.exe 4960 explorer.exe 4960 explorer.exe 4960 explorer.exe 4960 explorer.exe 4960 explorer.exe 4960 explorer.exe 3768 brave.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 5440 avast_decryptor_troldesh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 2396 4916 chrome.exe 81 PID 4916 wrote to memory of 2396 4916 chrome.exe 81 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 4852 4916 chrome.exe 82 PID 4916 wrote to memory of 3924 4916 chrome.exe 83 PID 4916 wrote to memory of 3924 4916 chrome.exe 83 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 PID 4916 wrote to memory of 2572 4916 chrome.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3164 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:828
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1444
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0x50,0x108,0x7ffe86bacc40,0x7ffe86bacc4c,0x7ffe86bacc582⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1772 /prefetch:22⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:32⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:82⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4432,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4436 /prefetch:12⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4740,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4748 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4940 /prefetch:82⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4672 /prefetch:82⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5016,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5012 /prefetch:82⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5028,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4684 /prefetch:82⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5024,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4360 /prefetch:82⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5196,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:22⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4756,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3368,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5260,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5416,i,13515997893246666891,12421307844097503313,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe86bacc40,0x7ffe86bacc4c,0x7ffe86bacc582⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=1788 /prefetch:22⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2084,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=2144 /prefetch:32⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=2184 /prefetch:82⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3008,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=4436 /prefetch:12⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=4756 /prefetch:82⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=4916 /prefetch:82⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5060,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4788,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=5104 /prefetch:82⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3688,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=5260 /prefetch:82⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3364,i,6472065433107641245,16978046592668748591,262144 --variations-seed-version=20250117-130131.443000 --mojo-platform-channel-handle=5392 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1280
-
-
C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:4568 -
C:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUM2AF4.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4556 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3344
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2348 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4752
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4372
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:996
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5MjA5QUUwNC0zMEQ0LTQxMjEtODcxMi05MzU3OTJCMzg3QUV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MEZERjg4MTctMDEzOC00NzQ4LUJDNUYtQzlGRDYxMTdERDM3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjczOCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1472
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9209AE04-30D4-4121-8712-935792B387AE}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2256
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3772 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\gui83E3.tmp"2⤵
- Executes dropped EXE
PID:5032 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\gui83E3.tmp" --brave-referral-code="BRV002"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:2284 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=132.1.74.48 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7663ee4c8,0x7ff7663ee4d4,0x7ff7663ee4e04⤵
- Executes dropped EXE
PID:3824
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\gui83E3.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
PID:3900 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{88F33119-EA25-4630-AE48-C755966696DE}\CR_A9E76.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=132.1.74.48 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7663ee4c8,0x7ff7663ee4d4,0x7ff7663ee4e05⤵
- Executes dropped EXE
PID:1288
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5MjA5QUUwNC0zMEQ0LTQxMjEtODcxMi05MzU3OTJCMzg3QUV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkJBMkZEQzQtNEZERS00ODkxLUJCQzYtOTNFMUUwRUNDMTQ0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0FGRTZBNDYyLUM1NzQtNEI4QS1BRjQzLTRDQzYwREY0NTYzQn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMi4xLjc0LjQ4IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xMzIuMS43NC40OC94NjQvYnJhdmVfaW5zdGFsbGVyLXg2NC5leGUiIGRvd25sb2FkZWQ9IjEzMTUwMTA3MiIgdG90YWw9IjEzMTUwMTA3MiIgZG93bmxvYWRfdGltZV9tcz0iMTQxNDEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3MyIgZG93bmxvYWRfdGltZV9tcz0iMTUxNTciIGRvd25sb2FkZWQ9IjEzMTUwMTA3MiIgdG90YWw9IjEzMTUwMTA3MiIgaW5zdGFsbF90aW1lX21zPSIyOTg0NSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2116 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=132.1.74.48 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe75a1fd08,0x7ffe75a1fd14,0x7ffe75a1fd204⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --string-annotations --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2072,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=2068 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --start-stack-profiler --field-trial-handle=1948,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=2212 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3688
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=2516 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3128
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3416,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3484 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3424,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3604 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4900,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=4912 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5024
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3420,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5020 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4176
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5004,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5176 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5160 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4796,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5008 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:252
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4792,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=4804 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3876,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5756 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3476
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2156 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=132.1.74.48 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff60dd1e4c8,0x7ff60dd1e4d4,0x7ff60dd1e4e05⤵
- Executes dropped EXE
PID:2904
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3232 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=132.1.74.48 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff60dd1e4c8,0x7ff60dd1e4d4,0x7ff60dd1e4e06⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1496
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4740,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5920 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3916
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5628,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5920 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5140,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5060 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5548,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5980 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5180,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5864 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5620,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5332 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4052
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3912,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=4896 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5464
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5028,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6008 /prefetch:144⤵
- Executes dropped EXE
PID:5748
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5704,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5852 /prefetch:14⤵
- Executes dropped EXE
PID:5848
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5960,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5784 /prefetch:14⤵
- Executes dropped EXE
PID:2312
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=2924,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5564 /prefetch:14⤵
- Executes dropped EXE
PID:3920
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3728 /prefetch:144⤵
- Executes dropped EXE
PID:5136
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5900,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5480 /prefetch:144⤵
- Executes dropped EXE
PID:3908
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5816,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=4948 /prefetch:144⤵
- Executes dropped EXE
PID:6124
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5508,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5240 /prefetch:144⤵
- Executes dropped EXE
PID:2480
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5220,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3708 /prefetch:144⤵
- Executes dropped EXE
PID:2812
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3684,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3700 /prefetch:144⤵
- Executes dropped EXE
PID:6092
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5592,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3708 /prefetch:144⤵
- Executes dropped EXE
PID:3020
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6112,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5400 /prefetch:144⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3836
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6188,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6200 /prefetch:144⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5268
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6364,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6348 /prefetch:144⤵
- Executes dropped EXE
PID:5572
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6372,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6524 /prefetch:144⤵
- Executes dropped EXE
PID:5592
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6596,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5924 /prefetch:14⤵
- Executes dropped EXE
PID:5796
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6588,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6632 /prefetch:14⤵
- Executes dropped EXE
PID:6044
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6796,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6788 /prefetch:104⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5136
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6780,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6900 /prefetch:14⤵
- Executes dropped EXE
PID:2132
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6620,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6252 /prefetch:144⤵
- Suspicious use of SetWindowsHookEx
PID:5388
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3132,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7092 /prefetch:144⤵PID:1396
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3644,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7124 /prefetch:144⤵
- NTFS ADS
PID:5652
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=6576,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7084 /prefetch:14⤵PID:5484
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=3504,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5676 /prefetch:14⤵PID:2196
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=5860,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5976 /prefetch:14⤵PID:2896
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6524,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6168 /prefetch:14⤵PID:4188
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6196,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6344 /prefetch:14⤵PID:5284
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7084,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6484 /prefetch:14⤵PID:5292
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=5656,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5852 /prefetch:14⤵PID:1284
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=5328,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5212 /prefetch:14⤵PID:5068
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5712,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6512 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=6500,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5612 /prefetch:14⤵PID:780
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5924,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5632 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:344
-
-
C:\Users\Admin\Desktop\systeminformer-3.2.25011-release-setup.exe"C:\Users\Admin\Desktop\systeminformer-3.2.25011-release-setup.exe"4⤵
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Program Files\SystemInformer\SystemInformer.exe"C:\Program Files\SystemInformer\SystemInformer.exe" -channel release5⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1192 -
C:\Windows\explorer.exePID:5604
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=5940,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7104 /prefetch:14⤵PID:5840
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=3396,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6632 /prefetch:14⤵PID:3768
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=5728,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3524 /prefetch:14⤵PID:4832
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=6732,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5136 /prefetch:14⤵PID:5448
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6508,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=4020 /prefetch:14⤵PID:1880
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=6004,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6656 /prefetch:14⤵PID:6096
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=5124,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5732 /prefetch:14⤵PID:5340
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=6600,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5640 /prefetch:14⤵PID:5912
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=7152,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=5612 /prefetch:14⤵PID:4332
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=6176,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=3312 /prefetch:14⤵PID:1396
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=6548,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7092 /prefetch:14⤵PID:2480
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=7220,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7260 /prefetch:14⤵PID:5192
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=5312,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7364 /prefetch:14⤵PID:3908
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=5308,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=6428 /prefetch:14⤵PID:6124
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=3540,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7564 /prefetch:14⤵PID:244
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=7428,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7416 /prefetch:14⤵PID:1472
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=7680,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7212 /prefetch:14⤵PID:5232
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=7544,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7576 /prefetch:14⤵PID:1712
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=7811406649879813384 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=7736,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7804 /prefetch:14⤵PID:4764
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3920,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7984 /prefetch:144⤵
- Suspicious use of SetWindowsHookEx
PID:3768
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7944,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7956 /prefetch:144⤵PID:484
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7808,i,15039502253049992487,2408033036696757940,262144 --variations-seed-version=main@daf6d93489f2bc0f91a87af4d587d81c595652fd --mojo-platform-channel-handle=7980 /prefetch:144⤵
- NTFS ADS
PID:3568
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\132.1.74.48\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2128
-
C:\Users\Admin\Desktop\avast_decryptor_troldesh.exe"C:\Users\Admin\Desktop\avast_decryptor_troldesh.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:5440
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]"C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5936
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
PID:5532 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5992
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3656
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵PID:3636
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- System Location Discovery: System Language Discovery
PID:5700
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
PID:5972
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- System Location Discovery: System Language Discovery
PID:6076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4960
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Re-Loader-Activator.zip\Re-Loader_latest.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Re-Loader-Activator.zip\Re-Loader_latest.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
PID:232 -
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im SppExtComObj2⤵
- Kills process with taskkill
PID:848
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im OsppSvc2⤵
- Kills process with taskkill
PID:760
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete KMS-R@1n2⤵
- Launches sc.exe
PID:6072
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="KMS-R@1n"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:996
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "KMS-R@1n" DisplayName= KMS-R@1n binPath= "C:\Windows\[email protected]" obj= "NT Authority\NetworkService" type= "own" error= "normal" start= "auto" depend= "RpcSs/tcpip"2⤵
- Launches sc.exe
PID:5888
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" description "KMS-R@1n" "v2.2 Final"2⤵
- Launches sc.exe
PID:4060
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="KMS-R@1n"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5228
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="KMS-R@1n" dir=in program="C:\Windows\[email protected]" localport=1688 protocol=TCP action=allow remoteip=any2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4144
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="KMS-R@1n" dir=out program="C:\Windows\[email protected]" localport=1688 protocol=TCP action=allow remoteip=any2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5232
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "\R@1n-KMS\Windows64Professional" /SC minute /MO 1 /TR "wmic path SoftwareLicensingProduct where (ID='2de67392-b7a7-462a-b1ca-108dd189f588') call Activate" /ru "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3568
-
-
C:\Windows\[email protected]PID:4404
-
C:\Windows\[email protected]PID:4744
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
- Modifies data under HKEY_USERS
PID:2136 -
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;Trigger=TimerEvent3⤵PID:5140
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3468
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2492
-
C:\Windows\System32\Wbem\wmic.EXEC:\Windows\System32\Wbem\wmic.EXE path SoftwareLicensingProduct where (ID="2de67392-b7a7-462a-b1ca-108dd189f588") call Activate1⤵PID:2336
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
3Clear Persistence
1File Deletion
2Modify Registry
4Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD59b061d9863757b582737d5d2fdb77892
SHA1895c336bf2f06c9c6bfc75991be5bbb552c5b171
SHA256d873aa864f45e204e8a79163d3a856737614fe3b0b7d1d519790e2d20cd83638
SHA512f1faa7f250ce8ad69cccb1ad23f2ed958f2df17e0762ba2b516d570d2e36dadf9c82dfb35b3ddbdf7e689854e1cbd2c1cd2e53dc660f482854f4f1e747de0707
-
Filesize
4.4MB
MD568cb538abee1e6f982bb3e227f644880
SHA18374784a94675c9d7a7b6b8642288b3c9a24d1ea
SHA256f570090435611bbdc706203e57a4c3e767f179608c1ebac48e72decb2895d659
SHA5122e1f70385858f95ca988f0eb7cb26279b1f0fa6a0339d9dfeb10758acfd64c16f7a02b3ffe284f26bfa8499870448ed34cfbd55560595113c3bce3a61989f195
-
Filesize
3.3MB
MD5c21b9f52e195471f3978df692c46c714
SHA1f64ab91451fd761b690d070a007b72c309447304
SHA2560684d5382c346850eb2378caaa73606671ca579dda624c3d4d042ad514a50b32
SHA512c995a8ad39a1f77d808359554f35f7df7ce8f0382c1aa6cda731bd645bd1c46ea4ab0b56fe7818bb9249d007fb695dc40f84680cd2c5f9c26ba5ac54b34c5b22
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\47080b4b-0663-4299-a043-3447b159f6ad.tmp
Filesize79KB
MD56aecd117a2cf871e8698f0a74ee738a2
SHA1aeff3b80414953667717ef0710f1bda465436c29
SHA2565b9b577e71c87192e8ec0fee36697e5c5c43b3f08fac5699bc8cbf8c722678f1
SHA51239bd5027c30a3c668ec17909593e1bbd25315c23dcf2ffc802a85fffb0baf36e3ba4c78bee4e5bf50134702ddf54cb91ebfdebdab8071c79f8b4d03a1d7048bc
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crowd Deny\2024.12.19.1218\Preload Data
Filesize16KB
MD53c97222c910c2aa1fab0c39a1c8d2b11
SHA1c794a8758b4fa74c7aa9536effe9bfa774822e7a
SHA256c7b91efdd09d75b47036e241eb55a238065ace2c26cd8f31328e8a9f4b4102b4
SHA5123220065c655bf174c466d9ac03d3040e419f30d081983c23a757d2c0c5e4720aed2c71e88befc0d8b6987d6abd6a25289731d7f4fc9ed6348a1d762f67032153
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\9b0fa4f5-1ec9-4fd3-a8de-1bdf855579b4.tmp
Filesize165KB
MD5dceb0cfa9b61effc8788488f43747572
SHA1c43235ebfd21469a747e8a264b67f874e0400cb9
SHA2564f6f8abe6e2a6bbfea1c79b495019e80015343160d7fd99ecd0d428c9a8fd57a
SHA512a4f5775c654fa4f31f53cb6fbab084939bd929feb95740b904045cd1f0a52c819e90876e56e66f7d1bb38db66fa0cb49c7365511f8346eec3cdc610e32b02c6b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000002
Filesize23KB
MD5f837d382a885a07c34a3d4bf4f49373d
SHA168ddceef1d164a48d9d01d4a74f26b7897323229
SHA256dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33
SHA512ef010d89971c4f69af7bf541430364c56245a5b63ed730fe628e49f48fa9e201c7f42b1e104eb14c3193bf79dd7ce20244f6b963e9996eb8308c0d61f444ece6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000003
Filesize23KB
MD575fb76ec35595f04717e8b3f1dc3ae2a
SHA191770c8b9979c8245519e9c5078ca10a47524169
SHA25662553d159189834af73c9a6264704be5b2bee9a08da66a14768d8e5c6ffd2cdb
SHA5124f05ec0c9a34ecacb19bd13aec6a15794951bd42b005986967b2d8b347cdce22fe8edb0b7d24d3e470416deb01fa69c0bf0fa5ae07eda3cefc26b0073dc9b62a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000005
Filesize18KB
MD5872cec79ffd0f0de399bfaeea0d87a26
SHA1a30ef4c87271ff70c904ef2799d483d14d94b15e
SHA256478f26b1b5ac725d80a761a83e1af5fa4ff5693c3f98e06573adb3f0b8238dd4
SHA51226f16464c1dc3c87e897f43a2da1d4dc14ee7bee8c559623efee8ed9c7bb5a15c0ba5d086633ebc94241f0906ca1ea0f254e4cd7775080fe4f587f4241db6d7c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000006
Filesize23KB
MD53b49c13950a4b03f8347f49b7fc398e0
SHA1084423c7499a83604bf20d42f9ede5b2bca044ed
SHA2563c7bea8ad292bc3807f51227a0e5f1e7b8c23029a4292dc67617616da35dc293
SHA512d5f67dfd4c9e5c5232593d4e07001cb7d16025e869a08c6b50b328dea02262bcf47e3394deb7e6122727b52a09d6a4ebde67243c52092eb967cfefcfdcb4dd0d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000007
Filesize20KB
MD51f01bc2c3c87e51439c63ba4786b27d5
SHA1e610d5e576ade4442c7c43530667db1a7af7a087
SHA2564f05ca0d4162a4b274a7faff868200ae4b8887159180a00ef1c311db16b94e49
SHA5122fb01072556690cd49197c5a78c30c5a76d4d5fec10f82ea650c6d41e1e7e5f0a3b11def0a7686c835be756a860f80d36c562689beb07b6e677a75a84ab65af7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000008
Filesize31KB
MD534d6e77c5f9fd1c9d468f4d8df34e186
SHA11ab34354099ed96703f7e9dfd4e181e9da0fee18
SHA2566a447e4b7df166d903820045212ce46dacf60749a7d042141fe9b58cfb083dc4
SHA5125a592cef6ccc91c6b4306011a19e9b295812ad40ec3872d667d9ca01fa40f2eda4f0c3f7135c3028df43003f9ed3f773f86c8bca9adb786a08c4511b8b922385
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000009
Filesize51KB
MD5449c3c7ad472da3c1687fc29e20a695b
SHA16814d7feae1b010ea230312c26a9974a19cec6da
SHA256dbfa2abe35d6d6db79e6e648ac3819860aca27389df7e8d1927db8b0586ca38e
SHA51216b405c83a006c967a0ca05955e5747baa291ab34649837705586729bc3864dec1e537935f93990210d524c70b8c69ca0b193d6bf4e4741ff44fec35b5332681
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00000a
Filesize199KB
MD577cb2cb57b391485673203f10cb0c471
SHA1f3f5cc89fb5978039db39ec3a3c5a5f97c93bc9d
SHA256f6b237fb95bf95877bb085209c93b9db0b1ab90c8eae86d4457d470f6763c32d
SHA5120fb0d69adbc4a5baa2953a2bdd9e4e8312550d341e1fd302e567090cb8b8ef216a6dd6a0e98be3e16aca83dd88c492e81fe97f533c148a79101de630850acb11
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00000b
Filesize16KB
MD5c9ea2e70af4c15444f025f9bf7e2122e
SHA13d5633113f6f9267776bdc11337b9b691eb0de5c
SHA256ad0726a5f4f79bc2a4135ff3769349a8c3202ff4fab8dc6ddc0e7003cbdd0d03
SHA5123a01a30b90ae63dc16ba05bd5100a6369d4b85e902b049624925dcfb4bf0cf36527891afac494096a8c095347917136f91ddac53eccc1bc0ed8882af9139760c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000073
Filesize20KB
MD57247e91eedf36d653790d6d0a1c8a4e7
SHA188281d63857f377a82426d9ab6963249c37443c7
SHA256bd6e42e520f77a213daeee8749872b2ef6b220f7864e72c90f78fdb916861e5c
SHA5127780717bfbb9661b6715f46c89b81e0241d2a7305893ffed317b0ad5ebf57548552b6ad11ce1518f6bf20aa5671bcacb77dbd86f9b484abe4b7dc2071c4c42a1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000074
Filesize20KB
MD50b17fd0bdcec9ca5b4ed99ccf5747f50
SHA1003930a2232e9e12d2ca83e83570e0ffd3b7c94e
SHA256c6e08c99de09f0e65e8dc2fae28b8a1709dd30276579e3bf39be70813f912f1d
SHA51249c093af7533b8c64ad6a20f82b42ad373d0c788d55fa114a77cea92a80a4ce6f0efcad1b4bf66cb2631f1517de2920e94b8fc8cc5b30d45414d5286a1545c28
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000075
Filesize38KB
MD5adf2df4a8072227a229a3f8cf81dc9df
SHA148b588df27e0a83fa3c56d97d68700170a58bd36
SHA2562fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c
SHA512d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000076
Filesize37KB
MD583285c0f09ac865af1341a877da170b7
SHA1b4bb4604cafbfee4be8a3338a402f066e25eb785
SHA25684fe2df4a392f96823bdd0bc333c72a774154fdab3ac7d1c5a55248685da80f2
SHA51219198d23ad6e9120b5453e7e0b370ad7d049401d407ffb2325589ea733cffa0f2ecd62f06d6fb1decffa8b275aa13fec132c1be7498e3e2fabcd37c2fd03cd6a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000078
Filesize26KB
MD5525579bebb76f28a5731e8606e80014c
SHA173b822370d96e8420a4cdeef1c40ed78a847d8b4
SHA256f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503
SHA51218219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000079
Filesize18KB
MD58bd66dfc42a1353c5e996cd88dc1501f
SHA1dc779a25ab37913f3198eb6f8c4d89e2a05635a6
SHA256ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839
SHA512203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00007a
Filesize18KB
MD5f1dceb6be9699ca70cc78d9f43796141
SHA16b80d6b7d9b342d7921eae12478fc90a611b9372
SHA2565898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f
SHA512b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00007b
Filesize58KB
MD5df9f046f50e7936fee38774af18721cb
SHA19788f8e7d7d6de8e203849891c0b8dc1e6eecebf
SHA2560d88aa7924fb18c6e96cc43900be8b61ff14d5561dd1f9934168fe85b38e8967
SHA51296415f9f1e90e00e6a7a6a0cd06b38be9a3ec5c29ab3018e8b47301143cb83bdbe18f0976dc3766e6dadc7dce01128ccdf7039446ce5c5371a40bd5c61991d9b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00007c
Filesize40KB
MD501c37712c53beaec90552077a4235057
SHA10a1b1f47f36052ff504431b8cc75aab470ef2b70
SHA256aa3bfd95713e4d5c76703b2ef5267b94dded413f000ba3a46ac391086831b38e
SHA512be81978f7854a3100ec49d4c12a730af96df1e97e35fe182fddf8db6124c6780913a17210e4b268d261a9e107ed75811833d698e85d6ca325847a1ffad895b9d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00007d
Filesize107KB
MD55229229ea75490496d7f8a86d5c2860a
SHA1f2deb6d9b43e811f486fac1fbee1d9517ce9b0dc
SHA256487cfcbffcf804d2965bc4d45d846acd8724562714ceae80bfe1ca78534aea58
SHA5129b42f14e130181117e2379ff23d6e08bfe739e27b0756785d6f20669139d870d4f73d03653d820f278a71f2371213a0104158d791ab867622014b1ab8d637520
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00007e
Filesize53KB
MD52ee3f4b4a3c22470b572f727aa087b7e
SHA16fe80bf7c2178bd2d17154d9ae117a556956c170
SHA25653d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799
SHA512b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00007f
Filesize87KB
MD565b0f915e780d51aa0bca6313a034f32
SHA13dd3659cfd5d3fe3adc95e447a0d23c214a3f580
SHA25627f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16
SHA512e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000082
Filesize16KB
MD5cd4e82b46e4da434142a43b103c70d82
SHA1c90880a374cca87c8db41b629e803cba3412f14b
SHA2567fac6df5eda28d747100a7de800f01581d46fc81adfb53e5f6597e81ced06613
SHA51289d38702ed8b7eef95f287012b3de691cca0c191c673ecb7be8aff9481f38e6669ff9b3b422b4e92b1d4bebac4d4e67811cde421b422728930c75962f989a6ad
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_00009d
Filesize22.6MB
MD5979b20755ddf86eddb3e2892003a2ca6
SHA13a0b6f9ee4ee12872e733948465be5ece5b25629
SHA2567612d5e44a5a392ab9f0d1b5b8a79bda3cdbe19848e8ee9ec23909aaf3daad45
SHA5123238f77f7810460cb7cdfe7692892879c28e14ccd95969e80cf83d1dff320c8354173a87503b893b7095b99ee81c61e195004ad5f5e6a28e09e3e9c1fc080d44
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_0000ab
Filesize50KB
MD5d6e7f2627ad5c958588527c3e15452cd
SHA1074a18cc9f2cf82c2a2ac3fba31ce256679afdc4
SHA256d6c7e1e13096d47624c83a74d19f6ac7beac024dda3bae2c746933b7ca44fb14
SHA512ebda7d9b1f6bb51020858fc18bcbc6ba1dcfa9b1cba932a7efee1aa4e91b6496b6f782addf49696582387875c1e5f1240e0ad50b9e0b622c3bc707a75a2e2d45
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_0000c3
Filesize215KB
MD5d474ec7f8d58a66420b6daa0893a4874
SHA14314642571493ba983748556d0e76ec6704da211
SHA256553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69
SHA512344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348
-
Filesize
160KB
MD5e9fcb41b1fee21cd572a91184c8c23b8
SHA1699099abc30e0d96c364a68f967bd2e26a1535b7
SHA25668590788b1ba533d2f2ca85f81dc711238a37a095722823f5651177b38fc2b61
SHA51230393a706900f3ab4f16ff326a7a9da68863ee254c2c9bb5d8bcfc95239f919b8bb3c392c064c1bfb86c23344769ded300f2c11284ecf89ee8a09d5284f968cd
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD59ba83186db4c31e8a9c7541254fe49f6
SHA13c268c65a22e215a0291990a33a4505120c405c6
SHA256730ff41fab6474843aeb6b3959b8abab17ae97f811d53c32f093fff58898b251
SHA512089c6e9cb391edcbd89f6c54327d09c62aeb644ddaf0539542db603cf74a14c6dc7e48e7e66ec8b1078c758a8e2519b6bb8ca5f3520ca1a28bc4796b8997fec5
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD55beef5c78eda51686ea85d504b2b32f8
SHA1f176eacc2e6336043ce1d1dc872c8d61d0a3e4bd
SHA256006255351045db2e8bff5770cb226f3e2083befd153cb6f2a6d07f1d697c8851
SHA512910f3357a7c08534ae5e778fdeac5a98b795c31886b42e1d03284c5563fcfc8d89375df44194ace829274bad920bd5c17b5ac1e42339dc0f46c863c5bd5ac66a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5026b0831638d99966e13dc56c8fcacbb
SHA11a89c3dee24f1675d4efb36585d604c56a8cae5c
SHA25650032c8c6f11de84fa0cab914aeb4cbc328ddd6244d750a24dfe884b582b13b4
SHA51240b1fab3bd253ec02b298acf05cc52d0a7a5d865c3d5a444f8fe359159a1d9f522914137bd99b0efb8c99ba926f909357818384df7ebbd29c1a2e383ad7fb3ff
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5e24712f7ea3ece5f510aba33d7d8d452
SHA16caeb0e4cfbbcb4df2ca19517b3ced30aa746dfa
SHA2566fde1f3b483e23fe96d5095386ab9e052894c32be1624ef190ac664888a92c0c
SHA5120bc91651c5fa8ebb1d55d64a02ba45af3ab95af3956c608b7b8a15a2e97248de5c6fdbb76e9095d02f30c3391ffb46b2dcb3d3ff1bf776c45647796493dbe434
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5ca724092c07d8c0a97f8456de1b330f8
SHA1807d2bfc8dd01e88594563151812b0e65cccd54e
SHA25686ef11ac6ba1b858ec26cf47a6a71e4f61d7a77b9c20476083bc76115f6faf36
SHA51252261e421e69b36c5c04caf71f56fdd8d67e269513509ddd94cba8462b944b5e62661356279f3a6b89eaac33f2aac5d3102b66bd1947f07bd192c764750fd3be
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5814535bca13cd9fa1f75a51defaaa56a
SHA15bc2e6bf05f7567ba97b25f31b689eef109d4914
SHA256013f81f99e3902624e1d7d92f2cac80ce427e8c7017ec9e06f7575a13cf984c2
SHA512ff9b0fe43a5d6e43ffa36b2d153c8397b1c16dc42479c9da3a546e4398719f3c9aa59a43d7eedf438139d5678b61480eae20de93e09b895e6d7b388b90203b82
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD51871584b369814e084f755fd5886dc41
SHA1c808e20ae8bd820bb175c38d28be6be1013890a0
SHA256e4debf610d7f7df8534b1c1cffb117d638803ffcffaff706f9c9838c051437a5
SHA512c243d87b4777becaa023af56c01190138b710fe605e37d90e6a99357591717cdb416b1829f01fb27ae6f36fd6c7223f51761cc0a19ec2397d18d9a3166369668
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD513aa7f9dcd37b1fcaae295afaeee10b0
SHA18d619fb7102bf6c26b50a1a346193a411beac2e6
SHA2567e7996d28dcfbe4eda1dbbe6ff6c4f72440f35e3616e1dc1da3b6f5a795e6713
SHA5129804aea150d6ae422cfd27165012d1be8c791bf76f43af027bd3a921b145fd8a6a7780fe3ed15feb78e0194371a224f358884f4eb178865df25c97cabda28499
-
Filesize
160B
MD566f70f1b4358a9cc8508829833776623
SHA16f960025925e32bce5ad72ff5119022464c37af8
SHA256be1b3c77846ffd53e35eaaecd1c61170482b4c004382b0fc8fe73ce42526196e
SHA5126a66370353a68f73b9e82b6123ed8e4b4b1c385177d2787cf74eb54d5b9c75d61e19dce2af27a92e78e6d9cc1ab45c9dc02de6d85bfb832db66ec7742cf98d0d
-
Filesize
655B
MD54d3f96481758a03bf4aa1b717d95bc65
SHA1ae6888e0fb71a00a815297106c0a360a81acd751
SHA256db855fc6b7d6ab993771863f2f9ea9b7007eb20bc8cd4d11893cda9e4e8aec7b
SHA5121511331c02177a25c80699cab2da511782deb3f25ab0a4b46eb071798f36279d14a70ba9d0a0d349b1bd6d4914ec4c6175a994ded50c603dba4108d9830a3f99
-
Filesize
7KB
MD511148fda56083310253ca6a7350ebab1
SHA147cc8ce62fe198cd094a180970c08ed767e4177a
SHA25616d67f8e3e3246f4db561c3ed8cc87a2fd27751998b0553a2138828ddf2b1ff3
SHA512f1c14a72ae0fe53f4b4598e722f8d68c78829074aa0c4e738b7ccd5b236086f551ded612473b0650c564f7b37974414b5bad0c82f5891cf82f8fd8eb70dbc96a
-
Filesize
648B
MD5756e25e06e28bcdf7ba0859e783009e2
SHA1bbe2e3190defa2cec4ff00a0188ff092348f12bc
SHA25604941ae0a06f16517ce3a4c07ab0903c0edcc4936e454947871d10865513683c
SHA512bcb769f28fac1b2a4d8e82226409728141033c2f17ce7dc38f08421c1049b153fe1e47f2743e312dea2df1e8bb4ec5764fa0d48af32809124f86799de5f7c2e4
-
Filesize
167B
MD5305bb389096a5fff000a025c1661aa12
SHA10022002e14de9015d1ac4ddc40148aa4779038fa
SHA2565e8d078a73f5eb86bdbd02fc41cd8cbd59138f8d182a1a8bb91a91928dc69d65
SHA51289e6963783a92f7c5607f66881a876d485d7869396061dad4ba007a4799ac5e56ff2a04d22d2aac11313929c64793cb353e05c2244aa064e1e9c3cd2c645f9c0
-
Filesize
7KB
MD5ee635c334270ddbcf1db4a63c1e50298
SHA1bbedff9e9c82fc893dac5e287fc40451bcd7896b
SHA256962fa6309fe9e6fedf9b86f053704d6c5df9d735288b8612342b16ec14e60ef0
SHA5121ebdf710211e82da51714d708ba1703459ab47a336dfe391d2ec33d864f4819272cb1a28afdff2164e203c8a392ed0ba0fae137854e2c2cac991714f907c29ac
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata~RFe5bec50.TMP
Filesize5KB
MD53fbb8802b52c6758fc9c9baca0b39fe0
SHA19ef3f7f2665245409c6e686be22d39212d32d884
SHA25602ed4bab1582906959b96a93f48f3711bf2c5809af236d64549a9a4a7d95a980
SHA512735b9429f8ccfb5a0136830740ec7b8382cf18e37b29f289a2a339da92b1e6826cda894faea9dc2ff628cfc6967a05b57d41787613669c4c87ded1f2e335bcb9
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize5KB
MD5359b4b2ad7111412fa2bd53cc897458b
SHA13022f8251052109b8a7d212c452f67a2010c280f
SHA25641204d987abd7780fde2fda2c75d94130adb50ed5b4850ac2490f9041b1d424e
SHA512b817835a787a9a76b528f98942576d8f54c765621fa1fccbbc5433b19a385cc651585aec0c1ad49ff5a4c12e27fb8b0dc347a6a8c438016439c84b424fa4a37e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize2KB
MD518d13c78e3914787ce44dfa301b58eb8
SHA146d913cfe0d881cc20db0724c1d1ae5a81561c70
SHA256b24dec9753f3856e0836fe646ffb66f0934d03e2a51d78d0d1cd67ab38b41361
SHA512daa28e9d1afa1f55d73ad9d9ab9af5ec7f8383218617a34acd892a2ae81c7e56176d6edd04dc825ec9215062d28a23fe22dd256a1acc4e526d75331cf31ad059
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize3KB
MD5fcd2c5f998671e0c0658d20b4d2cdd9a
SHA1dc5670bca2520dceea00bbd9f2c9c74d0dd104cd
SHA256a3f6231ba2a43f8e04cb694d88d8f07fbe8de73af3e5d2cbb127aaa6a1090ef8
SHA5127fbd027b9372415304f2a187cc9cf552c27b7bdda06573794e45d63dfe3395804d0d540bfaed4ba80235138811ba4493efdb580926b402c3caad3d9596c865c2
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize11KB
MD518f9735d419cb32e12a13fe4f009c705
SHA158179f073b898b611374264b8caec5f8d311d66d
SHA25673459c0a305f471e14c535d010e833678af3e81b7e0abec6d0c6a9de1228a860
SHA51293cd7eefb6b28bd9e9b4c0ea397322d960b3958f544d2e7ce5706a7ffc586a860220b7bb370752bcb84e7419ee5e76c75763efdbdc5dae1d4435c1ad042adae6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize2KB
MD598b1a1d27028f0b86881c201a6d1cfe3
SHA1059138c16e6f3d3c6c61ac4d3ca695738a19c786
SHA25653d51013b97d9254b48cd94dd5909d62c0d2711b187cc7ae9fb858732fd0bc1a
SHA5126e320ce733859fe4809fbb650d55413a9c5a7f45a3aeb33dce9d4e775d9373597f3164fd38608f640b6e3c2dbc1b5662851b4323f6a6c17077f24b5d3a972c49
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize5KB
MD51b7182e371561f63ef0469f183135bed
SHA176ba54e74e05f233ebb688d31bd3f920661a0208
SHA25690948a566970677a99325337bd17efc0ab5013e01130c8fcbf3ffeab01ae569b
SHA5122f954068bf716deeb8ca0974d7b2a5b67568301d6e28e8556245be41abe74ea0098c842bfa89ab5a76ff525d4abec474f313beb9780573bbfecb430a03977c28
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State~RFe5a279e.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5278a87cb1c78be1af9d3035ef1b63cd4
SHA10186cd246e5ebeeb8c0d513f27b1b1445aeda5d2
SHA25687a6d8b7fe106bc076dc7d14c064f0283a32e15f5cc49f6e5cdff0b863c1573b
SHA512d88106f138fedc7b28a9d7c8849d72598eb257feba15863edb26410a51d777fbefa9500d19c8c3a949210955b216ab190beb4c94d256f2e80ab81473641cde2a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD5600baf9a9b86eecab61dfb6885236ecf
SHA1dca38ad527e9856204f9675cd37e6653db18d43f
SHA25644f35a59f299b7a92dbc34bd78813528866cc1df74aad26b4f7f19792f09ede6
SHA512af8e13d9b88b07de39d23221e9cb45675ed1acbde45a7b8420228a66518790f3592ae2b38c60e4508031ce8db5c5ca1f4fc366167ca1669ca61d8030c8dbe635
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5744e79833e9e38b7012b6b4a8818489c
SHA15f28f3659847f6609085c5c9eb967aa45f7abff4
SHA256dd8a71df9157791ffc79b886588e0501c21ff4da96a11948669d74eff25398ae
SHA5122a107c5ce5e0dbeae8ec2d7601b933ae0e902190c73c52182bf64aa018350f93931d8a1d6a0210c744555d7a32292450a914e332871417594b9304a85cdff82d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD514cc870b4b16e733ccc16f98807014d2
SHA159c7b42210ce75c3467c61736bf5eca0fc6a7b42
SHA256270f4db554b59c480ce31d36095a8fee5182d36ec5bf0270e1eb9e7f9fbdfe65
SHA51219cc5e17c64429034f5c73205d1a544bfc96004327dd74f8628f390ffc48b14f23bc2534895cc4805d2f4e1f8e653a2dc9f1d0d6ec3fae78c4c80ca4445e3c81
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5fa4045117cb8276482b99f592af8f1f8
SHA1b98dc7d8789eb4af411c5ac9f9a0964eebb61ff1
SHA25664a04ab17e88a666a9f952af4ef5bbb9d5ce14adbe5e677f00d254f1f16655a2
SHA512d005dbae7ca19a241d83d2a2da7782bea48fc3f6474e835974d1d155324d9bb87f81c6d9f5756c5706d8e2d0f4c0a1057a47fd57ec88f471090cc724c62b4cef
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD58f2e414d4546a5542ade386a8010955b
SHA1d465614ca1cc0c1ca414edf0502e7ae4ce810826
SHA256a765294909bc8a51a12662119c93e409361b0c33551944b1744076c6f5bd044e
SHA512fd43ae35e816a6c087643710058255e5e970c06e053093d5f3818cd68fb46beda4fd81bfeeb567baae186a19b991dc2ccbb242c6a1372b16c8bbc093ad5525c2
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5d61faea105fba3c928a6229831ba1fc7
SHA114027e479f64ff557593a49ade4cb3edcd4d422b
SHA25612489e8db30f6a90e7bd774f0316a181379bb6998f8f720b66716a1e50a54fd6
SHA512674d50bce505b8a8c64bd1207957f1d8d8ba47bb771c0777e76cac8c5cff81f3c2ae5df7a7ad2ba09b6301523545c331790a34af04a64a18e0cc4dd80cb9a240
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize690B
MD5bb240acb1882737dd89914b011563d90
SHA1dfe94b3910276971d62a86937e8eb21771246f71
SHA256113e02552142b52cb607b53a52b520cac9b8a28cf4053bcb0907a490c525544f
SHA512dc89ef071759586c89b01b48d3a4681a25ed43d01a21b36cabca2f37c5be05ca1900a2a40a84c09a1e40665b813eab0dc27324339fd111975e9293061c8e8752
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD5b197873dfbc0cf8e9c4e24643bb3a984
SHA187b7814662d22bbf93e1d36776178c9b6676e63b
SHA25652e1e9ddea1fafb8aa831850807b4950819c1c14e4e2e64cb8d63a44c7be3072
SHA512fa14bab5d5e861f34e01a73205941a51a354770fc3f2c3e877e56c95eedfca6d7f10735c434b49374c0ee9dc6bad5b1c11d39e85ddf4719ff290e918d74c9086
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5208787a68e2d219aad0a143d77bae0e2
SHA12db5d312b347ce063d899089d24505ff3695fc94
SHA256832bc654d9ed3681ee9f053e4e9834d313ed17707852dff44bfb2e8c1bd12691
SHA5127e842d144f1a9e7d716156afcf60947498e81582135f29f9a7f331613c2f9c4827d824996724af6a7d687e500785ec0b340856a7c8b4b929397c3a2913dea6c6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5a7b182f51c83faf5be6c310b5bbc7b3c
SHA1c0f7aabeab7edd41de8cecfc39bb925ca9a796fc
SHA2568e94bfb3109d4731b63fcecee1aaf35cd677a959717a50cf08db5d99b7005c8b
SHA512c1f4eae441656f7c87ab9ab042260c70f9a3dcb7018f95fb98790bd94e90bedd982d60a0f96556d7172e2e348d679b2bf3f08be0fa16f4b702311789526772ed
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize856B
MD5190266258cc870c941fb462da1dc63c2
SHA1de1182c9bcfc17440cfb462e6d19de30f88334cb
SHA256d94b3675acfbec6e5ace4a6a1bdbca5d41e2d618c0c3994cf2d38a81a16d1857
SHA512294c94db9fa0b9586e1abb05cad0028d02bd4591993cea5c404061878ed8eaf1689283d145fbfc1b5844622c719999de00e167c4937875a93905043c67123e9f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize2KB
MD5e7fdc71bd25d6ce5a75055a3ed74566a
SHA180734c16f4d75ac7bed9fcc31e31e4db6822a2c7
SHA256009e56fb7bedae7e3061afdd72d6f40c46244131e66b0bf5e7b0f348220acad3
SHA5123d202d6014ea983215d7740157eec499b50c8f363398d5471946960a1f3c50315633bad55398f27209bf92bccdb428ebc1be912ff50380f438cb3f916a44f9c7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize858B
MD5e3a987326520aa3ede7af605c27ae901
SHA195f1b223e989d64c0b6ed71adbf7c0dbf62eb6a4
SHA2566f454b31353e55dd6fa853b41921378f8d64c6fb460418f41a003ed56b096aef
SHA51207fc4d55be010681574133e635079911c9c8d08d3a99d8d560be1f59411548ab29d5d96dd456c99acc7b01bcd8d0f2e28fdeaaed707b830873d880e668edb81c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD533b982bd6a1a0b2aa5fa333b842a191f
SHA1c0407cfcc9f5742c389ccded2177fbdbdb85df8b
SHA2567479194828005a876995a37a8e06cd4c3b43d8f45dbf4b684439352b18f536a8
SHA51252f6ce6f4f0a6cb6d2587dc058e11d2a9ab05d706308b7c042a82ec0f8b4c3d4148080bf4008d6b09d29f673d02a7f6b76f76467fc3ce224bf342ae185de9298
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD57899159f86ec932819d5a5a744b6fb28
SHA112b13a7853fc84b310803786f83793926c3028b4
SHA2569fe1025fcb719d69b5835487d663383e296f44d7689615f2d72bb405a7a9acc9
SHA512f343d73b64f3fad9b463b5f8f92e8dcbd1919ab237e0064dc6344d12a818d82128c567ede7726bdb875bd5af3e57150ab317fe740c92e183e09247d3350a1e9c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize690B
MD50aaa94bb44d058b4b075d687014dd10c
SHA185016fcfe8d31438048bc653385eae12ad2cfa5a
SHA256b09b7256ff99111cea918678cb610c92919091ee135342db9b9451a4926ef82e
SHA5123d66fa907ece1c2127e46bc043205dad315577875f3bdf10250b520fbfda4cfd92fdd6eba1a31b0abab0ac49e7e042def51eb5f131369fbb7b4af7bd7e567a47
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5411241f99426a12dcc6be16c866f0e3d
SHA18cd9c4a4002d1256d6791bdb4fb1aef110f6f8b0
SHA2565837b9b9bfdf27b116f1bc5f4d4b8dfc63d84cbc6cf322131e6a1ac2218bd57b
SHA5124b837b80460991de96e0dccb9bd8313131c79ec079e6f4313b288068d4be68618404b88521d751a784f95833ec4ef47d5368989f4527591edd9b9bfbc36de1d5
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize3KB
MD5de10fd97149dc6dc4178fb84ead93fd5
SHA10fecedf5741a74b00ad02504be1aa94f7c6bf2dc
SHA2568434d33b5bd543d387e736d990d2c42263c520a33d695593319701a44dfaa77b
SHA512b7ddeded89a1601c845f57ad0f90a8675f7d2ed37749b55dc37996025f5b5cf2e148c2dc1fb4dbc465db45a8fd37008766254be58791489689e69e3f0ca16d05
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity~RFe59b329.TMP
Filesize188B
MD5571fcb1f2c21303529d1ca2ffcd274f1
SHA1ea72de4a102f737730942140e11a4c39c3b4b6ae
SHA256ea2f29a53bc7f4cb31ae5b3f5d47548ac0307ac5dc53be80190da391e08f1def
SHA512e30ba368d9101aa248c152008ee8ac80a4ba5213ac901c90543274f21654f05176ee61dc1211a7eaeb3399e0271ef52ba3190884fe5aca8d5482fba353e13957
-
Filesize
20KB
MD5ec11f2cb56a5605438162c6c63b23b56
SHA1bd9449344f9cf9e31e36e53cd8329fbd8636dc59
SHA2567f53f664fc8c2b23585cab1b09402fb8ed7eba1e57b260f584a6b018225ae311
SHA512edafda7f305c8a07adc7e53d5dc371e3ca0a124be68246868ab894fbf9255db91fb70de83c408267deb34f6db6463cdbf2b16b3fcb951199f4a3b1567a154565
-
Filesize
16KB
MD5d306969ec83b063567339bba1f604645
SHA12e01d01d8e409011384df98dfcdaed4f38b3cd38
SHA25687d5f92b54a8a7345c7f155cae080c34997427d86ed2db8d1028a396b0ddc2c1
SHA512d89c29c8c194d28f84493cf48d2886d2824cf3a27493ed40d6ecd950a7336df83810d64ae79f3891cfec468beda2b6e603b3a793da3f664406accd00e6bc7dea
-
Filesize
18KB
MD5c083bb5342213f589a197e3a858cddd1
SHA1e0f8341034336230f10ac34f747289146789cee8
SHA256c9707b54328a48c0aefca4258ccd560e575a5d00445e6957e4ced1b4c9c3ee6c
SHA512c8654994df73c2641a311f006d0c656d1a4eb808c599babfe056e729b5c7bb622fd8cba04a0cc96185f952b748713d2c880479873cd57e9760975f0885080bde
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences~RFe592495.TMP
Filesize2KB
MD5d41ec748ac85acabd1077770413baaad
SHA114fa601181cf18e3acc1ccabb453a337f9134caa
SHA256947f7f9428e629e3bf9795c10ed11167406cf5f1cad89eac37f4aa062b17da3a
SHA5125204a2c32fe9a402bc25ff2955de620bdfa31752d803c6f73d1933a1d7b0aa8020af321beff1f484c9a995e9c9d05ca0a3def6cf47b94e222649ee8f0ac2b44e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\FileTypePolicies\67\download_file_types.pb
Filesize7KB
MD5d28b6246cba1d78930d98b7b943d4fc0
SHA14936ebc7dbe0c2875046cac3a4dcaa35a7434740
SHA256239557f40c6f3a18673d220534b1a34289021142dc9ba0d438a3a678333a0ec6
SHA512b8dbebe85e6d720c36dbdae9395fb633fb7028fecc5292498ac89276ae87bd6de36288fbf858f3476e18033a430f503acf6280596449dd0478b6ab7139f3cea6
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
63KB
MD56ad235e9d27ac322f8bcd7f336423162
SHA16777fff2dd63aef258f89a81a2e045393d371437
SHA2560fee5a24283985aaa0d759050d350660f78dba290407fa44af2aa3ca653d37f6
SHA5128678994f1bc5ec01d42b27da9c9d43bccdb6359bc98cc2f692dfd24c6a7ed06808c9dfd842c1464f76a5963c8af6e134c1237868de6e2b1bfe3780192b5b2789
-
Filesize
7KB
MD5d4d616f02901bafbdd5dfc12b9504df6
SHA141002f0acf2974b2774553640799f2d9582686c5
SHA2569def4dd316db5fae7af34cd77f8e1126c72b4e532d4617241cdff6b630e6eda8
SHA512556e0f086de277cbb8af5c4d70d8aff6043ad4929e9d90f1ef40719e2a4bb28b617afb58079e3c49240d562056872d12fe4c9d728931fb5861cf24245d986304
-
Filesize
79KB
MD59d4feefbc3ee4f3780bd47a0bb27a760
SHA1c2a65d88b2503178e78bb8cbc758d9ba6d1e0ce8
SHA25639d26f68060f756c1bf58ae20f5c549447a13adc957649948510226827e745db
SHA512e5890bf00cd81f163a5379bd86dcbba82549ca1836405c5e7e6f20acc3471fbe03de24c45c067591e65c2fc5e4a98b58beabf34624a0126e6d2c6541be770d30
-
Filesize
60KB
MD55f30c291c7f5452b8894a63b5172ed3c
SHA1e40223dbba3ab3c568e47c9ca068ab13f4e00a3c
SHA25647a26aee74dc79419ef2e55e63bc0d24edb91a62b3f57b41a57b78fe816a3159
SHA5123c32a5dad302321ad4232657ab4cc126eeb6424dfe509235440d4440a3f481326c10233652ec819c7563b868098e572e87897f7a4f5537f3f94c18cb662e772d
-
Filesize
66KB
MD56ef50b595b3c1d275481d9f4b513b971
SHA13b54200b821380be66a479c3da6d68965dd61baa
SHA256f976e75ae60b7091eb785cd52de8b7cf78f6e124d87d59e87db772a9b27a3d7f
SHA51237386274bb472936eba9235b6d62b1565a9d26911d2c8c36744de60f4fd2546c2486e3ae626fdf14e77668ce787bbce03951ad8fd63f799a42e0e147df58988a
-
Filesize
76KB
MD579ea79c4d0299b71bc9ed4c313cb6668
SHA1035e4489a2c8587b36412dc690ad5336c7761f3f
SHA256228c5cb8db9f158a2af1c31b423cb4b31ea2c4ae9571b13db3db4b555bd54f4d
SHA512863c6728e3656eeb9e7828daa37e26c1d9d5efe7c15087e378d0d1ff2aa96e16004598c0491ccbac9547c7437d7c05a3a4fe339ca96a3030bbeb45aed16bd1cd
-
Filesize
72KB
MD526108f89e9edb1e166f787b3b3c22f72
SHA10c8a6efda63ade64c2e760756dbf6da931fb5e37
SHA25660ec0e207d10703a42e207235d1d585f05992f8c5b581f1e9954df47dbd22da8
SHA5121ea5c4a1d4d4fb78334015dcee4876baf4217e77e446c05fbcaae2f6be3139ab684e392008852a319b52d283a91d9da046739ed8a85c5c706d762f0ce61884e8
-
Filesize
69KB
MD5c5c53cd1eeceaacb25d58ef9bdc96b8c
SHA12135a4bdff51ea05f2de04e90168f1328fafa5b5
SHA2566e318911405d66aef4eeec1ddb06facc83e7d9456963b4db659fc8abe0bdecff
SHA512735ab08bcfa3046e055c0179287aa2e850489a07996523c6a207e1d1d6985c1b52bb37e01567bcb5a911a61de35dfed9c6883910dab87d4a556c8dd607415ea8
-
Filesize
63KB
MD54a67644ec4f6ce33579f1bc003121397
SHA1dd708bb533d44840313d52e64415c2443c235ad3
SHA2561ee0174fcadd835bc497eaa0098eb8785da375a4e1fa54379fb5f5d7f7d1a288
SHA512e98e2db7f331be0979e8b552e88872861fd245ce3c2eeda23c8925b32c0a6cb937f5c29d40817acf66ce361cc2bcfce8e83ee2032ec2e3843c0270a9489c858d
-
Filesize
69KB
MD5f1ecbdaaa44143fcb41b342852d0e2fa
SHA1f040219ecaed1254e5416855b1aa8f415ce6b188
SHA2562ac1fb1200f81e11b06aa621709954cbfebd26ef8315f64fc834a404ddee40b7
SHA51283a519876c4f1d9e71737b2d52772f29e1de6244507b3b9921235657eb087d987241f8c819695bc4d60eb9d21ab119cc24c5b605e1d6ad5227b68400a7eb1b9f
-
Filesize
69KB
MD5b62457d4f00bfff4156170130d6690ba
SHA1f5ada5662186563a589cac5d5d6e39f26f4773a6
SHA2568dec3cb5de09a5673870d43031f0d32fabf940dd08a7c6b4c19a4520753b3cad
SHA512f5c804ba0cfae25b177440c30e77865c7a9b9304e5135bd1238bdf9704eab172b062633245f2764217ac7055ce94ad40259a9170ff47bb540b8d955eca8d76aa
-
Filesize
69KB
MD5779b44b819269e48a815a9ba6723b311
SHA1e6c973cbea167ba73a779a42d46c6519e665815e
SHA256ae9d0dc78a73dd2f92ce134c777bd339cc2d396306a187cabb77c4606dcaf39c
SHA5128f264baaeb527efa58d120d3cce03eae74cb1d05c941275680574b2bbd0ac0bf7f747aa050e4f8b3b7ce42cdf313ac1916cabddbfbfb0adfe5b41237a17066ce
-
Filesize
78KB
MD58865c54ff2ce4ea5831627c047dafddf
SHA1f47e9e813cb881879afc9ad85258b4a3ae0427d5
SHA256efeac7b46077f0483b68dc3dd81197bf7470be8de290e057143571f305506d80
SHA512275d9f64805269783bf566051f0d43c0db31591d5d13610f70d79f453c2ddfb00cde79d2f3b6c61d3d700b67f99d9a4d3fb4e7c3cdec36cc74c561aa0fde7244
-
Filesize
79KB
MD549972fbd2f001f06f61b624aec022bd2
SHA1f1c816cd9ca7f999562c2b7845d8a0f366f61ebd
SHA25629058a9c4c3e261381edb1839cb7d219050ccba7387e3835a83058fd447d6b3b
SHA512083013cf36071ad90b36b3a9060604ac4274f02934f849fd3ea65a3d930388a62f4d122913df77319cabef9a8634a3b36b3d4f29e560ec29fca26874fc8d1e91
-
Filesize
79KB
MD5ce518f14b3bf3b335c27d75f819d97b0
SHA171f160177d4fa200c3db64d98846489f08858d93
SHA25635ca56230059dfb23f722c3e706d88983f1043fb309e98b8758b84f6fc4c9e23
SHA512e59f4570b8dc90e06946f0a715e9166dc4e4e78103e15a7e19139773e4580acd452a4471457ba28fb76ebee76d457bde3391bb46e40537fea451049be72c9af1
-
Filesize
69KB
MD56901d2b520ac609c7df5c84b53b52e6d
SHA15360579013630beb61bcd3803996962a74a57f3b
SHA256cc465208aec20f3c2b7bc11cfda145f453e0eece678ea4030c972956947ef92e
SHA512cba0a2d6c756b54965fc05835c060dbe874c020a4b368578b37fe5cb7f53a10ac5f44129084e6147d98afc2c152ce3ac69bce986966fef67f6a17721b5f874d3
-
Filesize
57KB
MD541b607dd7ca60e19e2c7082700e5ec71
SHA1db8c891972ed2e2307db7729896449d451fb565f
SHA256f0311856ee72a86595455013c42687ca55691016cb28e13a62ed235bcd18b194
SHA51295e23af8d59e6eba1d78a05c3cffa29807571b2fdc592f7886a2058c473eb9f179164c5114a3d482e534f0d308dbe12fd3a5687cc6fcbe88ee43482ce5e0bd75
-
Filesize
66KB
MD579a768b3718f09b3ceed80d7e25787b5
SHA15a63185e754f52b41538438bbf952877294d4bf5
SHA2563f34280e768f99bc8d2d1e18e28f48f24a34f202d76c8fa135f426b2a00e3d11
SHA51261dc9ab31b4e2e14758a457bccb22972a03b8eaa05a9beacf81b5197b8af4235225e387f3db4eb50884184f862cb2a67c1722794f19b392ea24558af5968e396
-
Filesize
63KB
MD5b4942859dc4cc7bf5ad0c7a36c995913
SHA16dbe99cc159c6ba91716b56983e83eafed308ef8
SHA2561f8f8b2c29968200e5e6aec7ee61de5c0857ea931b1c6e77cc7377a3ccdeb579
SHA512af669f30043f906ebc99f607fb28b1b96992ec205bd777c81402801814e6df8db9016c7479c093e5287e4e204f6b85a6205298a59207a77a17f7aa2eae70a41a
-
Filesize
63KB
MD5c3d028788c1fbfd34eb28c69bd5d6052
SHA1da6d6ef8dc880550d69f38648f6e5cb1c833c3fb
SHA256499a1928c111a241bf3597d37e436e502ef7758ce71b0ff5f8ccd052f2cdeba6
SHA512a62d7bb25b57d3ed23ef4d3974dac65c5de1d4b03771182560da7eb26c54b99ac63e3bfbd0fbf2b887fc0779d5cb4e60480b13f80459db5fb2fd639e0c34995c
-
Filesize
81KB
MD5f224c9e1e78d8ddb204827e9f1609d78
SHA1ed531b99023bc41429733cadb69cd927ac84d390
SHA256e10103306d05c99e4fec87b66a8599af6d219b008402c80c08cf6e99b5e5517e
SHA512f6a0bd0ed4685baa9a46cc228ccd7da37eed01654c98d215bd8841a370bc59812e7bde8cea59bfe2e8f1fa03660efacf10203ee6cfe0ae71b22d59786728401c
-
Filesize
51KB
MD5726bfdd219cdf41f4fd5ee059a1a012f
SHA1a965f4c2a89784b7362b8fa08b4589fdf6246908
SHA2563a44df339ea9c2c6e21c9608c8bc01d36e57017a002c1c05ce8975f9289ddcc8
SHA5121e41e6bde2aed0f0c08e23858b0b6fbc191489822978d21f9c7736340752587d0cb5378db4f4015cdbcc8cd0ae8bb6ac59b2904bfb1dde3dbbd557892156cc26
-
Filesize
52KB
MD5c16d2068bfbf1eb398e071ad4e841eb2
SHA1e115dc9f49fa12e417a1388d9ac8d3755c225a20
SHA25637cb641e1dbc6069b361d7db771cf32791e33d243df017c4cf55a6354f3563f2
SHA5120a787387e743f520c59bb2641225f5248bbc820f0643b88b3537a99bbeeac9e1f48fad648fcdea71a7cedc72b5b713b3e3a599218884cd2614e66be5f2b84f06
-
Filesize
52KB
MD55c298f0f0fe916f281c6b4e6363fac98
SHA17d3d0fbfbf80da50fe853365b4ec6cdba19f35b3
SHA256983cb692a8e84b520eaeee07bf40024d7e5456c4110b09d51565c98a8826af44
SHA51201f8b7b25aae560e740577be3447148e9e2812427adca512f365005d6b49e5cc9d49b1975e56101b6a31b1ece13e0893042308a6c343fcc474cdff1a1b60c47d
-
Filesize
60KB
MD5998cbf31fc65a93c8d4228d625ddb8b7
SHA1e80ccd74d9efb3d5f97e6d0afc27a69f3dc98c97
SHA256981d165789a8ca32716691f135c5df53563f99fa2743bcf1420f05bf9c28bc06
SHA512202ad9b39a5a03b42cc9ab3c288d6e252786dc67f9a57276097af857dae272c21fd1b1daf13f35d5c0c33910a5f523d336cefd67b6a09b2dc89fbb5cd19b3679
-
Filesize
61KB
MD51e78bb28abf35feb8bbdc3845283d5f7
SHA1167153c88e3c34fb9b2c26e54b328c82b1af0544
SHA2565cea37725c6bc8213d2b7b05ec7eadb2373fb090f17ac9ed8a97606d26d91b7e
SHA512f02763c4bc511b930de1e2b31af003379f411d6db27c8bef240b479fd8ac41565516cc05dc3272f1c0565b3b679e2e8579c952c9bf3dd5d3e5e5cc2898cde009
-
Filesize
76KB
MD577c11ff94cd2426cb6722805bdd7bb60
SHA1f11de7d9d872f0df310e60d2cf2a974d6de25010
SHA256fb8c43b2df84579552dcb9a3352305e231e21b3211a9d16afb4f5af17b075899
SHA5120becf8bdfdd38abc7eb82106386062a39f05619bc5a125081681b72678a3dc02e4a070f3bb37d52ead3649ac6252683f73e1f356ae0c907a8e16956683f90a6e
-
Filesize
63KB
MD5ae27362d8ce778a1aafe9c000e1fae7d
SHA170c4cccf1f60aac027f0ddd92bd5feaa7b9b32c5
SHA256185b8040c4be81aeb04382c4f84bf26d261b87691596df242303c89cf60bb857
SHA5128403c6022c7e8ee4d89e6de9fb762d4e6ea168439cb5f53cad710424cf3b978a0e7b119c815f8ec9b43669a54e26306fa857577fe63c036a37a84ce841dd8b7b
-
Filesize
57KB
MD59c008d0520a445a2e078228c6297fa56
SHA138aa23895b88ed26a6137d5b2d15ae30045fb36d
SHA2566dab7f18843bdd5b04647bc2104a5558c7c1501abd1f5a4fe686c193ad17f56a
SHA512f90cd07119d6eeb1452a091a757854f7cbc1551824a73d760695b493ed79a39fe54e194d82fe62cfe322fa8586439491dcb74e750ef4447aaa31b531282af957
-
Filesize
69KB
MD5ed11c2e97c76193716007ccd4377d72d
SHA1dfd0e60492d6eed70230f357e3b399f7f016eee9
SHA256e45cc2b9286bb264fedeecac9a5a5bc54b52101144f5f10bef91464cdd0572d5
SHA512675e1280b2b987a592bfac31aa59f3e5248a69a41e1a3fde57d78b8ad0ef27428666f624ee937a6b3795068bdc93945294aa62263a57b94df4c9cc14e66e501c
-
Filesize
51KB
MD5aa489ad8fe562b99353f0b40213c7e55
SHA1b294c27db954e13346459f740bd9ae36f08980b1
SHA2562bf9564ae58fa213f5adc9f3958e0184d607753eff183ffd001c0c48cd5eb514
SHA512e181ad9b095593f0f52738f74338c772f7cd3210f90ec0939b15cd93e8a3dd6b22659b71f1e313b19821086351b17acf37f2835de3a330b06314412509880f1f
-
Filesize
57KB
MD59a14800731ed3325d76e2ac1d8f3bc67
SHA1dd4cf1db4495afac17297271add973698758eeab
SHA256f4912c4fa9c55140f02c3bfabf723aaae7d8c6a6f252fe0608326a961e4e2b11
SHA5120f3142c5ec41bcdeb190abc0486430e530e713bebac11c3e3c3209501f255b98ae941e9e7c1195eac2de1faf807cd34882a8730aeca121c1811bf1bbc2d74556
-
Filesize
76KB
MD55d1913b49a7ac7e436fd436253bbc1a7
SHA1985c3de243d23da08f32f3b57438caea3d26410f
SHA256135865ed6aad7b90bdb9791f91861772ca58138d49812e3d97463807cbf52b87
SHA512415a1492cc40b47035089a458a2b621554985b5d6307c37e33866a0f0813abc5c07f5a0d259e720b632aaee8d65ed913fda7ed0251b892f79715929b4e4b0739
-
Filesize
72KB
MD5d08af6f3d995f711aabcc53351bcfe47
SHA1e685f6686da1ada945bac52b608585d205559aa2
SHA256c92de3992fa26e536b7c0f1315af7adf49eac9b4aa9fa2e08abe1f7c03840f71
SHA5127b6d64575d6aaf0c7d87b8f864a8665f771a64457c4acdb3eb346e102a46af5721d3369212bed2d8e353f7cfa1e51bb5b82fbfd8d71617ebd1a66873c4fdc913
-
Filesize
61KB
MD56cb99da68aa0317e2e8ccd3e9f59311f
SHA1194c458fe41ce2f3e52b7d610edf94284d9849b7
SHA256a93130361d70a691fc9bac3a3e4cb3cae85e54a073ef5df6e04235299e5ecb3c
SHA512917160d9b703796a1b73fdc6d99d11cd54887afa388533480175e24ecbcf5dd947a451a34fdbdbbbd05c4f7bce1448ed8f51a57d975898a3c29423fb5bf29a86
-
Filesize
69KB
MD516dab80be78cf56f1c0420ab6e5a829e
SHA101788d519d756e278bce3720c25e6d9b7b8445c1
SHA25603c714ddaf5d92c8cb4449e0612b8b3f88e6d70d2e4a7681a5aaf22dbb4b10b1
SHA5125f6f623c1bded9a2007da31e267710169f3dd8c1237c54aa6a333a396fc58e3866c28b79b0156726226fab44936a3480e02d0acb499af35012654d473fb7c76f
-
Filesize
52KB
MD5c00f343925e4ead4063d102bb06d2187
SHA1f023641c6da1505e838f343926ccbaa2cd4303e0
SHA2567938254b4290f817df90b6ee2ca0ddacb3b7a2df5dcdf0634ad9b97c4f46c95d
SHA512ad613f83f6b78cd30c79ff5f8ffe3f7147b1ef66d9db861ae13716c946bc915b82986ba310e5fd3745c31569abb962fc262a21b20969380cf4e044276a3a060e
-
Filesize
63KB
MD533b88514128f1e7d01e0b7335746e610
SHA1ed90a2387ce855ecbead9c1439674e9835b46235
SHA256bc7f76fc7bbe2ccf4895fbf125c5148bd166dad929f9c601aafa9969f2821b5c
SHA51221f35fb3f645bab87be2658a77ec7406b15224d8655a4adab1f716e077996729da59fe5d682b506e6fcd7b91d8f9c4d5e7a9ddaf6bd78203f7df8ea4b9118640
-
Filesize
61KB
MD5e9f9872879be84d47830edeb7f2b780b
SHA112aff37f26078fb878e55d29d35d6f95276f8fb1
SHA2569ddc141122779d4bab054293553fbd0ced67f75b1f9425a50f74eebcae7b18c1
SHA5121c6c85d213f4dfdf29fd5cf0547aad2e0ce98c51207519e57ab67e602e02c26281852b41653b2c6521b3ade2753f7d28bb1b46e48070c0a71794c436271ab057
-
Filesize
6KB
MD5af9b8c9d7b7f69435b515052ec8fbc1c
SHA1b744c1199fa8e5c058717c849862888ce9418c46
SHA25604b33e7da44fb296a29499bc06b1d7ef6e7d1794afd83020a3efbf6650b853d9
SHA51246672a80fbb8d02dccb86af2c994a4a6a7d38bddacd2b4681ec4320c12fa064260da28347456809862e0260261a1c8a239b0289eebf255941b0d2a2596361ebd
-
Filesize
141KB
MD557086b02f74c3fe7b79a5e2e3d852322
SHA16420387225ddcd5210175de4f3fdb0ab2be8ee9c
SHA256a1b5be8d4aab349aff58ed34e1f3bc6647cf440830da0a12a8bd5a1c976c6407
SHA512b195eb9a9129863e75be603b00b85ecfe46360910529fb38513af6940f9d17efd56f234b47963452329cd85b16bebb5a85ab5d304743e57d33bafd5b59900468
-
Filesize
50KB
MD5b75704e3fb403d1b726f6bb6fee24c69
SHA1d655b745f4b1d9f4453976471104dcfd2797bd4e
SHA256d404f5d1312a257ac374041f2de3f7499ce21e329ff86c243262dc52b2fd59ae
SHA5128f61eba2064437534a8e1929b6ba4cbcd878ff9ae1993c8da0c57c272f57c6a298825064d2c3e4a613d8c4497c1b3741591576bac5d09efde530bb08ed9253bd
-
Filesize
11KB
MD59620a48bfaea2e0f26b9092c7636e2ca
SHA16142d9c77ba11cf12ec2fe746659e9ea95a8ca53
SHA2567605c62c020ebd914e6942b8468a6c33f0bd6b14de7a3eef361bc770f74bde54
SHA5124e921cf69a6508b8d43aca6f301a9d96594492650c8f34c00d08627f806df7a364da7277af8ce5d291fa0658eede15c70cf9b19115a0147eb9e8fbe8a52b4320
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\SSLErrorAssistant\7\ssl_error_assistant.pb
Filesize2KB
MD5e2f792c9e2dd86f39e8286b2ead2fc70
SHA18a32867614d2a23e473ed642056ded8e566687f9
SHA256ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7
SHA5126a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580
-
Filesize
163KB
MD59b8d5611372559bb0c5ec7a5d3f5096a
SHA198cb279b6e94e424faf9f6baa86a0c84140bd569
SHA2569dece439a4472ee74f0a5e239172e6bdf9b05ce85a9f6eaf79598d0817eb6902
SHA512da044c7790191df4354585aeeb31428300fcd1478191b2d8ca445f90d79c3c61967e777b6dd1e098f2fdbc06d236f819d74392fdf94bb164c1c152f2477195ab
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\TpcdMetadata\2025.1.15.1\metadata.pb
Filesize33KB
MD50f83ea8aad2d94a32037e90f2812611d
SHA166a2879b881176df793c94f6833441fe153e5135
SHA256628b2de57b5dde868a30e9c45ffc6ff35a820c93a90d3f4ff61a1ff5396eaf54
SHA512e676aa774c099e43c00ecd42d2f10ae194910d9b694629abdba763aefc1d2c541cb1133ad3bf74df08fc6f8fb32b3f3047c07375977ee8d0f8bad9eddb7bc388
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei\1.0.290\list.txt
Filesize151KB
MD59e7546fe03e01da7ea2443e2a51419ae
SHA1615ac4aa39bba0a0e495229e33fca333b5b308db
SHA2568c92b2a97b894de01cf075214d12f2b1abedc5d20a0034c9efeb1be828df8486
SHA512f6441d6b2ff91ed3e26ab4ebaf16a6a7a6eba2056950af0cf4a86490048f4c79faa0969b8893575236184d9dc6de536764dbb2b86775d7b71c58f99d06cf0d65
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1034\1\clean-urls-permissions.json
Filesize268B
MD500acb0f14b6b6c11ce80107110ead798
SHA12a40b0217ddea6d507234f236d3889b46ee35baa
SHA2562e666bd0d92b08bddac4487b184c5612dc408f21fe4f3fab78a7ce1b2fa3f8ca
SHA512c3a53397be2fcf41702524cb42c8d2b49d4cbde4c5479c6d0d6e92152cd213dd7436d7729906d76ed003d64e806cdf66dda7f3ca8dd4b9f9efabe25ffb76c2cc
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1034\1\clean-urls.json
Filesize18KB
MD53e6714a16e04d03f205a85f2563eb1aa
SHA1a76641cf3a4745ae2e4426fb10b73a6af4f1f272
SHA2563c09ee2c055819d0ce5368cfcb19cd5384e2916d7a5c2332f59ed60b3545b0c0
SHA51205062fd40cf019b7367c2cf65d2fd219fd4e602111e9bd20b76545dc890f20fc4d1ed798d630bc0821d52ef4c35bd83e63bb84971d10f162d4c6c12eda8526b0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1034\1\debounce.json
Filesize11KB
MD589b3c77c6b79fdf5252be739d528ab23
SHA1bef55bbd5fe8b4d92551618391da721c1dc5ba27
SHA256066f3b4550e5f6ebe7bc9c4a17e7b64c26a144df206d87cdf1f981634a5a76c5
SHA512e397d5dac9662ba5185cff7af34ff8b5ee3ba89a795aad18fc1bdef90cab9e45a78b523589b8edc1a0c3fc28fef10bfb84983e0f1df06a8149f33187914f6bbe
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1034\1\https-upgrade-exceptions-list.txt
Filesize86KB
MD5b8ebe8c70e14e1bdff4bf04cee9055a4
SHA16a8eeeb539eb5f630091a971585bc77731c24b12
SHA256a9c464c1aa17ec9958141c020c30badddd4801e15b9c0a0d430859df0ad1955e
SHA5129240b1d7ae17b6d20cb21a466335471d3b62ee2866e6d07dc62c1a288def513cedb5368891e4c8beecd135140a221bf8a16e048cced31b29fff9f8d0d40c7266
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1034\1\webcompat-exceptions.json
Filesize6KB
MD554b1343eed0640cc4b415bd1ef50dba1
SHA1df0a9d4bc264e7c9325a9d082ddb3ff8dea528ba
SHA2569344abffe1529919decfc08c1f171600319625ef7ec9a6d63dfac4927d6246b4
SHA512c7689d95879d890425e95322613167cb6be9c04f207e847fa3f6da4c752413325968a667fd3044d8cf08a74537a1affaffd02dfa33397079bdc603768f757e92
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\StudentNTP_Alyssa-Skala_x1280.jpg
Filesize308KB
MD52bd8dda959c6b3e68379301df36dfcfc
SHA1420fd6daf63e4fc896a8d5cf7320fcfa8f3bb7f4
SHA256225b36e7a6f884fd3dd7206851c35b27a2f882a3d8bd9217799165b357bc58be
SHA512b0cdd950dd2e8af198a5aa053b3059493032b609d8207939045c505085463c7c2fdbd0fcbd0655f841f89b05d04b60618ff1679586a42a0e38329d72ad8f4e3b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\StudentNTP_John-Ng_x1280.jpg
Filesize418KB
MD53d133899b87ae6e9516b7c2a563b1694
SHA11dcf87d50a46dbebf271e67a75d27716f0d7daa7
SHA256425257fe0d391eda8c851cb06bf8e929d6078b23c911ccb643623a21e1a26c7f
SHA512cf537d86c84f7c9abbe9f8d212765af35aee51a9ee9f96a2c1ce39f031ab797891b76b9c828b1392673344b88cf9fc536b77345a360c41bfadf2c027ca257cd9
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\StudentNTP_Sam-Richter_x0825_WINNER.jpg
Filesize544KB
MD5f66e5fa138432af6b40849484545b809
SHA125942df987649a1bddda636686064d29dca799a6
SHA25665b5f21ccdcbdb23f39baf036ae5eb3999f3e88e241bc57a3a4d1bf0fbfda605
SHA51229a512f0f028b2c4e53f492f6a4fe27cc88b547334466341b08b70724b16e7eaaf70cb0308e251f404aa6b80db972a553438afc3894440e1b1ed0962ec7a5319
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\photo.json
Filesize6KB
MD5a7e80c8cc5121a2febc654140e53ac32
SHA1c3b1b578dcbf91aa19e65d0ef6974c165723828e
SHA256a2595174656b59176071c0b79b404efa7246a9242c2bd19545155194c6b8cf99
SHA512d7ef1e8df49956bc212388ef7a5343b9836e825c4ff066aa65bf0f3a136ecee4b63ff807dd63eb33e6e812e470d644eccaf3a7f61a816e441ffc44a982690577
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb\1.0.10736\list.txt
Filesize54KB
MD5424f676bf880318b4db096fdeeb5efc5
SHA108bfd47d8afc546a1a78a4cf49e62388e902f510
SHA256a9436aa8805942fcd8ddfa96acc557b50ab67cb661035efd499cd7bdc1ae5cd2
SHA5127d979b9483b3db5b112210b3c9c13ac06611ab0a98de260bac60445bf105bf00530557a6de24357fdd22a96f2e596d5ca6b45fb24bb5f5125a927482b1c4191a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe\1.0.11960\list.txt
Filesize1.4MB
MD52fe70d67724db5e1a58067aa3a74c3ed
SHA14405431198b1f8cc9bd1d01cf5a49f2d28e85cf4
SHA256c9cd765f6c04905ed44ff32d03664a95d1e970b77d1662cbf3ed24d8bc85607d
SHA5129ea3552950d65d3e91597477a9729454ee9b694e953b20a9cdce5fd46933b31d3457be24174bcd145824a385747118855e1c2ee7c5d8ca58a9303d94fa235fb1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\adcocjohghhfpidemphmcmlmhnfgikei_be8af71b9ca03b332d95897e6517ee1dac14c2c3ec88732fe9d5807759fb6ee4
Filesize51KB
MD5c3417bff3e6f2c693d52d930d9b4900b
SHA1144ed430e0251a1e014360144515734d4f9c669e
SHA256be8af71b9ca03b332d95897e6517ee1dac14c2c3ec88732fe9d5807759fb6ee4
SHA5124c8090f2bf57fcea3ca30d8069e79c1432f13ed427b855192bec28fae2097f6769cdc3b1927f7b4f7a722aa5291502b47c461adbe6010ac4d7945b389abc4ce3
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\afalakplffnnnlkncjhbmahjfjhmlkal_7a1b58bd8f5df9ba803c5ca865baf4a3607e601859f1dde92c76ce08366b1bb8
Filesize71KB
MD55aab41a1e4d31a4a7396b2e5eb645dc3
SHA174b20045f49707e1ce4bb0f1fcd8cdd9f5905020
SHA2567a1b58bd8f5df9ba803c5ca865baf4a3607e601859f1dde92c76ce08366b1bb8
SHA5121364986b2fc0ee74ac604558529b7007f0d60550dd36addf64cb613e392b00806e211fdb78bfb6fbd278aaad9e61c87c72edeed503908c6b2ce58147f42596a0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\aoojcmojmmcbpfgoecoadbdpnagfchel_9f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a
Filesize12.1MB
MD589c01a540e21a6012c4292eac6100dbb
SHA12bf600a9d372f38d37c64a9df5cb26d5cb046cf9
SHA2569f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a
SHA512abd83f91b97c9c9bba4cb82501a6d316ef07173e4916e87a13f888ad32947b424d18bd6186a36245b2bd9f6c6cd29ccaaaf2445b3e5754c30ea53f1ab6016f25
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\bfpgedeaaibpoidldhjcknekahbikncb_0c7388dbf4002e357257de4114dbb346bdedcf865624a05a36e0593eac5a90d1
Filesize18KB
MD5041d2d22f1b0939513a3b4d41f44b92b
SHA1c5ad0ff44cc32f94a1b20d74377cb9499dfec358
SHA2560c7388dbf4002e357257de4114dbb346bdedcf865624a05a36e0593eac5a90d1
SHA5125a2ca31835022dea080137c1d846bf6648369081480f7005b970450b4b7bb3a08b9f2b90309daeae331e20d4b32a22b40eed36504f291e52ab4f1263ea9188a4
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cdbbhgbmjhfnhnmgeddbliobbofkgdhe_cef8879bce05947267c1e715e7502d6afe358d288551bffa56f5c2c135b07aa2
Filesize411KB
MD51c581ac3a67443991df13f7e3f97673b
SHA1835378acfa476079db477047283a0d8dbbdee692
SHA256cef8879bce05947267c1e715e7502d6afe358d288551bffa56f5c2c135b07aa2
SHA5125b6da9aa881be39f6d7a09f74e34619f071ae7174a2606a046cfd49eb76240c9f751feeaff4e30862582b00dd9dd6f01c4a8c414686a72bcc569ee1cca9b16e5
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\efniojlnjndmcbiieegkicadnoecjjef_1.883561cf17ba8ee650d401840a04dc776311a2ec15de889d0dea2e79b33d5019
Filesize150KB
MD500c7cb9daf021bcb6f6ea00878a1cbfd
SHA11035712ab0c7b57755b361f86d7d3ff4ff9aa307
SHA256883561cf17ba8ee650d401840a04dc776311a2ec15de889d0dea2e79b33d5019
SHA51249f8186c41212e126e6d580ec9cabd4afed367283fdd6b34190bc06a1a9b71e160943dab9ea1468fbb643e5e5d19baf0449eb60899dfdb653ebbde09ad689d57
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gccbbckogglekeggclmmekihdgdpdgoe_848ded94484e0a5d0f9edba1dd6fa06fadcf342e4f44a02c74eaea1c5c27eb36
Filesize741KB
MD5ec103402ec07aa49391a21bfe11d825b
SHA1a1407e897581d0f569089c0b98facbb0f2e81654
SHA256848ded94484e0a5d0f9edba1dd6fa06fadcf342e4f44a02c74eaea1c5c27eb36
SHA5121d3320cbd8d9ff0f4b95b605acfe298b1024acfb2ed8f2c1cd494e8e53ec8b0b6ce356f78b6abdd73bc49de2d3ca16bc6191bd35ee52cdc0ec68672957f0bdf7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ggkkehgbnfjpeggfpleeakpidbkibbmn_1.3525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f
Filesize10KB
MD581c39099b5a4e221569eeec0a746af7b
SHA10601105a54e905370e965cbf8cf78bd6d8e300c2
SHA2563525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f
SHA51242011c20c52733df0116c4661efdce06d8ec70dd38cfae2cad45e4b4eb7cb24ab4061e968e4d5766e4203b8c4caaf2b6727e55bdf78402157a19eca0f2e89140
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\giekcmmlnklenlaomppkphknjmnnpneh_1.3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
Filesize5KB
MD5636c653ec2c30bb767533901a18669b2
SHA14b5a01cfea4c5deb62f3aafa01ef24265613b844
SHA2563eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
SHA512a4128fb20a5df9e573e92b45f5bc18dcdf4be6e7e39172d08847882f17361320141e89b35deef337e40c365d6f1ccdd1b991eb4593d805dfa2e39a5257c335ee
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gkboaolpopklhgplhaaiboijnklogmbc_9b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f
Filesize76KB
MD534f31f85a6b2a69a074939e4e231a047
SHA197f6d1a966baa94e686aef7fece23bbf099fb8c6
SHA2569b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f
SHA51220f4d9efe5450e1f02608d382c97bd4269298c87763a4abcf63a5fe0ba62dd0c391824964084cc011ed6cd7db99c19c9b6411b04d42539081f3737dc78a2f2ed
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\heplpbhjcbmiibdlchlanmdenffpiibo_69d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f
Filesize4KB
MD53a03f3ab4119a23fa6b70a32a6fcd4b0
SHA15d047a5da7c7f388416aa50b5fba745bf5f36eb8
SHA25669d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f
SHA5128caa4e94e831b25226e956a8ee87c5b369547081df863ee34e7f80d686259eb9b7bf75757043ecc5b0eda3a603198da060f9b6f30be755350ab912fdc7681819
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\hfnkpimlhhgieaddgfemjhofmfblmnib_1.5403446a7302f3c11920b8a3427849d2c1596f9f378f6674b8de6ed1b33b2fe0
Filesize585KB
MD5a9a36c999223cb333bab48d71559f201
SHA15c7118053f6edc7190a822fb5442a6e0495dbd1c
SHA2565403446a7302f3c11920b8a3427849d2c1596f9f378f6674b8de6ed1b33b2fe0
SHA5128cec58d85b38690babb580597e29e46462f3d49cd94365602ef6cd5eb4347e1bcf7de40640c79a70b3df1518d558463f20d3299326ad407eabf8afdef64790f1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iblokdlgekdjophgeonmanpnjihcjkjj_44fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72
Filesize17KB
MD5a1b36d762732f9439efa78708a40dafb
SHA16533b78ae795077fa711c67347eabdc88b5a6c6b
SHA25644fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72
SHA5128dbfd514f87e7b929ab9d2b61f99939b3cf687947dff980ce3378b56127785acacde7b8fb4ff034e2a31f8cec1901605c6216b6846f5d2a199a245bf6144e05d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iodkpdagapdfkphljnddpjlldadblomo_3a3783434bcf534c3adc891f6a8332ac5e99abddafd2f747f200442719fe12e6
Filesize1.6MB
MD58e4937d78fd9c9154a167da56bae93d5
SHA1d6ca81e0667d9eef9fa9a1a73b77e45fc67a70f5
SHA2563a3783434bcf534c3adc891f6a8332ac5e99abddafd2f747f200442719fe12e6
SHA51256aa1c7a249b10f52f1beccc4721fa12af7ba1473d960abf367a4d10a84d16a54c1a89f917e2ca8105da2069e4cec728da2d57a0ab25818350263e2a1619530a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jamhcnnkihinmdlkakkaopbjbbcngflc_1.c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
Filesize1.1MB
MD52ac309d48a054c8b1d9ea88bac4dbd6c
SHA17507922d88a9cb58759b5326fadae5d0c87f40b2
SHA256c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
SHA512870dbb86a67f36a43ad4c80db904e76b602bbe062cbb9fe4222d1cc69d99aa4a60aae91c094a65a481d8c62cca4942f178f1b2744ed21836a526c7ffe3409969
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflhchccmppkfebkiaminageehmchikm_1.4871e9fbee798f3aa1612910d64a57e76f2d1b9e729b30305020745b839953c8
Filesize9KB
MD588b5e8d596be36e024564a648aeb1b06
SHA1753254eb16b07ba4561f4a39978ee61fd915fbf8
SHA2564871e9fbee798f3aa1612910d64a57e76f2d1b9e729b30305020745b839953c8
SHA512fcb3e71cd6d7a23ad0e1cb6b6865a9f03a591fd887fa2b1839747feb032f5ba54ec3cb0ced44d6a012cec2f06dd40549ae4ceb8b90ec306fb16f26c9f93c543e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflookgnkcckhobaglndicnbbgbonegd_1.dd7633c0a3f938350e3d5777455ef21cc9a85acbf27316b4e295bf9888c515d9
Filesize77KB
MD5f6d763deb52065a1e989ba71294ec923
SHA1e8b992cfd955d6047d0f49695431257a3efb9e92
SHA256dd7633c0a3f938350e3d5777455ef21cc9a85acbf27316b4e295bf9888c515d9
SHA5122f5e8e159d767d8777b460b6a7a51276bece5c5f655a4faabe267b2059c6472e1024fa13ab065a0a6094dab680370122454ad49612ed762590246c6194cf4be0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\khaoiebndkojlmppeemjhbpbandiljpe_1.44c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319
Filesize5KB
MD593e97a6ae8c0cc4acaa5f960c7918511
SHA15d61c08dde1db8a4b27e113344edc17b2f89c415
SHA25644c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319
SHA512e61727a277d971467e850456fbc259dad77a331873e53e3e905605cd19b01c2dc46df7400ce8442e39cfac5ac3fbcd833ec7310c7ab1c3380d900dd676ed1679
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\mfddibmblmbccpadfndgakiopmmhebop_bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3
Filesize179KB
MD562af22ce07e0375e66db401f83384d5d
SHA1468b255ebdfc24ff83db791823bca7e78b09f3b1
SHA256bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3
SHA51254dd31001427a97665dad169b0d5f32fdb79a89eac7fa23a164bf78095be2d2e5f9195eb9ffedc2d1998f839781e32515baeae482ec74d8409b0d58fe53993e1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\obedbbhbpmojnkanicioggnmelmoomoc_1.dfddc50886ccee464d4fc01472513db1467df85e37ef600b19c1ccb8a1a4dcd9
Filesize5.1MB
MD5be3e537007af657edbb6f5cd2eb24e21
SHA12b59970327411f62c4b29d93f4a8582c928bfcfd
SHA256dfddc50886ccee464d4fc01472513db1467df85e37ef600b19c1ccb8a1a4dcd9
SHA512b79b69db8c7ec82cb74cd3c9e986e19f6a92450a85fb9c06ccb698377a502a3b010896ef5fc510af94dd4080171cf37d3eaf9e6b935c94960642bd571cdee2b9
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1854\1721f6b0-bb8d-4a29-a7f2-6445c9fed510.jpg
Filesize352KB
MD52a6d208250f99d4b1fc179ca5c30c3d0
SHA164e86b70ea5a5a23d93e9298bec62132b6ee08bc
SHA25644c85259b17114091338378ba23dad170f1dc6b65a07e00f8353abc1129abd57
SHA51276266650779e1b76d1d7e445dfa5010a83fe227c67eacf6fd88f7beabfead56d378a60f045865e605773dc0f1da97b3c0ff54da3657e1243f8a96f00b97ce256
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1854\3e86ca4c-6553-497e-9616-910182982f3d.png
Filesize26KB
MD549eeb2546b3dc3b33b58f8a68c8fc054
SHA1efa296faf7778e83bfd8426c93286f884d888c3e
SHA256e08bb357290af51ebd055966e90debd734a47609203b9540bbcbdb02b3449fc3
SHA512e46847d1d484367ffc5040ffa09499bf07fe7182e60dd76eb43b22a4bc0a08550cfa088b5aaa1d9411d110ddf86d9b50a0b5f8a0492be5dbace1310795aa01bf
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1854\photo.json
Filesize2KB
MD53b5a8b4e7805199c2108e7a69c947aba
SHA1a308e26ce68d8accc163f260a3b97f25c6360702
SHA256f6328145b9e39e1c0ac6345e6b10ec7f0093c746665e36968f8cfdcf5dca4d13
SHA5128428ec61754fd2bd85a5c935b54507b62f3ad68d47308f4271db8699d443266aa738fb3ffe2668972f868cba4fae6337ed532da5bccbeef9509395834c08024d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc\1.0.69\list_catalog.json
Filesize76KB
MD5d1d6a9d9cc2ada3f3bad8b0da607f4eb
SHA11d286de6436a8a28584744f022af73077ed64601
SHA256f1a889c0f11e2642c299774f601b72b5cc51e86bb1fa7514cfa9f4fa1a9538ad
SHA5124c43a10995b91d2791a8274813f005feab48d83078fb8b51f026266ff524ffbc53c41d507d801101a9a7f765453ab4b08398f4e743b6beb08036b72e40b82934
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\heplpbhjcbmiibdlchlanmdenffpiibo\1.0.11\mapping-table.json
Filesize4KB
MD557ff689022f2d93d2287ac3b48daec73
SHA1937b7dc21193a27607340af7fb7b987b8ea50582
SHA2564665c8cb39b1fd0131b72097484bd3a8309992821a21de9ee0420434cc3f7d5c
SHA5121b81c2c9df45875c2f563b99bb2d29972408e3d449fb2e8793822dc0cf85c41cb48eb92510f4940343ae4826ec9bb4b98093d64f53de635ccf75b5307b92ca87
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iblokdlgekdjophgeonmanpnjihcjkjj\1.0.106\resources.json
Filesize269B
MD520effecf10eeb0456cc6f537c802f172
SHA18fb3968af27ad30c639f45a6fcee99b48ef79878
SHA256044502a67e39049b4cfe2b80295ad396fff4d1a28e7f2a1200abf21061aace8d
SHA5126a002b205519c0fc498c139d1efcab2f26bc03f3fa795a5bee9b3358c9796088bb6419e2b95afdbb84c5ea36a328dfab01b33c148c84dd8e3b9d21fa07fb6dce
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo\1.0.10169\list.txt
Filesize5.5MB
MD559de9cc3332cfffb261b21f7a4bc2921
SHA15108b5720965343f3f2a29d67db0e21a116db06a
SHA2568caf656492bc5f70265ff3f86e345749f5825cd20fda02115fde944082ec27d1
SHA5125206c0f8062f511d29c51743f07d26c14f0ba754c883fb1bc1d8d05a4634406dd9c69d4c3ccd2021740a1dbae5209b2fab1710ad1a4caebd2e645448c37f90b4
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop\1.0.104\resources.json
Filesize1.2MB
MD5f7e232619fcd50a55c3df6ffbab0245f
SHA1f26eff68192fa88acc08ed97979c258f8f534a33
SHA256f4e1a4ce5d42af762210fc9218115a1048d3564ffbc987b4c47f1d9321dd35e7
SHA512bbe0d62000740c6958e8630af812bc388011a225785e3f8b3b7ccdf2e033a42d63db566df030244ac22884d005f5f2048b4a506ae64a8e7062395b8bf08430f4
-
Filesize
40B
MD511d253b3a6f1f94b363fcb04e607acd2
SHA19917081d96e0d89a6c6997cc2d4aad6366ecfcbc
SHA25620152f2fc1ca7717b9b858435b3658ce0879f28944bf822210e5ac5e148cc7ff
SHA512101086c8c2805dcb8bb4e2a3c979574fea1cf0268859804c350f05a85945216de51bce90981a11d08c9a7043efee5130ede5c5a376cd86707dcc90c0e4f45334
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\07dd8e33-91b7-415e-811b-20a95fad7cf7.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
649B
MD523040398844f8f3b7f68c75134e74b38
SHA1cd6fc9730879ecabb3333bb2f902599292dffb40
SHA256a7638c5ee42e5475c8491753e01476a0b89ed120b0b94bca8483aa3ab31577b8
SHA512f956fc3f37ef0b21b4206aa4694776ae446ccdcfcc83393aa3277b245e3cdad4cf8db572acc75dd3d9973a1dcbb77681b8f1076d443c070e085915e8f7dd2de2
-
Filesize
44KB
MD58e1df7c0e2599a76de37b5f1f3f90c53
SHA1d3263b75efaee8a594bf08e489237b496850507c
SHA25621a164e9a89ea2c291a539478db9f186e3107de3ee65a7f7f7f90246ba8b410f
SHA512888ef2682a6c69b0e9cdc75d74fc3031e5e69c83314b1ddd61b2eb4d525e0e5ba207b5e2892ceaa1db40a0feb48e7b650c916170ca887d468eb317da0d2d40a4
-
Filesize
264KB
MD51e321e9ddaecc5f197244f0223b8ef47
SHA19262f931d109da11742619f86c0525f3df6dcf45
SHA256377b6b8085b3be0816c5d3d0f5d44733f901a46b2732e159d289077f6572c669
SHA5123db5d73ae351327111633250f435a7d93af2f931584112074432c5a68959d8c8514ac2ed1ed305e83845af244712b7ad46ddf12365f4ce04f9282efe30d563d5
-
Filesize
1.0MB
MD58c63ff42c6ee47f4b34c1c37c25cb6d7
SHA10261d847066f88fd59aa3b743a5aff0246228ed8
SHA2568f87a20822adc20bc7f70b967132dc35a930e9728ba93b5232052848d160da75
SHA512300afb7bac8ebfe2ab54a039b6f55f03159e3fcb24c68ad5eb07aa7562d4123e3490fabf9404018d00e7932720d2efc6960450ff8ec438bd8f07a48d0330b8ee
-
Filesize
4.0MB
MD57b922049aa2a446c2080620f9314e036
SHA1bbb11a237a8836deb4eb363c6565ed710c7bf3a4
SHA2562e094877d8d16a8b4a792137068aca4ef941a1e2177058e97f1956b633e6e6ea
SHA5126e2ae59eeec4f87dc2842433c6e9cd655b0d5c2669d520f26949cfc68fa0e1a582c6f38c4b99a9a538246a731dd367a959fb308842b13581787032feb100a422
-
Filesize
20KB
MD56b492b559e37a6ba5d5fd95902e36c73
SHA1021b9962bcf3b3759af1f83a138fdfcb7f357844
SHA2560a979c2ca66399bf38bfd9985b48b50b90ac7a115e35ea7df689a083257cbc9e
SHA51240fc607c3b9c06d914c9952167c2d77f6e459d95eeadfa4200efbfb3be1a71af9649073ea7406d256512691f5844f161b1f579dcfd80009984c3d010d24aeba4
-
Filesize
85KB
MD5bbda362ec3d1a3425c21fe094e09d23e
SHA16fab48366377eb7d2c6a4edd6e85baf74a32f57a
SHA256b43449359224f52b7f58bc88f581d43d21dbb86d67acd289a84d46ff4a516c3e
SHA512dd4b6451247e31c6abe2c07bd222ae40cabdd576093f2eb1976659b41036b7f5b4e147b252e913472a9b5069c53f36083f1db17b91096535f359894c7e254db9
-
Filesize
16KB
MD5c632d4f4e41be316b3c20bf8fc19c9e8
SHA1e0e67e03641749d535b605d8650bd98cae372a75
SHA2568b3f4a03349e837a652d0eba4616d3e0fae9a41f1b55fe04bc25cf0e7ba6325f
SHA51246b9f10b8d792b6dddc9d71b210bbfa91b124534582035fa39d5422bccfc4764b15d10f3c497dc00874bbc334a45f3573015e2b7f60ebcbfe42c873f6ff9434c
-
Filesize
30KB
MD5e315d6c66a97078cdcb9df3f2af2736b
SHA12d023a1af6fb47efeb239e345efc925cf3dd12ce
SHA2562d847d0ba04b39d2c930d00195b4746963b5a009a217e9e7a9e9f4d768d15458
SHA512f9cb02ec31098084cce042945ff640f22b86f792129a6a974cb79801741cfdeca9ef82cf69af19c1c0399f7df8c59d789f3fe032d45de47bbdd7a6b293571566
-
Filesize
22KB
MD59be89914ef1fe3586978ecd4c579fe68
SHA1ea0ced9f541f265aa08b2b7c6185ddfb7d5c1435
SHA2565d2a31f06a96103f3ae0a3b1105657200ab602f2d23cddb862090d19f938f3ac
SHA512a34e09d186832409aebf083b9cf44ca9b38b9e3c1788f162fa27abc08f3185ddb81fb885f9776878c79dc63e4399f8fef2cc69c209e7ee28d969fc0231c54f12
-
Filesize
60KB
MD5475010c03c15ba753315ec53ee52daa3
SHA13f5d321cdba3133c8d564c578a0434b3ba3e63d8
SHA256afb7051f2c64c0df117c02163e8c56dcf90607ea7e2d11e8d8fb0d669eb1bf13
SHA5121da227e2a4faf331b40859095e14af199e8d329b70a67dca0de94f42a7048a8f4cccff8c22778055497bd2e2395c7188f60458b27d2370e2bd1838ee9403df9a
-
Filesize
19KB
MD579d199915c35744618487c2b40ca73a4
SHA16f7a94c3fb9b704ee2fda196b345c35953ac9770
SHA2560d822ccdfec5d11aa33b42bb3904a22474dc2cc3c6b3e0fc8f4fa5523c43a85e
SHA51284e5bde017a0d08e7905d475dcaac80097ef110fe0c0be82049bf63575d255eb1f8ba722bcaa1d96a9b59202b17c1137ebc0d657c4a6cf8f97fcc336e5e8143b
-
Filesize
108KB
MD5b8a9c6aebf7c45a5a5ad7cda462a1082
SHA1198f671a13fec5a6df84e11e7f6795f33da7eaba
SHA2561940228d9218a25f406a7d4863b397c5122820159ca99051e3f0aad8e98d9757
SHA512996115a4160ee16f8976a9d7d9db4aa8bb15945e57f71f89671b12f8a6904f7254fed1b3123dae7b328fcef40e1ce3a1fab2955fe86bbcbb20bd19e4dc5a065d
-
Filesize
19KB
MD553e1d69438cdd1d1f14394539a80e625
SHA121cfa22d0de9907dfcca0220d4678a7cce58d922
SHA256c18b8a1ff97ecf28c4fd06bb2424188166116bc36fe87759cf8395fd2df114bb
SHA512b01c6c5dd7c8bc8cfbcb8c845f17edd8ea629a238c9d2aed07011557e701cea8dcba2353e31b97aa1b5ae1d964898eac27b756187e6931fbf37a9619b5551bf3
-
Filesize
52KB
MD5be31168314a87172bddeaa1936488d8f
SHA115e19f20eb81b9e9f0a044913a19c6b22335dcfb
SHA256e78348d065101933a019fe362668606be1b2cb8134b3a3be4ae50493a2f45cd1
SHA51270b74344a8034908b40adb8914547853d9d611e5de43d7382860bc04c3322fde9b39837f502a82c646659b68b1810f2ad0118bb272c1aa2cc70f50dcde0ecea9
-
Filesize
20KB
MD55148aa75dac43a70c0512bb307ada1cc
SHA1a1c959daeb71eca67a420a80cb106ef3474e4e02
SHA2563bbaec0cf947aea822f475e7dbb50579624c8dd1bad50f33233c79b3f98df843
SHA5129aeaed348dd3f00319692a913ab1d7b8ed53849a9a7738faa1c2ce43aa3c7a09539c37d208e51e0fa56001c515b33bfb0f82bc3d98dd1de5a79efd2e0cb250f2
-
Filesize
65KB
MD50bed730f5224397d0ca8230f7fab70bb
SHA1745fa77befb18072edbd36ec18f0e3f8cbb804e1
SHA25680d91dc3e6ad73ce8ece4ce52840af07e40e807c1f9000366684142fa2d5fc29
SHA51254cfd6a73d1d05076ce4428674d1684812e3f0ff47544ebb64c1bb8f4c25f7b3642e16bd2a02e220e3c26d9e803d4324f1b8f684298e45c217ff2e89536af414
-
Filesize
94KB
MD58440aa86d69d5859de607401f421cd6c
SHA1307b176eec1d209b3d591c835fb0356fd6f2772c
SHA2566957ecd1084ada36bd233034f307d4b6153c3675c0d977312a7c99770a46e938
SHA5121db60aee1400aad9c9d60391400f055986fe8148e5afc788b3625217769f28ae859a98aac07c0bde74cb788f588a79a83d5445bab62dfafaab818607a83b18b9
-
Filesize
129KB
MD56b6cf3157112cb117b0a3341e2b2dc21
SHA153800a7c7ef4e8179c1e0b6741fba2f53c36bb73
SHA256be1e826b2a32a465a41b871e86f9a7b1cd6b35e9533b3714e32e24f645511856
SHA512790039d9c5318e7a9afc103fa4b6fc33215f9b6ba5b295a8bacb8f1603817dc32c14ffb3bbdbb62d7ca67ae60c8f92f68ea25c82ee86807d10388adb0a883c56
-
Filesize
79KB
MD5b27a88f5ada1ed7d9b6d28a89f2d20bb
SHA1e6889172ee2924344477ea9dcc212b14c6e4c25f
SHA2568a2ed1cbc013e844516859c603d60232f499f55deb8ea5e303203422d1ba01ff
SHA512c4dbff05f219ee5a1ec215f356309af57837e6c2a516e6329386e826623ed11c5452f2108ff56090de7d48c5defe58f49184daeb06d05913d6b24e3eeca3b44b
-
Filesize
30KB
MD5e938ca087b973942ef36ef4fbefdee1b
SHA1faf43b2f2154ef30802c9b17ed38254ee83ca2ab
SHA2569547ba358223a26a21a327119c44f5a2a24a0fe2fb635fb8d3f3bb45264e76a7
SHA512991a79136878e77e0c39d9fccb450a191638c62723941f23cf086110b1b5f77d4ef7fe65499b2941d756936b2d955711e1ef1d2bc192cc51c9ddae94d662fd9b
-
Filesize
25KB
MD52f80bb316e5de678eaa3b6906d064f0f
SHA1cf1403ee21c603a5e5bd0dff785b4b22dd891303
SHA25692774033d77d8ab2a2d0e70e1ae65d064d6c88ae82b8fa16509be8347add02f1
SHA5120cfc50f4dbba35d9b027ff80f3e5aa1ea2b9db558d89a80134c8b0c88bd5af799a0dc3d933fb89ed54557c3f2528308b78921386d0ffbab8a5d18a5d3539227e
-
Filesize
24KB
MD552dd54599464e4043086322a1edf99ef
SHA1f57cb1c3154b0c621bc60a31a36d9a774e1a8ff1
SHA2567ec24a200f700d8fa5da79da0b6d7005340d30f52260f69a247361d4f19982ac
SHA5126018e2bedf521173f5b916ed48ec92b81362c66ced7af477a62dbd3424b74f5027a09124a61667465db5713feef7587e18f91f46ad1b1aa043eabc122ef1f7fb
-
Filesize
17KB
MD5a25f9eba6e3843d704ff3542e16e8dbb
SHA10e30878e8efec164436c111e2f88d58c2092e9c4
SHA256ba2d412907954ea09d7e49ebe0ae4dad3d8219239d9a6197b0fa6ecf5de87328
SHA512327c93544286df19173570df3ed4b69da7f81c7368bea7340bb986c3ae9eeaca164e6cf447e8137e3443e01569987a504f770167bc00b53ced514f1b438d44c6
-
Filesize
75KB
MD52dc4b7699928659d4eb18c014f50814d
SHA1619bd6b212bf64358b249a61ac10469e62a73e00
SHA2568b91d605a7124269a7b31664e63e0a2a5185f01823b1408cec98b28dc2e42d5e
SHA51230a43f51d453f9624cd10199e19d527b7180b1928b0745707852e7ea77ba6c475b6182399d9a2ab9bbb409580bff03952d1ee82b0461ae490c2fac1c40f7a6e4
-
Filesize
22KB
MD5759e7b31d4b2147024a52952aed9da3a
SHA12d9838eae331034b17cd8c865cd407c2993263d2
SHA2566ca1a5f2d5570c5621df6b628d73affb13ee6847d7ec4caabce8d5299500205a
SHA51224257273960a3cc87aa2e7f5c3edce325898f5d194c9303fd62461de804a0b0a57019cf607bea0c2e6ebffab1b72660b4ef51089770ebd4c4a59e413802fde8f
-
Filesize
34KB
MD5b6d09c5e31f0b7a73e8c9d9fa640e745
SHA11bc99b74431dfe829f8f665eaac6fb5e03addc61
SHA2561c56bc9dba7f3e4bf13c9480229f6759e20130dee8d6108a95cc76d925724d27
SHA51264e890efe11a3e8e8f9ee452d0db7a8cde5843d31e2b1987472dd63489ba0874d193cd0108c9e0b4ac65ac9c3dbcc4c3213c1ffb59865396db0994af51ebe25d
-
Filesize
720B
MD5b5abcb07c6018ab9bebccd76b894176c
SHA1313c31f097ba267ea825d383fa9121db7e55f4e8
SHA256fcee39fb6e0a92ad1bc19de32dd340b00bdc8d648a0d59ec5044af5341a350e5
SHA512ce2a9c55592e228fd612c39e4d12276036df1fd5dc265bb93bfdd65fb80393ea461cb1a47865dbbcedba95dd44dc06ff7b0544683d28ad31073237ca5ffe3f50
-
Filesize
1008B
MD5e0b986461d5e1e218d87e6c8cba689dc
SHA19bb9f5cc30ade7ed36f2a26e46e7d9835f6211f1
SHA2560950f52ae30e2fa9baf548638d7e65ccfa41d68231a78d9ef19dc2c106ed35b5
SHA5127b5994242982fe86648abafafdbf63e98cff9a018a7b30ea89b98e5eba4267486ccf9cfc545800c988276e3ddcba88e026c55c46deafab1f045e78f2b707b8fb
-
Filesize
264KB
MD551451677b1e5b4208410159a8c35c833
SHA1d35d7f81eedabf7ea45f2d943c49ef9e7fcf82f6
SHA2568a2777a4f7658534888b8e0ee732742ba517a6aaf7d508e123caf0fdc048d6ed
SHA51243a4e3bcd76c207874278081eace5fd31617b30f08f625b02f47f0c3ea4af3eb8773bb91ebdeecbbf479f054d00daafc4eb36866b55ebd04df577745904447bd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
24KB
MD5d7866b9f8540cbb9263dc34b76249a42
SHA1d301841b937a2a95afbf24eaee80d198d4e69841
SHA256502daa2e1f5c8de557f046a3e03db2522976935465a2b2601138feacf8bf48c2
SHA512bfc15e1932f213c6125f2b50df4685c6a12120763c6bf27aa2af39a536b31607ed43c6e0c8bcd76f403f5542d834a2571128f1dc74d32997121073bf1c1a6bc8
-
Filesize
160KB
MD5a314220c4b16a2e50d5b40b36f35ad3b
SHA142e29f345c827eeaf8a78dcdcdb47b63eba61905
SHA2561c9cb0eee7910757b57e04db8c7f9907be3e0cf09a81d49ee695788f0e87c41b
SHA512fbd2b30a2a5e71598619c01366bafa7d789aaa16c4d9f765b2a0b470a0b162634004931ece5c849e110ca1dd7e9b568a05282bb0610fb4bcb11ac8e271d3d949
-
Filesize
20KB
MD51c4d9ba47f1645f17dc2b75b611d4878
SHA1037f2fe6d9f9255a324c6c9658ba91c2a4b7efd4
SHA25623f1ecd742d76f4ddb129f059ac1423bd4627555b92ad2f5cd2bf5e3b24197da
SHA51238192d26829db25ed532f14a74cf7e7be557be9aac60eb9881108935441a4831eb1fd573322dad380452011148c6ae20c8e5906f309c35a5b3a1300a309a3ec1
-
Filesize
5KB
MD517d289be0d5c9f69e73e7fcf305fd430
SHA1f9ba4188a404e4bde8f46ddabcb6e13f6c6953bb
SHA256b5c66977df1a8bc2455413f589e0559eb1fc0c2c15220974ff647cbbf349d87b
SHA512ebfd31d062076337d20f48bd0b0d85db2437d519ee4fa63ce122353e3bc2062921959191938f8e738f34185713c96c0f20109b566343c95386fadf48163cdafb
-
Filesize
6KB
MD5e08b3b7688db931693d980cd5550a7a7
SHA134652b6532a561f822d539f66317fe1dfc3b84a8
SHA2560f1cd2274b478181aeb0d0ec80c7a49d8f6b96177bc49f0e4d861e2fcb50fb12
SHA512adebb59c55fdd40de6c6bb2d324e80bf8859bfa9207d019d9e51193bfa7569eb2cb7cfa1fb9c1aab13b1d68d876e60598e18fae17a5e13b54ecd24c38607822f
-
Filesize
36KB
MD5df1659b8d34fc42a551687353f467cbb
SHA154709d263f3a49fdc3f012fa081c227046819060
SHA2563dbcde66c5c93067d04b58c3c47d4d96980890edf1e340d38d9e040804c39b4c
SHA512af1d94ed3b8cbc6547c5112df84685df66b2e8a79793539e4bb1c52b92b5f58aa6fa28a0913ac0f3382d4407ed0680dea9f2612fc26be0a2f80d388eeaed9581
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD576dc50b6cfc371af7b24b1951aed0970
SHA1cb9426e03ad6d733242332c2241b0db30d8a94b1
SHA256cdaf0bd7c0fb3dff5ff68968745bea2ef3dbf75075f9eedcfad55bb929bcd5e7
SHA5120b42c4d2115f26e7034c2b82657ab192d7c32b9f17add2646c058d3f8c87c4e6108513684222db4437a7ece31b19e455ad5d67d3ffc1f1cfd1061870686b0579
-
Filesize
2KB
MD5f97960b2aeecff4bb93e066e1d3abea6
SHA147919ba1ee3760cd27917221ab776793d0b63475
SHA25666fb9fe7a285431a49864df5fb32678c1d132d668cd156b29aa243e255c2dc91
SHA51207bb42fc0238671e5471d444480ab042174fbbbf787389b37231b5492b151762a3601f2a4df27602e958cec832a776e8d16ea1bedb03384aaac9ef3428440b3f
-
Filesize
356B
MD511cc1dacbf470388f4c400431522683d
SHA17e818222cbc7047b16c19d5ed4a0c7893a6892d0
SHA256e5ea289885627bbfdb55399de1c35915f9c7a3f8406b70200359792ba7b0f2f1
SHA5126c166ca09ad791cc1aef5e5b8827002bf78e852db43166f382a49afbd85f998700d970ba007cabc2390d80cfd3a1ebf79249ae8118a067867c769506e6d47ba5
-
Filesize
2KB
MD59413dd34a7ec539a59387bd198ac1834
SHA1b9795e36712dcca586170c5016feac843da0f1bd
SHA256e2686ff1d4ae9f55172760f06c74d358f6eda541d5d914555af810b2dbadef02
SHA512e91a23f19c7f0afd08cf149acaad10a70bef6044eef34a4c3b5c738aa095a281df586ccf158050443b49bfa3d73b6edc3d168e17475ea0f7146f21d634b8de2a
-
Filesize
9KB
MD50bf60c331de23c39ab99830260a0e95e
SHA19606fce80c2f63f28b6d5177135407934b30b18e
SHA2563abbde0529a989315a309dc62a37f57c7f26f9919ffc443ba542cdda737e293b
SHA512d2469387182669be8d03e6f03026eed98f39247589ec67d3e99e2b139cb9db97aa663479b94fbf89241ea09851d4319664baa9f8c8f9c5e136e1dac2d8f057e7
-
Filesize
9KB
MD5430e628d4ed46432557e5488ed8bcb3c
SHA127718d45bec4522d1b00370f5e8cfe87b9a3c10d
SHA2562f1f87f2b6c7b6d02c0671d5304d7f25081636295d875c78f13e2205d6fdfe03
SHA5121a9394c60954fa3c0ef9edc5ad8bbaab08d8cb0b65ed18781c89170fedc604eba36892c76039b454b93842bc3d29da8c769b6d376df35388bd62245721fbfe56
-
Filesize
10KB
MD5a17c1b8c6e81212e95eb6eb1472e16d5
SHA1e91459fcab2e59f9e1444c6c9e1e207fc360e42e
SHA256bc6f2e442b48e356dfcff91354860c7ee26a9413739ff864965bebf37c25b209
SHA51224a9941ce43d58bfd5ec56a618b6ac8814e0d9c3caed370258a87ebd2c1656e745f62b71f4fc5969a57c97fe9a8d9f939ce9b2f6b5dc649af2c63b3402a415dd
-
Filesize
10KB
MD51ac4f984ae065ae624883b25a83056e6
SHA16315838959891c1b2cefca542813dad92d36b606
SHA256e9b52cc1a88adb9bb23317b4912d7a0187b82fbf3352bab9a49e0fc9a39dd5f1
SHA51202bcd2bd72786d2143e99a34373423042ce6a73dbd4a69fe5b74c991193ed1c5ec968ef2cd0f895b78ad0f3a2f4246128fe9433e4bd5eb49b1a5a38371f89d50
-
Filesize
9KB
MD51f2d3b63da526e2eeea2643539291d5b
SHA14e6d2567a616382ff8747a5f7105a20415a497c0
SHA256b6c3a2b052e50675aeb0cd729dbadb269a8bfc3974d965f826daf978e7835366
SHA512d3a63188a3a8c546fcd3cbb4b9640d1b939abc7c624662ea0bb4076f93305ae6fdc34a099e2fc741c1828b403d25bc653648418e7524dcc1ac695595224c8a97
-
Filesize
15KB
MD5dc1ccb68b31c0d6a0fbcf5fe4828eb65
SHA1f45f1305600cffda97a2ca1f71da9c7e7b0ae4d5
SHA25637d7d8948bec803293f9bc58bb05d1a904e05b47a7e8f2e05612f155e8681cad
SHA512d9b4ae303229a5b6a64390353581959cbbba31e3e3785434e3b655709dec31d4c3bd031ea78a22c90bf43112ca8246fd1939b7e01d01141b3bb9ee1a7046bbb7
-
Filesize
333B
MD506765508dad8e5f765efb04b9156bdac
SHA1efd403366d2b462a4e5846472796f076924d3103
SHA2568ccb8f094a63b779c0123a770b1a642114be763e75972d87f56fd00bef92d526
SHA51226c605fd1d20187adbfeb5bbe16081981e31c77e0c15eff184170353cc0f8523f300d238e84bc00f30898af0013f654b2efc3fcbda6abdf4521207602961930f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD51b44f8fc4664a279097a91c98ac462d6
SHA12bbbff164e4d35f4dddd1087233d8d33c075a340
SHA256f5c0ad9d3a5166546f17b403b388f68e212da6249d1c7d9b50f80d6bbd3460c4
SHA512d243fc6094de595c5346a3a81eaafbf31c4ad14b3429cf764c4c116e875c7cf29a758193d4ce5f13781307e32b357b30cdd6017ff83393fa274c8e2c1658abef
-
Filesize
324B
MD517da57ec60d7edb37972168fdbb34e23
SHA1915aad7bc2ff6f71e153534a3dc52d42e28526f3
SHA2569d61d8ea55439e88092b44ae70a2844267f51cb95cee559fe96f0afa7052472e
SHA512378afb91779ba33c9e33a8fa0d7866d974fe1feaf5869e04681e696609f06e928d310bf913d5e5cf197b857c0289340671fd810b6174d181260d2932f4c2d634
-
Filesize
128KB
MD565b167b6d1a7373d466844fa6735c68c
SHA144626f4f6260abf3965edd22651d25f489de4d8d
SHA2569225bc76542267b4bae1a8e5384c878d7ec0222007665e0fecb0e943cfa33111
SHA51226055f9ea0c237bd7b00feb2421b3d4ebe3057ac9b8cb51ea7861ee589a131587efc9422d4b8b981a61ebe44e3aba1d4a47f53f1ac4a59fe5bdd6affcdeb90d0
-
Filesize
14B
MD5ef48733031b712ca7027624fff3ab208
SHA1da4f3812e6afc4b90d2185f4709dfbb6b47714fa
SHA256c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99
SHA512ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029
-
Filesize
230KB
MD55adf5c79a9282d8588c627fb2c4aed11
SHA1f68a838acebd73dc3043184c41cf6797742ee3b8
SHA2561abaff841a5aee19b6a618d4e6f3cbf29fda2ccb687c3dd337fad90750546619
SHA512487b1fdf87112dd47d6f88b618882b039dbb9e02ad7101eca77de50fcb6f738ced3ea461742b4d471d75d9525bb9db1b5a9477f5eee37a607390e054f590fa6b
-
Filesize
118KB
MD5291e0e1be0830894083d8d8947b89ab7
SHA1adcdad089b512f1956a22c0c9545d663df6d826c
SHA25686230728039df781932f06e3215fc9d43ac727e166a98daf2a2f604d374509db
SHA51230fbe4183eed2819921d6b4b42f959ecb0c2069de231de6d59f99452b5399e8e51bde17c3bf315574c18cff05a9f3d8b3ee262717d432bef11200d99b1da1962
-
Filesize
230KB
MD5de3e20fca5c16514afdbb06e775f2f4c
SHA10c0b6d75469cda77a4447a276ae15eac7bd4e16b
SHA256a3003e8460c83ec1246f7f86fadd516de84f9303b18d3302800b01196d33f3f3
SHA512e9cf0152d1b874f30485b2701d3064c8e90f72da20dfb2a169f6292b2d8d90ceaf6a03f2dbd16a893fe798403fe8beb1a9eea6fbfbfe83bc14d2384d7ffcb3b4
-
Filesize
118KB
MD5947e745878204b1b882e1c438319c3e4
SHA1513822093cd1ae4dd54d38ef38f4c93205bc9d71
SHA25694f8fc1baa4d41f207ce94d4ae1c749cefda5aed6bf44c049113435d13e8250a
SHA512e005ec3ad4372ab45b1db3f5004ffc84c71414c34c66658778f4d934d26669fc972fa6fa299ded3e06320c51d8d8ac483a1f1ac494254728972e739db3d4c9a9
-
Filesize
264KB
MD5f42f94bdb404be732981bcbb3ebd4662
SHA13679a9d0fcfdff1e93a6ea5d8ddcaf82785b0d85
SHA2567bb18106c0fd166270f5b563b963c676bf135d81e3797541211b9f75c6aa5640
SHA5124abff6f8d9b6bc89064ab2833a6300ff1e5ebdaaf78d268ac4cb2a113de6cf108f20aa7dba488a8efb28205c67e0e2b0c0cf6917082bc559da17fcfb4295ee3e
-
Filesize
85B
MD5bc6142469cd7dadf107be9ad87ea4753
SHA172a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA256b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
SHA51247d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
-
Filesize
28KB
MD5d1fe7f1f35721a8fc44066b016d90f79
SHA1c0e72bada96904fd551bc2a4f13c58e7744c0346
SHA2566cdfae3d7d1729f7d81b7e839a0db7d75a245614b2acf375270d654c3883e469
SHA512fe58e066d88cc87b2c17092684a3516334e7cfb91d57fc81dbadb2296147ff7b1ddbd6f1a1cf8bfc8a917f4bf1fdb46aa155245a08340a60cd0a65da36e5a056
-
Filesize
24KB
MD5ca950636122bf08df3778b545131f027
SHA16142c3d4d40a02dd7a8c4a8b7b2b5fcf50c26322
SHA2565f26db4bdac20e92a979173db3043b91ca67177fb65912f71f2da8a83793a288
SHA512c20c250caec65154bcf57710249c2672a7c9a703172eba8dd164a8e15e6f93bbcfbec9a238ef37ae4af22306218a92d029004d117f838dae783d3cb1b0bfcde8
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir4916_1417064994\7f3e9ea6-be94-4a9d-9bdd-0555e7040911.tmp
Filesize150KB
MD514937b985303ecce4196154a24fc369a
SHA1ecfe89e11a8d08ce0c8745ff5735d5edad683730
SHA25671006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
SHA5121d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Brave.lnk
Filesize2KB
MD5d77081511e559f5eda72c156f972a237
SHA16c89ebee0ca1ce6ebba261b7328e98d0dd4eb990
SHA2562bc307e6436ebbaa3f2ad120154c8707ec22fa657e5052956240798a48abd163
SHA512475a1ee004d0b5bf63daaf99d6ec07404e835c4d4102bd194a26f8d6c4c95da7f951bda040b940e052ea1091437f58b0907cfa1f50a2832ecedd9a4897b280a7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize8KB
MD5061f9c709ac4ca4706d095dffd3642b9
SHA1f0fd39e1b4c5f4c9688d439232b2afb030260382
SHA256d821f3e5a328886cb39ebf9960e04ca30e91cb1c85f73f6ebbba9f998b271532
SHA51259fd21b03fb2791374360d63e340fce97241c21dd33451753155c16c84020daa17151dad6c6a128278d24a2e03b87853b186858a5a641120dcf6d95c115272fb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize12KB
MD579eb528362c8eb9ad2ff8fc712cce26e
SHA11a686a569af1b4cbf8b41bb9c5d09cfa097ac052
SHA2560466a456abefb3a19602a576ec3d838533896bd3ad1b8f0f745c87ab302ddace
SHA5120e49cb995ea6e8fb604986cee916976a8686f40dcc009bf2f356ffa45983f66a62f8c7fcd12d87fcad38ca778f14e46e8d5bb094af88c80e2c7d91b56c99e497
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize11KB
MD57e33abe43496492f8fbbe56188e00270
SHA1a228b76d9440b4d431c86563c519123e44b954cd
SHA256c3c4f0dd3462a78c39aaeb1cfbbb9633b929ea5050a44eb5f47ed668f7b6532b
SHA512c40ce6d18ab419f646c069219b3d0c40fa45fd27793027e4bbd141fe188edcce71219a6bb9868e7a95d92e31bead741e33f503ae331bdc44b2caf47641172d52
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize14KB
MD5225c5cf63d11eea84a10fd3e05d99814
SHA10ee623ad1650bdac81a7607fb3ada1bf31ff0e75
SHA256a8214824080052892bb37dec4b83d8657d6bfe25b3aa3fe7a0dbe12bd95b69c6
SHA51243024cd8da599662700186156026ff35097de14e72930275e5c1ae96ccfdcc27eb96508c3882cc8ef36725b2096a81870a9a64aaa67db890d57ff17827afd8ba
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize9KB
MD571e2bf82351be82931f45d1c7e40e2a4
SHA1129ad4c779570ad368231a92d754842a259e2ceb
SHA2566dd3a1355903aa4c4db050a8fac571e89e63092feedd8cf60694b98ab99aacd1
SHA51256035179a5262b281d8197fd6d8d968e176dfb5223b70bb2cce897f3bf11819cf537eb8ffc6208e64ff1a14310ec789bb216e6d7fb5638c3b58e03851966e80e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize9KB
MD593d5873db87d02749db1377c3fdd2645
SHA155ce2864b28d67ba66062d63c98de08b93dfb570
SHA25656cc132964b916d4ebca3a1214dff0d3359d93cbee0156c0712e341cc247e320
SHA512a6bf760b4d38f19a3670fa4d1290f5b00cd0700c29b529073af6695c3b7f9e89ec350632cd9e6a562be9059da2db74a626b26f6d3ee3586a0701f28301f592e9
-
Filesize
2.8MB
MD5d527605daf4e9a5b286b026d9c0ecbee
SHA188ca3aa2fdad73c9c026c1f71fc80797016c7ecc
SHA2568d69a19a451b63e8a1e90a879a0e93973fe604e75ff35d6a03c7bf7267eb4b06
SHA5126c5589d34cd37d12cbbc5670a5242a70d0486eea89d6af85ba2fe8d7bd8b6d55cdcb432e4a1430701e64ba780cc9d5239298b71511d1fec4ab499774abbb5090
-
Filesize
916KB
MD5f315e49d46914e3989a160bbcfc5de85
SHA199654bfeaad090d95deef3a2e9d5d021d2dc5f63
SHA2565cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7
SHA512224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e
-
Filesize
1.4MB
MD516b28498d2488084146810d1b8577143
SHA19279276bd1557fb5ff543f2c103bd04f38690d52
SHA256f6636ebb80e77225efc2714d5e664d476ecdd0f647ba83d551d9d287c6df0d24
SHA5123245894be88ea8bbe0676b7dcede36393387ba528303fa810f575684d68011786e7a4cd69ddaef6bbdd87ace470a6f0933e22c3625baf7da55800511a17fd0d5
-
Filesize
1.2MB
MD5800116bdc6c7f221f72cf5f70eb755fd
SHA10345c897711b7c51a7a9634017ec0f8a535fbbe0
SHA2563eee2d8dfede35e4ca450be208021e4dd6e425ca887c97b1baed029468db3fa0
SHA5124cdef8f83a1bb881506bc0a31e91014c420a3136425f6b13374b701a981c82877cec69f466e90bc193ff454a199ceab5b7c46498bbc753866cf26b50eb9d93bf
-
Filesize
108B
MD5312e4f3903c4c44432bba32d05890b50
SHA11c43d85b5119f09224f7def6054fcb141c08a4ab
SHA25644ba2dcd8dcdc22358d9e178a17ea739b2712565b088bba7f665370afdf7dbbb
SHA5126840d317d2af8c1f0da8f1c448a276228c1b3250c5216c03316b78c26e0703cbcd335b3f11d499e12800328e40f4eafb238552cbc4e038cb8c1ea89142f9a304
-
Filesize
595B
MD502cc7e44b2fcab7d7aa8d0d7f7b1a50e
SHA1d6d7b30f4d68134797e4bcbfa0006bdf18d15bae
SHA256e3652ef484a60b9ab213d4dbf462337acbc1cd63a4cf958bf06dfb574ecb5c8a
SHA512760c37eec18199eca62e79d476f3059138643ce8798bd09f1e85e01a179da7792c0ea6dd35dfcb9431481ad9a44e7d3cc7e9c1bf0f2bf4c7474015ebfbe3d90a
-
Filesize
546B
MD59297097f2da8c015f8a94acd2d181d50
SHA1cf366a3171379a80449ddb7755986d66c53ca73f
SHA256bf8426137ed6822b8e2e2040833273fdc754723db588a834c293a63b0d551157
SHA5121f0aa5d1f566cbcbdea6a73551e3a4da3f7ed520d0e4591c699eb50a398dd355cf58ed178c7bc950da8e9c02a8c9d9c1e5533270e81dc8df1bf5b36fb9c2b15a
-
Filesize
111B
MD5fecba6c3128a97f09a1173779924be7c
SHA141645675ff089fc6059bbe1ed4b049502241e7fa
SHA2567ef57c6645a8d144047d276b5d41b153c4dc63cf3627c32db018ae64b4e6d92b
SHA512c1193abe0bb4a9359e8e73332475995bd042149f62a67e67d37549993c7130589db809c53657abb7a0f9c518f975f270debeaf7fa70327a81b8bbee233035aad
-
Filesize
558B
MD5f2ea88c3713fadc1cb2f57ffc5f763e5
SHA1203adbd539223c4ea2c2f0a549dd198d46bda233
SHA2563ecf70ef4593b2d7ff9955f6f62f656b1a3957b743972f1b615c91ad8b4acd62
SHA51232b8508cdb2b650abf06c6e1507769cca8cbaa99bc654d6ad528872aa1606bb66773142029f78353798c1ea73a4e2ade7c76582340b85206cda0a3de857dc212
-
Filesize
585B
MD50eaa2e07e1f124de646f1f02113c8388
SHA11e22eb01136c1085ec59c1ad97b04ebd4ee3271d
SHA256ab82ef9f00dba8ea0b6997a8c8e381a1f98dbbc6554684ff4e6ff25c8e264c62
SHA5120fe2d21b8c768ce1088f55e6b319eeb144d55bda7f62aaf1e7a16e21a92a97f52ff13ead64cc72cfa68bcebb9998a52ed94398cb9355290c4c82c02a2f1217c9
-
Filesize
518B
MD5c8e3ccb468295cf6a83a182d31830ef8
SHA1640300cccc6d8c8e5173abf2d05536ac70764920
SHA256148564b2473c982e21f10ee6ba8f89282af4398578169713673e5de969c7e444
SHA512f9996d1197816fb876cb4a6cc53f4f9054208b6bf22b5484d135c29a9ec6029efa0c168f5135cf6c100644a4acaaf8c98181d266ac434df22156fddd705db6e7
-
Filesize
76B
MD54aaa0ed8099ecc1da778a9bc39393808
SHA10e4a733a5af337f101cfa6bea5ebc153380f7b05
SHA25620b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d
SHA512dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879
-
Filesize
72B
MD59a5a99da362e84f6bc53460440088105
SHA13f423954c63ec8e57c00dfac30b15059f96ba7c0
SHA25683944ef33ffcbeb4895d21cdb0b65b0712763d7953d6689a659441f378ead1eb
SHA512d69bc1ae132dec4b28046f66845f572ff552e8c650c08d6dcfdfd8d71ba04904e7771b959cecfa145909cdabeaaee4102ceaf7eeae71f59954b03a07a47585c0
-
Filesize
108B
MD595a4ce489e7170e41dc74ae984787097
SHA13aa6ec73fd4620fb7a2e1946c42e443a887d07a2
SHA25664f88606e2e32380555b12f0a3c8ff5a262f35c676cec1faa36f1f03530a9744
SHA512d1a3b453ce6d40cbc2618eca75e68c952d483d299316cfc9b9e111cd9de2aa930f55882401383e04b77ea1bfbf2a44f47d0ccc98b84209c59ebdb964fd62a089
-
Filesize
73B
MD582bd4111745c8a653cc0355e8816305f
SHA1b7bf21d43d4e5717199415301c4cb8495cd9730b
SHA256fcf10c7298470cfc233e8b87e4765cf4afb8fc3d84048bb84f7f441f7d6ad868
SHA51219bc6307ec4274cb3a399450b8fc9d877ccfc25642e529faa87ab1ab85ba2317eee21c9cbbf8baefc2c3a4315a66cb19e479d27b800d1ace737b32b8a479f1d9
-
Filesize
578B
MD5ccdb43ef72689d4c55fae5d3af1be2d6
SHA13f7ece0c5427761bc20231b01b7ac4539a670274
SHA256dcfa9fe499ed7b48d3e4c1521b847de0e1204413813a45723ae21373b574c366
SHA512ecf99a78381b690c410bde1b960214bb50b8191910f88f23b2199b1d145fef4780e3d98ed56903f5e6d54ce706ee656e517913dcf24ac46359a04ddd552472ed
-
Filesize
563B
MD5f499e12cd5b042aad620204554eccf6e
SHA121514fe6bfb4624b27a085bcbaac6b1ec16aa2ad
SHA256c9ec716dda60a8ea215ef3d3fe85615476727aeec05088c1fba90c24c587b9aa
SHA512f9562a43b1b955cd0c41c676f9e59e5ec53674a6d09d9cd34b73404a78bec6c3c08628545423f52a42c702f01bbd2b71f909610f9289313e29a3d4bc6c20797e
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
82B
MD52617c38bed67a4190fc499142b6f2867
SHA1a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA256d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
SHA512b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
-
Filesize
555B
MD532c91bf9b8f95b4b2330a1b7d8b6c359
SHA132589e12e041bbc42fb3a66c489b39ef380fc1fd
SHA256cf65a918306fa7763350fd8464fd2f3a049468424b6b89b15b15d824f0796df1
SHA5122f6582a63caf1d18298b6ff9ac65172609c3444d676c5d1988d329e2dfcca5293b6cf2838dd9a6eaa655cbff403989f47fc4811b41e9a2b4c10e7478b92f384a
-
Filesize
592B
MD5db4a674cfcc9c6471b36191e41b9cbef
SHA175b394ea5762ed88f379756c35111a4ddc1d45a8
SHA256b37acd1f5410f6e129fe953c06da9341d0e5c05f3808e3f2e13f85e5be7ba1ba
SHA512263f76d4b53f7f0aa1fddc0ed0d789c7fed1a4906c387f1497569d5425ba008686a48e5951d498a63471f1c3a2ebc3e8b097dd405ada3312a028b28d7cd6133e
-
Filesize
533B
MD542009b4dd959e3bc13f18be4df9274fd
SHA1587ae3aa747b57ee96f44ff231efec1cc594dc97
SHA256c9e3cf0c31a16a1a4737fd30b166c6da0a74925590c75026af334c224c022f92
SHA5126a667409d99bfd69b9096fe322eac756e24a96d5a1cff2ff0ef30cbdb66b3355fb00e6914aebbd2fec35107a4e89a5b9981a030e505b8d88cc4a28a6feabc3a8
-
Filesize
76B
MD5c08a4e8fe2334119d49ca6967c23850f
SHA113c566b819d8e087246c80919e938ef2828b5dc4
SHA2565b01512276c45ecc43d4bfa9a912bdaf7afc26150881f2a0119972bffdbd8ab0
SHA512506f9f4fa4baaa4096ce10007eb09cfa95c9188082053b9ff7f2dec65164ff57506b6a8fea28d58783700f257c982aef037afc33f62da8da281e67636430dc23
-
Filesize
564B
MD52efa37b5105fbed3014a7be8963dc2ed
SHA1a03fd940871c3a99836f8f1c3bb2edb5e5a32339
SHA2569961547296bbc34112d1c852fb61ada201f87230e56848c17af3df54ef8921b2
SHA5129b0b86e7c110b5d076d67eca5848e1847a8f04de3feb4a4c71e1d00724fad701b0b0cc3f7dba7450ab3392da4ea5e2353ac9f263b81a5a186b694b5a162db69b