Analysis
- user interaction
yes - max time kernel
900s - max time network
905s - platform
windows10-2004_x64 - resource
win10v2004-20260513-fr - resource tags
arch:x64arch:x86image:win10v2004-20260513-frlocale:fr-fros:windows10-2004-x64systemwindows - submitted
04/08/2026, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
BraveBrowserSetup-BRV010.exe
Resource
win10v2004-20260513-fr
Behavioral task
behavioral2
Sample
BraveBrowserSetup-BRV010.exe
Resource
win11ltsc2024-20260709-fr
General
- Target BraveBrowserSetup-BRV010.exe
- Size 1.2MB
- Sample260804-wpxvsaeg73
- SHA256 5592d75e8e40f8379c598db99f402a6ebef26f5dd9b8659826852de1f67bd113
- MD5 d3377208297b36400e33f9eceedf3047
- SHA1 c4e4130942465a3b739b0a2b66a3f659dc99b3ef
- SHA512 128b8b388610a52ad0b509098b5212a16a8354d2a616ee4709832facf2c0c81e93415c131eac38a35faac3de11332e11031c24238272bae18a52b6f0ba5fb7e5
- SSDEEP 24576:4mmr/02vBHToO5ygbCetj6Z+7mSQnbLARvaStqV6NkdFdU+4nTP4CVSV:Yr//rl8mm1URHtqVRcTwCVc
- TLSH T1B8452211F5D08071E07359302AF0A6B15F7DFC301B759A9F279A2F3A1AB06D2EA25367
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0007000000024a4c-4639.dat acprotect - Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\151.1.93.129\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe - Downloads MZ/PE file 2 IoCs
flow pid Process 651 5416 msedge.exe 13 4368 Process not Found - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \??\Volume{73216430-0000-0000-0000-f0ff3a000000}\VGXMSUXF\Desktop.ini svchost.exe File opened for modification \??\Volume{73216430-0000-0000-0000-f0ff3a000000}\VGXMSUXF\Desktop.ini svchost.exe - Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: sdclt.exe File opened (read-only) \??\G: mstsc.exe File opened (read-only) \??\K: mstsc.exe File opened (read-only) \??\L: mstsc.exe File opened (read-only) \??\M: mstsc.exe File opened (read-only) \??\N: mstsc.exe File opened (read-only) \??\O: mstsc.exe File opened (read-only) \??\P: mstsc.exe File opened (read-only) \??\D: sdclt.exe File opened (read-only) \??\H: mstsc.exe File opened (read-only) \??\Q: mstsc.exe File opened (read-only) \??\R: mstsc.exe File opened (read-only) \??\S: mstsc.exe File opened (read-only) \??\V: mstsc.exe File opened (read-only) \??\Y: mstsc.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\E: mstsc.exe File opened (read-only) \??\I: mstsc.exe File opened (read-only) \??\T: mstsc.exe File opened (read-only) \??\U: mstsc.exe File opened (read-only) \??\W: mstsc.exe File opened (read-only) \??\Z: mstsc.exe File opened (read-only) \??\A: mstsc.exe File opened (read-only) \??\B: mstsc.exe File opened (read-only) \??\J: mstsc.exe File opened (read-only) \??\X: mstsc.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe - Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation BraveUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation TeamViewer_.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation TeamViewer.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation brave.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
resource yara_rule behavioral1/memory/1284-4193-0x0000000074620000-0x000000007462A000-memory.dmp upx behavioral1/files/0x0007000000024a4c-4639.dat upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_423546921\Part-DE msedgewebview2.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe BraveUpdate.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1455792778\1\localhost-permission-allow-list.txt brave.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\kk\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\ro\messages.json setup.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\alan-hu.jpg brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\wallpaper.webp brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_160674851\list.txt brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_423546921\Part-NL msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_569019086\_metadata\verified_contents.json msedgewebview2.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\uran-wang.jpg brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\marcus-lenk.jpg brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1665409095\list.txt brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_176810339\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_2098062532\ranked_dicts msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_569019086\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\sr.pak setup.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\sebastian-knoll.jpg brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_750441337\ebec0987-c5ed-4874-8fbf-032c1cc6da91\mouse-pointer-DSDsXotA.webp brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-ka.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_2098062532\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_423546921\Filtering Rules msedgewebview2.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_sk.dll BraveBrowserSetup-BRV010.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_lv.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_te.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\it.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\vi.pak setup.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-why-do-loons-make-that-eerie-call-at-night.webp brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_url_fetcher_3240_1786903098\extension_1_0_16874.crx brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_824917873\manifest.json brave.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_pt-BR.dll BraveBrowserSetup-BRV010.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_pl.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\dxil.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\id\messages.json setup.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_160674851\brave_metadata\verified_contents.json brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-bn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-cu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-lv.hyb msedgewebview2.exe File created C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_fi.dll BraveBrowserSetup-BRV010.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_hu.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\ml\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\vulkan-1.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\bffcba74-2846-4546-b2a7-b4283a5980e9.tmp setup.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\pawel-czerwinski.jpg brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1437964722\Mu\TransparentAdvertisers msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1437964722\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\chrome_200_percent.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\el.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\chrmstp.exe setup.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_750441337\412e2691-d708-4558-9b1a-269f681564ac\cd51bf18-1293-49c8-b17f-2ae61bff4664.png brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-why-do-flamingos-stand-on-one-leg.webp brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-as.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-nn.hyb msedgewebview2.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\pawel-czerwinski2.jpg brave.exe File created C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_11110670\brave_metadata\verified_contents.json brave.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2288_423546921\Part-RU msedgewebview2.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_gu.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Extensions\external_extensions.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\ms.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\tr.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\Locales\uk.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\ru\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\uz\messages.json setup.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\netrtl64.PNF TeamViewer.exe File opened for modification C:\Windows\INF\kdnic.PNF TeamViewer.exe File opened for modification C:\Windows\Logs\WindowsBackup\WindowsBackup.0.1.etl rundll32.exe File created C:\Windows\Logs\WindowsBackup\Backup Files 2026-08-04 190837_error.log svchost.exe - Executes dropped EXE 64 IoCs
pid Process 1832 BraveUpdate.exe 1236 BraveUpdate.exe 4676 BraveUpdate.exe 2336 BraveUpdateComRegisterShell64.exe 1412 BraveUpdateComRegisterShell64.exe 5204 BraveUpdateComRegisterShell64.exe 3824 BraveUpdate.exe 5356 BraveUpdate.exe 668 BraveUpdate.exe 4028 BraveUpdate.exe 1228 BraveUpdate.exe 1104 BraveUpdate.exe 5524 brave_installer-x64.exe 4388 setup.exe 3648 setup.exe 5832 elevation_service.exe 4196 setup.exe 5384 setup.exe 1332 BraveUpdate.exe 4592 BraveUpdateOnDemand.exe 5152 BraveUpdate.exe 5864 brave.exe 412 brave.exe 1616 brave.exe 3988 brave.exe 4332 elevation_service.exe 4600 brave.exe 1924 brave.exe 1220 brave.exe 3240 brave.exe 4920 brave.exe 3340 brave.exe 4984 brave.exe 5828 brave.exe 4340 elevation_service.exe 5792 brave.exe 3500 brave.exe 3732 brave.exe 5140 brave.exe 2228 brave.exe 5516 brave.exe 5356 brave.exe 3812 brave.exe 4664 brave.exe 2996 brave.exe 2360 brave.exe 3560 brave.exe 2444 brave.exe 1016 brave.exe 4680 brave.exe 5372 brave.exe 740 brave.exe 5544 brave.exe 5332 brave.exe 1948 brave.exe 5684 brave.exe 6128 brave.exe 2228 brave.exe 4300 brave.exe 5720 brave.exe 1416 brave.exe 2848 TeamViewer_Setup_x64.exe 5164 TeamViewer_.exe 1284 TeamViewer_.exe - Loads dropped DLL 64 IoCs
pid Process 1832 BraveUpdate.exe 1236 BraveUpdate.exe 4676 BraveUpdate.exe 2336 BraveUpdateComRegisterShell64.exe 4676 BraveUpdate.exe 1412 BraveUpdateComRegisterShell64.exe 4676 BraveUpdate.exe 5204 BraveUpdateComRegisterShell64.exe 4676 BraveUpdate.exe 3824 BraveUpdate.exe 5356 BraveUpdate.exe 668 BraveUpdate.exe 4028 BraveUpdate.exe 1228 BraveUpdate.exe 1104 BraveUpdate.exe 1104 BraveUpdate.exe 1228 BraveUpdate.exe 1332 BraveUpdate.exe 5152 BraveUpdate.exe 5152 BraveUpdate.exe 5864 brave.exe 412 brave.exe 5864 brave.exe 1616 brave.exe 1616 brave.exe 3988 brave.exe 3988 brave.exe 1616 brave.exe 1616 brave.exe 1616 brave.exe 4600 brave.exe 4600 brave.exe 1924 brave.exe 1220 brave.exe 1924 brave.exe 1220 brave.exe 3240 brave.exe 4920 brave.exe 3240 brave.exe 3340 brave.exe 3340 brave.exe 4984 brave.exe 5828 brave.exe 4984 brave.exe 5828 brave.exe 4984 brave.exe 5792 brave.exe 3500 brave.exe 3500 brave.exe 5792 brave.exe 4984 brave.exe 4984 brave.exe 3732 brave.exe 3732 brave.exe 5140 brave.exe 5140 brave.exe 2228 brave.exe 2228 brave.exe 5516 brave.exe 5516 brave.exe 5356 brave.exe 3812 brave.exe 3812 brave.exe 5356 brave.exe - Checks whether UAC is enabled 1 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TeamViewer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tv_w32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveBrowserSetup-BRV010.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdateOnDemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3824 BraveUpdate.exe 1332 BraveUpdate.exe - System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2856 msedge.exe 3988 brave.exe 3340 brave.exe 5416 msedge.exe - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters mstsc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\TSRedirFlags mstsc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\TSRedirFlags mstsc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\Device Parameters mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\Device Parameters mstsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wbengine.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sdclt.exe - Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TeamViewer_Desktop.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TeamViewer_Desktop.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TeamViewer_Desktop.exe - Enumerates system info in registry 2 TTPs 14 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS brave.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust tv_x64.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs TeamViewer_Desktop.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tv_x64.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3AD2D487-D166-4160-8E36-1AE505233A55}\VersionIndependentProgID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\NumMethods\ = "4" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\NumMethods\ = "17" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{08F15E98-0442-45D3-82F1-F67495CC51EB}\LocalService = "brave" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\NumMethods\ = "4" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\ = "IGoogleUpdateCore" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\NumMethods\ = "8" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\NumMethods\ = "16" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ = "IJobObserver" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids\BraveHTML setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\NumMethods\ = "11" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods\ = "11" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA} BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\ = "IProcessLauncher" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F26E08F2-BA64-4BC1-8C0E-7D3390D7B27D}\InprocHandler32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods\ = "11" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B16F95-319A-4F01-AC81-CE69B8F4E387}\VersionIndependentProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ = "IPolicyStatus" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ = "ICoCreateAsyncStatus" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\NumMethods BraveUpdateComRegisterShell64.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\ProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassSvc.1.0" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\VersionIndependentProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassSvc" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\NumMethods\ = "10" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{28C83F57-E4C0-4B54-B187-585C51EE8F9C}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3FC92C1A-57C1-4A34-AB53-3C69366320E8}\InProcServer32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\TypeLib\Version = "1.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc\CurVer\ = "BraveSoftwareUpdate.PolicyStatusSvc.1.0" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\LocalService = "bravem" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\ProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C3BA8F3-1264-4BDB-BB2D-CA44734AD00D}\LocalServer32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C3BA8F3-1264-4BDB-BB2D-CA44734AD00D}\LocalServer32\ = "\"C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\BraveUpdateOnDemand.exe\"" BraveUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1920x1080x96(1).top = "209" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\ = "BraveUpdate Update3Web" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods\ = "6" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ProxyStubClsid32\ = "{3FC92C1A-57C1-4A34-AB53-3C69366320E8}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachine.1.0\ = "Google Update Broker Class Factory" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods BraveUpdateComRegisterShell64.exe - Modifies system certificate store 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e TeamViewer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e TeamViewer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e TeamViewer.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2264 explorer.exe 212 TeamViewer.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1228 BraveUpdate.exe 1228 BraveUpdate.exe 1332 BraveUpdate.exe 1332 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 1832 BraveUpdate.exe 5864 brave.exe 5864 brave.exe 3240 brave.exe 3240 brave.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 372 msedge.exe 372 msedge.exe 3356 BraveUpdate.exe 3356 BraveUpdate.exe 1748 BraveUpdate.exe 1748 BraveUpdate.exe 4212 BraveUpdate.exe 4212 BraveUpdate.exe 2264 explorer.exe 2264 explorer.exe 4396 msedgewebview2.exe 4396 msedgewebview2.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3784 sdclt.exe 1848 TeamViewer_Desktop.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
pid Process 4456 msedge.exe 5864 brave.exe 5864 brave.exe 3240 brave.exe 3240 brave.exe 3240 brave.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 160 msedge.exe 2288 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1832 BraveUpdate.exe Token: SeDebugPrivilege 1832 BraveUpdate.exe Token: SeDebugPrivilege 1832 BraveUpdate.exe Token: SeDebugPrivilege 1832 BraveUpdate.exe Token: 33 5524 brave_installer-x64.exe Token: SeIncBasePriorityPrivilege 5524 brave_installer-x64.exe Token: SeShutdownPrivilege 5756 control.exe Token: SeCreatePagefilePrivilege 5756 control.exe Token: SeShutdownPrivilege 2264 explorer.exe Token: SeCreatePagefilePrivilege 2264 explorer.exe Token: SeBackupPrivilege 3784 sdclt.exe Token: SeRestorePrivilege 3784 sdclt.exe Token: SeSecurityPrivilege 3784 sdclt.exe Token: SeTakeOwnershipPrivilege 3784 sdclt.exe Token: 35 3784 sdclt.exe Token: SeBackupPrivilege 3784 sdclt.exe Token: SeRestorePrivilege 3784 sdclt.exe Token: SeSecurityPrivilege 3784 sdclt.exe Token: SeTakeOwnershipPrivilege 3784 sdclt.exe Token: 35 3784 sdclt.exe Token: SeBackupPrivilege 4276 wbengine.exe Token: SeRestorePrivilege 4276 wbengine.exe Token: SeSecurityPrivilege 4276 wbengine.exe Token: SeBackupPrivilege 5712 vssvc.exe Token: SeRestorePrivilege 5712 vssvc.exe Token: SeAuditPrivilege 5712 vssvc.exe Token: SeDebugPrivilege 1228 BraveUpdate.exe Token: SeDebugPrivilege 1332 BraveUpdate.exe Token: SeDebugPrivilege 1832 BraveUpdate.exe Token: SeShutdownPrivilege 5864 brave.exe Token: SeCreatePagefilePrivilege 5864 brave.exe Token: SeBackupPrivilege 3784 sdclt.exe Token: SeRestorePrivilege 3784 sdclt.exe Token: SeShutdownPrivilege 5864 brave.exe Token: SeCreatePagefilePrivilege 5864 brave.exe Token: SeShutdownPrivilege 5864 brave.exe Token: SeCreatePagefilePrivilege 5864 brave.exe Token: SeShutdownPrivilege 5864 brave.exe Token: SeCreatePagefilePrivilege 5864 brave.exe Token: SeShutdownPrivilege 5864 brave.exe Token: SeCreatePagefilePrivilege 5864 brave.exe Token: SeBackupPrivilege 3784 sdclt.exe Token: SeRestorePrivilege 3784 sdclt.exe Token: SeSecurityPrivilege 3784 sdclt.exe Token: SeBackupPrivilege 3220 svchost.exe Token: SeRestorePrivilege 3220 svchost.exe Token: SeSecurityPrivilege 3220 svchost.exe Token: SeTakeOwnershipPrivilege 3220 svchost.exe Token: 35 3220 svchost.exe Token: SeShutdownPrivilege 5772 control.exe Token: SeCreatePagefilePrivilege 5772 control.exe Token: SeBackupPrivilege 3220 svchost.exe Token: SeRestorePrivilege 3220 svchost.exe Token: SeSecurityPrivilege 3220 svchost.exe Token: SeShutdownPrivilege 3080 control.exe Token: SeCreatePagefilePrivilege 3080 control.exe Token: SeBackupPrivilege 3220 svchost.exe Token: SeRestorePrivilege 3220 svchost.exe Token: SeSystemEnvironmentPrivilege 5712 vssvc.exe Token: SeBackupPrivilege 5712 vssvc.exe Token: SeRestorePrivilege 5712 vssvc.exe Token: SeRestorePrivilege 5712 vssvc.exe Token: SeBackupPrivilege 3220 svchost.exe Token: SeRestorePrivilege 3220 svchost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2264 explorer.exe 5864 brave.exe 5864 brave.exe 5864 brave.exe 5864 brave.exe 2264 explorer.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 2264 explorer.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 2264 explorer.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 2264 explorer.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 2264 explorer.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 2264 explorer.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe 5656 sdclt.exe - Suspicious use of SendNotifyMessage 21 IoCs
pid Process 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 212 TeamViewer.exe 212 TeamViewer.exe 1848 TeamViewer_Desktop.exe - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4932 helppane.exe 4932 helppane.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 6660 tv_w32.exe 2952 tv_x64.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 1848 TeamViewer_Desktop.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe 212 TeamViewer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1832 1660 BraveBrowserSetup-BRV010.exe 86 PID 1832 wrote to memory of 1236 1832 BraveUpdate.exe 87 PID 1832 wrote to memory of 4676 1832 BraveUpdate.exe 88 PID 4676 wrote to memory of 2336 4676 BraveUpdate.exe 89 PID 4676 wrote to memory of 1412 4676 BraveUpdate.exe 90 PID 4676 wrote to memory of 5204 4676 BraveUpdate.exe 94 PID 1832 wrote to memory of 3824 1832 BraveUpdate.exe 95 PID 1832 wrote to memory of 1228 1832 BraveUpdate.exe 99 PID 5780 wrote to memory of 4456 5780 msedge.exe 111 PID 4456 wrote to memory of 4696 4456 msedge.exe 112 PID 4456 wrote to memory of 2856 4456 msedge.exe 114 PID 4456 wrote to memory of 5248 4456 msedge.exe 115 PID 4456 wrote to memory of 2964 4456 msedge.exe 116 PID 4456 wrote to memory of 5248 4456 msedge.exe 115 PID 4456 wrote to memory of 3900 4456 msedge.exe 117 PID 4456 wrote to memory of 5248 4456 msedge.exe 115 PID 4456 wrote to memory of 2964 4456 msedge.exe 116 PID 4456 wrote to memory of 3900 4456 msedge.exe 117 PID 4456 wrote to memory of 3900 4456 msedge.exe 117 PID 1104 wrote to memory of 5524 1104 BraveUpdate.exe 121 PID 5524 wrote to memory of 4388 5524 brave_installer-x64.exe 122 PID 4388 wrote to memory of 3648 4388 setup.exe 123 PID 4388 wrote to memory of 4196 4388 setup.exe 129 PID 4196 wrote to memory of 5384 4196 setup.exe 130 PID 2264 wrote to memory of 3784 2264 explorer.exe 132 PID 1104 wrote to memory of 1332 1104 BraveUpdate.exe 147 PID 4592 wrote to memory of 5152 4592 BraveUpdateOnDemand.exe 149 PID 5152 wrote to memory of 5864 5152 BraveUpdate.exe 150 PID 5864 wrote to memory of 412 5864 brave.exe 151 PID 5864 wrote to memory of 1616 5864 brave.exe 152 PID 5864 wrote to memory of 3988 5864 brave.exe 153 PID 5864 wrote to memory of 4600 5864 brave.exe 155 PID 5864 wrote to memory of 1924 5864 brave.exe 157 PID 5864 wrote to memory of 1220 5864 brave.exe 158 PID 3784 wrote to memory of 5772 3784 sdclt.exe 161 PID 4168 wrote to memory of 3080 4168 sdclt.exe 167 PID 2264 wrote to memory of 5656 2264 explorer.exe 168 PID 3240 wrote to memory of 4920 3240 brave.exe 171 PID 3240 wrote to memory of 3340 3240 brave.exe 172 PID 3240 wrote to memory of 4984 3240 brave.exe 173 PID 3240 wrote to memory of 5828 3240 brave.exe 174 PID 3240 wrote to memory of 5792 3240 brave.exe 176 PID 3240 wrote to memory of 3500 3240 brave.exe 177 PID 3240 wrote to memory of 3732 3240 brave.exe 178 PID 3240 wrote to memory of 5140 3240 brave.exe 179 PID 3240 wrote to memory of 2228 3240 brave.exe 198 PID 3240 wrote to memory of 5516 3240 brave.exe 181 PID 3240 wrote to memory of 5356 3240 brave.exe 182 PID 3240 wrote to memory of 3812 3240 brave.exe 183 PID 3240 wrote to memory of 4664 3240 brave.exe 243 PID 3240 wrote to memory of 2996 3240 brave.exe 185 PID 3240 wrote to memory of 2360 3240 brave.exe 186 PID 3240 wrote to memory of 3560 3240 brave.exe 187 PID 3240 wrote to memory of 2444 3240 brave.exe 188 PID 3240 wrote to memory of 1016 3240 brave.exe 189 PID 3240 wrote to memory of 4680 3240 brave.exe 190 PID 3240 wrote to memory of 5372 3240 brave.exe 191 PID 3240 wrote to memory of 740 3240 brave.exe 192 PID 3240 wrote to memory of 5332 3240 brave.exe 193 PID 3240 wrote to memory of 5544 3240 brave.exe 194 PID 3240 wrote to memory of 1948 3240 brave.exe 195 PID 3240 wrote to memory of 5684 3240 brave.exe 196 PID 3240 wrote to memory of 6128 3240 brave.exe 197 PID 3240 wrote to memory of 2228 3240 brave.exe 198 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe"C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup-BRV010.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1236
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2336
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1412
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5204
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins3NzhGMjAxNy1GMEI3LTQxRDQtQkUyMy01OTVGRjVBODk3RUR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QzZFNEY4ODMtNkUzQy00QkRBLThFOEUtNTI5MTFGMzRBMDFEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QjEzMUM5MzUtOUJFNi00MURBLTk1OTktMUY3NzZCRUI4MDE5fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2MS4xNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3824
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{778F2017-F0B7-41D4-BE23-595FF5A897ED}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5356
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:668
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4028
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\gui3E59.tmp"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\gui3E59.tmp" --brave-referral-code="BRV010"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff716db3368,0x7ff716db3378,0x7ff716db33884⤵
- Executes dropped EXE
PID:3648
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\gui3E59.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{AD1CC01E-5E1C-4CF0-BB4D-E8653CAE7263}\CR_BA276.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff716db3368,0x7ff716db3378,0x7ff716db33885⤵
- Executes dropped EXE
PID:5384
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins3NzhGMjAxNy1GMEI3LTQxRDQtQkUyMy01OTVGRjVBODk3RUR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MEY5RDI4ODgtMjVEQy00MUFFLThEREMtNjY2REM5RTI1REFEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIxNiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7QUZFNkE0NjItQzU3NC00QjhBLUFGNDMtNENDNjBERjQ1NjNCfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjEuOTMuMTI5IiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vdXBkYXRlcy1jZG4uYnJhdmVzb2Z0d2FyZS5jb20vYnVpbGQvQnJhdmUtUmVsZWFzZS9yZWxlYXNlL3dpbi8xNTEuMS45My4xMjkveDY0L2JyYXZlX2luc3RhbGxlci14NjQuZXhlIiBkb3dubG9hZGVkPSIxNTYxMDYzMjAiIHRvdGFsPSIxNTYxMDYzMjAiIGRvd25sb2FkX3RpbWVfbXM9IjE4MTg1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzOTAiIGRvd25sb2FkX3RpbWVfbXM9IjIwNzcwIiBkb3dubG9hZGVkPSIxNTYxMDYzMjAiIHRvdGFsPSIxNTYxMDYzMjAiIGluc3RhbGxfdGltZV9tcz0iMzYyMTMiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault15c14260hecebh481ah89b7h1e381661afe01⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault15c14260hecebh481ah89b7h1e381661afe0 --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2f0,0x7ffbc469c188,0x7ffbc469c194,0x7ffbc469c1a03⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2640278501485233670,1015986057859383546,524288 --field-trial-handle=3180,i,401691514169819569,3466427966547029547,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:33⤵
- System Time Discovery
PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,7989724288344871524,6894566853948239579,262144 --field-trial-handle=3180,i,401691514169819569,3466427966547029547,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:23⤵PID:5248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,10167443379204256091,4329685883529522536,524288 --field-trial-handle=3180,i,401691514169819569,3466427966547029547,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:83⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2860,i,3320042288485905879,7091920769986497110,2097152 --field-trial-handle=3180,i,401691514169819569,3466427966547029547,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:23⤵PID:3900
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5352
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.BackupAndRestore1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5756
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:4016
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\sdclt.exe"C:\Windows\System32\sdclt.exe" /configure2⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5772
-
-
-
C:\Windows\System32\sdclt.exe"C:\Windows\System32\sdclt.exe" /UIMODE /SHOW2⤵
- Suspicious use of FindShellTrayWindow
PID:5656 -
C:\Windows\system32\sdclt.exe"C:\Windows\system32\sdclt.exe" /STOPBACKUP3⤵PID:2360
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5832
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:5596
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:892
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffbc2efda00,0x7ffbc2efda10,0x7ffbc2efda204⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1792,i,10782106246052695107,14134223015976094679,262144 --field-trial-handle=1916,i,11226882894046831979,8798961499549163176,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1920,i,18384244592241855277,4819933135337473277,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1912 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2164,i,17460623524646048931,14339283548593524862,524288 --field-trial-handle=1916,i,11226882894046831979,8798961499549163176,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1920,i,18384244592241855277,4819933135337473277,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1804 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
PID:3988
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2468,i,4462558967427728146,17440569727504912484,524288 --field-trial-handle=1916,i,11226882894046831979,8798961499549163176,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1920,i,18384244592241855277,4819933135337473277,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2480 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4600
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3384,i,3962383988463637178,14195205887488820480,2097152 --field-trial-handle=1916,i,11226882894046831979,8798961499549163176,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1920,i,18384244592241855277,4819933135337473277,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3388 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1924
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3520,i,5985710760860871411,6210051472180514188,2097152 --field-trial-handle=1916,i,11226882894046831979,8798961499549163176,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=1920,i,18384244592241855277,4819933135337473277,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3508 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1220
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4532
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup1⤵
- Drops file in Windows directory
PID:5532
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2460
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:4392
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=151.1.93.129 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbc2efda00,0x7ffbc2efda10,0x7ffbc2efda202⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4920
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1932,i,1615441182779439132,6891923444269351058,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2064 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
PID:3340
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1696,i,11051974286739896254,9926961691823475727,262144 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2040 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4984
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,14462272886856771266,18406649994907590724,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2788 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5828
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3768,i,7521425556325406640,6231656787153210845,2097152 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3776 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5792
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3804,i,12628256186137738551,13761735470174935469,2097152 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3812 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3500
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,8889563487612452660,6732263399447256000,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5224 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3732
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,3009422170073901618,5361826563328088161,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5140
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4380,i,11772505005683494540,12718638941101287385,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,4545238978843105931,16713799569300999649,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5576 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5516
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,17543433368605524314,4053092017273284343,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5356
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,16393019527764234663,6395804200037620380,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5648 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3812
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,3986049262099852973,12787876499037944262,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5780 /prefetch:82⤵
- Executes dropped EXE
PID:4664
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,7753492875344466294,15170927435526169411,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Executes dropped EXE
PID:2996
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,1076547936383736131,11432790840973207024,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5988 /prefetch:82⤵
- Executes dropped EXE
PID:2360
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4124,i,17683219747346581864,17847442086561398914,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5636 /prefetch:82⤵
- Executes dropped EXE
PID:3560
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,15781719833358106861,2130115305103951845,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6080 /prefetch:82⤵
- Executes dropped EXE
PID:2444
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,6686798297705826408,1476093240208722206,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5952 /prefetch:82⤵
- Executes dropped EXE
PID:1016
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,6393895368799496703,11178976603965793499,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6008 /prefetch:82⤵
- Executes dropped EXE
PID:4680
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,3107514464706728429,6500792056689593397,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5984 /prefetch:82⤵
- Executes dropped EXE
PID:5372
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,12849575576653039659,8105775582220157194,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5620 /prefetch:82⤵
- Executes dropped EXE
PID:740
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5924,i,11832385994669927903,8124754506311840559,2097152 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5532 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
PID:5332
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,2108281598840871411,5811303657899733042,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5900 /prefetch:82⤵
- Executes dropped EXE
PID:5544
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4180,i,15061231663626381712,2062229661099881475,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5448 /prefetch:82⤵
- Executes dropped EXE
PID:1948
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4020,i,9789004620010824549,8863365176941284525,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=4016 /prefetch:82⤵
- Executes dropped EXE
PID:5684
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,17682078165492546646,3746977011579643448,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=3840 /prefetch:82⤵
- Executes dropped EXE
PID:6128
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,2550546313338829522,4539086902198322493,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6096 /prefetch:82⤵
- Executes dropped EXE
PID:2228
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,5208346404583613915,18124144285994833571,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=5444 /prefetch:82⤵
- Executes dropped EXE
PID:4300
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,127393757543700788,12169812235233303655,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=4996 /prefetch:82⤵
- Executes dropped EXE
PID:5720
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,5659173528526590186,13333023863632232954,524288 --field-trial-handle=2044,i,17380631688709411577,8562760118219975899,262144 --variations-seed-version=main@3da77713ca0e1cefba28a0d4a34b5144325d2320 --pseudonymization-salt-handle=2008,i,1805154818590717247,11006875907401220687,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=5740 /prefetch:82⤵
- Executes dropped EXE
PID:1416
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4340
-
C:\Windows\system32\mstsc.exe"C:\Windows\system32\mstsc.exe"1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:4300
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4932 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=5288862⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ffbc469c188,0x7ffbc469c194,0x7ffbc469c1a03⤵PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,12151067548121125752,11123649031337253255,262144 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:23⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3985119466888320240,16336174445984366255,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
PID:5416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,3895308877315875788,9722854011573786036,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:83⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6246278658562264360,11025787976602085162,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,772007080842683029,17099970914407261082,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:13⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,16582359909154431628,9174771701109518143,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:83⤵PID:6268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,15239793883038450410,13829202783563064705,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:83⤵PID:6404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5180,i,14116714919437671187,9931537759630270465,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:13⤵PID:6488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,5739808374103793813,13474566038156334347,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:83⤵PID:6584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,14376955421777615551,16151604435109323557,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:83⤵PID:6692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1223402632014931094,16103201229059801465,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:83⤵PID:6828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1223402632014931094,16103201229059801465,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:83⤵PID:6844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5864,i,7153402860807485409,12595932516033274953,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:13⤵PID:6848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15979496284046722972,5279899853299997957,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:83⤵PID:6312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14630098686886591328,7716410299231308294,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:83⤵PID:5252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4579215672316094183,12616547012456440309,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:83⤵PID:6628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13450108405340244407,1310305086828921568,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:83⤵PID:6332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,228090011755503608,11466840983001466865,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:83⤵PID:6296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,554535095877799345,12394617815123517197,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:83⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,3128804081786956854,11899434371812207144,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:83⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14088390701926645592,15186467518452454609,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:83⤵PID:5520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5920,i,1586255980074192607,6711544432045460205,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:13⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6672,i,16474104251008073393,16385526987468521276,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:13⤵PID:7096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5952,i,10248697326311097246,15491761449321794630,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:13⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5248,i,18334886141899477600,14739773667631726277,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:13⤵PID:5976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6940,i,12814660219350989704,11477726540631124796,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:13⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5940,i,3277665873467726320,6860508802867524338,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:13⤵PID:6324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6380,i,15844302222141485886,9860164474003747117,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:13⤵PID:6444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6492,i,8647343850948534151,10082192946743302897,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:13⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3600,i,15738509813194063396,3101408696215297610,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:13⤵PID:5728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6456,i,996558593187776767,1357929978521117600,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:13⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3668,i,12034903131914468456,16354610214606376370,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:13⤵PID:6300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7236,i,4809808977592584467,18411210279298189919,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:13⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7484,i,11401459632398250855,16190280694366531525,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:13⤵PID:5520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,4300594028264258381,4787304877824451443,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:83⤵PID:6860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,6979861150823640395,6868273214098217612,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:83⤵PID:6972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5932,i,14585618338973205375,6190789702277708690,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:13⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7228,i,10601296942253741472,5081831407058772881,2097152 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:13⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5807409520953836306,17296825934077024955,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:83⤵PID:4360
-
-
C:\Users\Admin\Downloads\TeamViewer_Setup_x64.exe"C:\Users\Admin\Downloads\TeamViewer_Setup_x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\nsa8863.tmp\nsu8892\TeamViewer_.exe"C:\Users\Admin\AppData\Local\Temp\nsa8863.tmp\nsu8892\TeamViewer_.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\nsa8863.tmp\nsu8892\TeamViewer_.exe"C:\Users\Admin\AppData\Local\Temp\nsa8863.tmp\nsu8892\TeamViewer_.exe" /RUN5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe" --noInstallation6⤵
- Checks computer location settings
- Drops file in Windows directory
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:212 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --log --action hooks7⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6660
-
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe" --log --action hooks7⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection,msWebOOUI,msPdfOOUI,ElasticOverscroll --lang=fr --mojo-named-platform-channel-pipe=212.3616.54940923175986753357⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2288 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffbbb84b078,0x7ffbbb84b084,0x7ffbbb84b0908⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1808,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:28⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:38⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:88⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --always-read-main-dll --field-trial-handle=3548,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:18⤵PID:6096
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4488,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:88⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:88⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4472,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:88⤵PID:7060
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4440,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:88⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2188,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1176 /prefetch:88⤵
- Suspicious behavior: EnumeratesProcesses
PID:4396
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4576,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:88⤵PID:6888
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4084,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:88⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4404,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:88⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3844,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:88⤵PID:6312
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=944,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:88⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4032,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:88⤵PID:5456
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="\\?\C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView" --webview-exe-name=TeamViewer.exe --webview-exe-version=15.80.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4408,i,2034888156179275957,4823309557303638938,262144 --disable-features=ElasticOverscroll,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:88⤵PID:1584
-
-
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\TeamViewer\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\GUI --metrics-dir=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\GUI --url=https://errorreporting.teamviewer.com:443/api/2/minidump/?sentry_client=sentry.native/0.9.1&sentry_key=a22ee30ee0e542f6c295fa4f7c615660 --attachment=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\GUI\0dd7a680-5dcb-4c90-37b8-3ccf42a820ca.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\GUI\0dd7a680-5dcb-4c90-37b8-3ccf42a820ca.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\GUI\0dd7a680-5dcb-4c90-37b8-3ccf42a820ca.run\__sentry-breadcrumb2 --initial-client-data=0xd18,0xd1c,0xd20,0xd14,0xd24,0x7ff73c0912f0,0x7ff73c091310,0x7ff73c0913287⤵PID:6532
-
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Desktop.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Desktop.exe" --IPCport 6039 --Module 6 --ServerEnvironment global7⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\TeamViewer\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\TeamViewer\ErrorReports\Desktop --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TeamViewer\ErrorReports\Desktop --url=https://errorreporting.teamviewer.com:443/api/3/minidump/?sentry_client=sentry.native/0.9.1&sentry_key=954415e6171778f6d31e0ce31fa2a3d1 --attachment=C:\Users\Admin\AppData\Local\Temp\TeamViewer\ErrorReports\Desktop\0c17c09f-c829-4bde-ee16-a60feaf42613.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Temp\TeamViewer\ErrorReports\Desktop\0c17c09f-c829-4bde-ee16-a60feaf42613.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Temp\TeamViewer\ErrorReports\Desktop\0c17c09f-c829-4bde-ee16-a60feaf42613.run\__sentry-breadcrumb2 --initial-client-data=0x3b4,0x3b8,0x3bc,0x390,0x3c0,0x7ff68b3e3aa8,0x7ff68b3e3ac8,0x7ff68b3e3ae08⤵PID:7068
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,13975350767149677843,12251246077253715923,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:83⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7868,i,14876085248917408260,9845687030761811142,262144 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,1401194501362606576,2156436268755578317,524288 --field-trial-handle=2444,i,12180235907245885431,8069732024549613633,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:83⤵PID:3520
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4988
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
PID:4020 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3356
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4380
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵PID:3024
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- System Location Discovery: System Language Discovery
PID:6796
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4212
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6988
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveCrashHandler.exe
- Size 270KB
- SHA256 ea698af883bd96f1e4fb29b85785997420def8ec42e7f91fbbaf43f3db493582
- MD5 3c38616a3bfbd7dd5807c8a7b4a928b6
- SHA1 37dfb50afa5f34666436d6960fff1dc08f20d52c
- SHA512 89b9aa8a261849b7a2adb15c396b9ce3c12a67e82f6144bf387974f5b6983979d89a94097b10d27a6ba0bd1b16ac446737b189d4823c81c246b1da7f0e8d1804
- SSDEEP 6144:Udd4maD39rUMyjJr+64hQqNSEzVcdfYiGdEksDxYYYYYOYBI07YYlYYYZbw9Itwa:S4l9rNyjbxqNSEzOaEksDxYYYYYOYBIj
- TLSH T1C944AE02B5D18432E9B315365EB89B316EBEB8304962DE9F23D44D1EEF316C0D625763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveCrashHandler64.exe
- Size 355KB
- SHA256 681d60a96bfb704c5a0d905c26f364f4869326c040319d3e9c706f3801e58963
- MD5 0bf24d2a68b08e673127a53f190ea0f3
- SHA1 ae6ca2e74f1384423c08e61de450c9cab20ae08c
- SHA512 34d03a769b702ae3e91e5757cf0fbef720280ba024dfd57149f13ba6b1c88574c5d3668b389bb2a8413d5943a663057bbe8ce62c658ce8760ca465393216c6fb
- SSDEEP 6144:EHlSHLFsLeljMiBwkyPnYeP1jJLSGtouZFvS+aItjQauHzx+m:EFZY5ryfPP1jx5FFvS+aI5JuTx+m
- TLSH T1F8746C15F3E404F8F5A78174C992CA1AE7B27C5607B0D78F23A4869A3F336619D2DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveCrashHandlerArm64.exe
- Size 353KB
- SHA256 04d32a0f30fd2e685289814c709c15ba03096175f4638d1a4a3c49cb57748b1e
- MD5 dd6131f4caf4047727d4370e51ab4985
- SHA1 867be41250de245590fb57f5a62f7f21d3631c4e
- SHA512 29b3da8d30ea1e2d9715812b31af216a795853053651597e92c0b4ae69d9d8d66dffaef0d603d6abd1e79cd079f4641b8684f2633452d5ff8b86c57e5c874758
- SSDEEP 6144:3uqb6JOtxnqOtBIjEYIkEBPZkwca2zJ/LmwpNtkOKRC93It1nvx+o:pVscDpihz4JC1IDvx+o
- TLSH T1D2743A51DA8C68D4E1D2867CDBB94B50312FBE788474C5CE3157020CEEAEAC5CEB56E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveUpdate.exe
- Size 163KB
- SHA256 cef8c0af5f698a7665631844af423c8a09f63310520a4d3bebed4e4341fe1b6d
- MD5 fa1e04da3cd2a5d893e78ac753db2036
- SHA1 1b3dca57c11b4ec37393f8887ef8f28b9afc6124
- SHA512 71b44f5dd1ec95292c8dcc6efbeb33333e53d9f4a728cbaae40291d417d6e8ca51f541d299bdc3ae1d01030e358a1be87d205cbbbfacb0de400aebdab7fa91a6
- SSDEEP 3072:FNDG1ap4GHOaGCbtrrE0Za9/U7hxTKbfXkdu13jB+MC2R8Fl2Z/GU7ysb5vvIfF0:2haGGhZa9YTcqwB+3pg
- TLSH T1CAF3E60373F4006CF8F36A3169B56725A93EBCB2D962CABE1780059D2F316918D51B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveUpdateComRegisterShellArm64.exe
- Size 154KB
- SHA256 14e5f7d08369626c62a37f2d9920a9057653a007bf24d642d8c4c77cc4b1b00a
- MD5 8995549fb81f114c5d93d74015f3ae2b
- SHA1 488c37cd3d5879fd32a808a91402efb205c18ba0
- SHA512 173951f1e1077d2609a2a44d0088b3edb1d1de65fa0973d2e3b60266403485eccfdf437f98118331d2cb4611257f642288102b17cfa05694660a74015e9a8b36
- SSDEEP 3072:foGPa6NpZk+tkJCbjOAY8nMl/Eed9G0rIQUpojb90CB+cIUR:fpPlpZk+yKyVFEQIolHB+o
- TLSH T1ACF3199376CD38C5E2C3DB38DD564950272BFA788430CB8A3296020EEF6E6C5DEB5552
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\BraveUpdateCore.exe
- Size 195KB
- SHA256 d9ad02b89918d77763f133417f56b02349ee0b0f0f7d4f6e2409fbfaaefb167b
- MD5 ea185f5a5a426ed338c5e78ac7004648
- SHA1 d2c75c1b2f96f6244eb3997eb98e447f9223ffd6
- SHA512 4b9449b375996a6870cbe3b99c91bfdcda60b9c28b974e001edcf9c0e46929b95b92dbba1e16d8b44d0fdc5dbad3a1e4e4783932817fdff3b2f6329f156c66fa
- SSDEEP 6144:8/Xt4nqREgRKE2kKh+0nc0y3xzweIITx+1y:2Xt4nqREgRKE2kKhj8xzhImx+1y
- TLSH T111148D12B1E08072E97315321AF0AA705EBDFD704E62DA9F27940F6E5F716C0D626B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdate.dll
- Size 1.0MB
- SHA256 775f7d667acc1b117474d6dacce7ed83aa49ae2f7a92c5e50c11583cb88c2ac3
- MD5 b8e16e8da5aeb4b02358ef4e0f2b4200
- SHA1 6d8155f5282768d48f5f55c517181f3e83903e1c
- SHA512 b04b4e31c661f72d872ce8502c4fbdb1003ece8bcd12fbd67805711fa2c644d907bfb7fe8aa8ba54f9b4255f7b0331368018e4d8438a28ebde6ebaafc6e45818
- SSDEEP 24576:P+uMkbgbE0YgJePXUHOb7DDtjViLXq3sXx6/LjhWuf53canTLiNNtWGN3:7rgbz1ePkHOb/DtjV8X0lLjhWufxcang
- TLSH T1B2359E1375D18035E5B3063099BDBB25AEFDBA310A32D64E13D82A5E6F72980D73A353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_am.dll
- Size 42KB
- SHA256 e785d7058810a73e484ad0f7d5fcf55162d35180b79d8f3c06aadb75d80d56ea
- MD5 75d5e8ed40c0f1b3d914cd24090cb20b
- SHA1 810ab225361a1e7332d21e956a41af3fe79b6034
- SHA512 cc4f399d688c6dcff1f8157dc5d88f1aab61975fabbcfe91c252972a775dd5bddf5771a828e6fa5d136747a0bd3b7cd1ce22d9b1082a9e5e40c13a3ed81d7d8b
- SSDEEP 192:rxxsk4lK4dAFlDmdYR7A6eHu25NyEIYiYF80dmL4pUQaULc8pq8RuIQCFVHh91fY:1ek4k4+J25NyEIYi2mL4/y8RLVHh9V8
- TLSH T10513423946085C0EE727FA3179941A3E45276DCC6BE0F3861184653C9D707236BAEFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ar.dll
- Size 41KB
- SHA256 fe55a1546621d7f9405b0e4a29dbe7261599e6f94cd57fc310037fc43087e9b4
- MD5 75d680006abcf1aabbbe8b1c91135b5a
- SHA1 9e1c3115ea21b2513d41eb6aa66a4891c4156722
- SHA512 f5470875b0423c267fd00ca20b197b6607375094a596b70c03d46670df78e0455357f8f378a5c0265e738911b5d6374ef872135676df23564ff68f75462206f8
- SSDEEP 384:qkOtkCLu+JGnNyEIYi2mL4/y8RLVHT7S7V:POtkCLdVYiDLk5/Ha
- TLSH T174132F720948DD3CE7237A30D196CE3F916711D29CC4736A21A4A93186B07226B5FEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_bg.dll
- Size 44KB
- SHA256 46696c9da4526e22838e049d2e445f4ef47e5e755207c1113a595db28d1bb60e
- MD5 b0f9a1091ba4b5472115d4d19f2ee2f0
- SHA1 9813dfd1c7fa03b6a5768d2d2f57f98a043fcbad
- SHA512 c305d8f20d4fb1de6bbc2e8ec259d1d1d1d4392892f4c380fe67e6381cdcdea33055f4617cec5967aaf52984d71d565e0cfe2ee870a61200bd58bf4471b27215
- SSDEEP 384:IrndckbeGZBOcKNyEIYi2mL4/y8RLVHMlY6:CnV7D3YiDLk5/Y
- TLSH T14D13BD7BA5788908F755B2301A9549FE2177779063E4B7C1528F7874A038332672EE8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_bn.dll
- Size 44KB
- SHA256 224ab75018f1a3744ca3b64e9ac031c8b628afbc5b767c94a8a7efbd2b8857f0
- MD5 a40365f252fd90a687682c8197e9fae3
- SHA1 baec1cb9a43637a299a30243fb9727c4ec997632
- SHA512 49d0fb0d5604e1d7bdf9b061811fa31c241b55c7829a9341c2cd854f959de9f465265202459c3d99bf843e713015d84a00fd47694b29c9576f89da89e63c82c4
- SSDEEP 384:R6IvUx7tYF7qKF0FrHF6zjbmBwONyEIYi2mL4/y8RLVHGjlU9HC:oIrlF0FrF3BwDYiDLk5/p0
- TLSH T16413EA3996087C1AE7ADB53076C55D3F09E7388017E8F39420D8A53889B03B75E5EE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ca.dll
- Size 44KB
- SHA256 e32bcf68448a40489f035c2dbdc5dd817554143e5900795e42dee85fb86287fb
- MD5 5a743ca6c6f4cf8425cf534051eb72e5
- SHA1 977d00d8bb0eb747bf73debccdffb994cfe0dfb9
- SHA512 5f66b4a6b5756d9a4312fc6a3bb1f400ec4c54b86604635bb6e94c55427521b2d045886aba85d8a6ea1fae10ae77b6e13d296162ca969849085d5726072b2127
- SSDEEP 384:CUs2ArzVuRm4bPdSNyEIYi2mL4/y8RLVHQlHd7so:ns2ArBupdPYiDLk5/uuo
- TLSH T19613BA718BE85A48F7B33F703874192D4A6B7995A8F4F34D1240A5398970B01DEADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_cs.dll
- Size 43KB
- SHA256 7562edd2b97b8033eb89c14020d479d7ab092d3c487fcbab9b4b58663024d36d
- MD5 5a64a7c01bbaf29fc9dc991a156aa3f1
- SHA1 c7c456168bf96b4db1d204d99d1d6c6c8f3a2a3c
- SHA512 807073bda7b646ad40b6f18796fc9f1b5b42744794cc78d18633fe785040115b1ca076c70758873eb33ad088e9c7c3fdb9aa73df426650b8a22a0a9f903d8eaa
- SSDEEP 384:4d0BWpaJkhYwA+fLNyEIYi2mL4/y8RLVHZwN4c:I/YYiDLk5/2ic
- TLSH T18913ED7155E40948F7B77F3028B00A7E197B78D1A9F0F34E528061798970781EAAEF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_da.dll
- Size 43KB
- SHA256 b8426493d7aed6d308f4ae5b93c0991784ee0a299cfd93d928bc8a96c2da3490
- MD5 847b10107e65d4a0fc42eab112794c38
- SHA1 c8f72cc26d8e5cb262cb77bfaae4eb866b82a56e
- SHA512 1ca59273eb69d224135943c855daaddb5305dc1814b8cb8046f3bbf5f51203240f5a69d5e8d020088601d2b26b276ef7f3cc9e130d8e1b9b8bcda3912f429da7
- SSDEEP 384:3KZfNnwtpTqPUNyEIYi2mL4/y8RLVHq315Hh:6Lnw/+RYiDLk5/Wj
- TLSH T19D13637153E88A1CF7B23B3068B4492D4967BCD199F4F35D2284607C8971385A6BEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_de.dll
- Size 45KB
- SHA256 9765c1efac552441deaf5bb6fef329e9e67ed65f540bb17cb1767718bd0c2349
- MD5 3f0656c4aba1748030fdbb92880fcfb2
- SHA1 b20a852903725c25369082e5832b10b1ba4c44ef
- SHA512 c214e2385752ecb6ba614058722d29661e01c43b5db122f54d0c78c12c70c83c4a927e89cfb45ebf4e61d0d2647d901cf728bdd9d28d94c6355557027819cc03
- SSDEEP 384:FarQUM8QtPM0Me6INK/AiNyEIYi2mL4/y8RLVHLpNKB8:UrgjMePsAfYiDLk5/t
- TLSH T1A023307147E4890CF7B23B306DB45A695A63BCD5A9F0F74D2280607C8971701AAADF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_el.dll
- Size 44KB
- SHA256 e752f141dc7051b7d732c341d4879977a8be2c7e028fc8d745fa54cb7de5e61d
- MD5 34b9c65e3673dee2d4b61c2d41b1068c
- SHA1 dfe1c1ac7ec982ec369e07aaafc9d47ed56f853b
- SHA512 f4b9ab5e59d99fafbc09880ec8b0ada8c8675f935c06edc6b6bbbce908240a09794e46278ad639eedc18788d7a9f347ca810dd48d4ab7d96b7ac6abc45e3363a
- SSDEEP 384:7LNE5eILkSIrGCSqlIxRFiAhAc8zBtfsBsTbJNyEIYi2mL4/y8RLVHSpjulNo+:Pm5lLO+R52/+YiDLk5/ajus+
- TLSH T17F23CB7E09AB5A18DB66B8F11462892E466BF0C108D0FB6631F07074DA7C7029ECFD1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_en-GB.dll
- Size 42KB
- SHA256 f044b3a896cd6b97093c50608f52cd9d15a23038b1c878bc64a85a83c41dd635
- MD5 686dcc95b84d6831d679b12eaf5d9752
- SHA1 a2b0cde88f66f0bb1f5bcdc846b53a4cac9500e7
- SHA512 170cfae76b2ce6c88e3d59f3a0876753807a94360ccd580b49e1216ad01bad58f8bcd49f1e72ac7395c263ea48d0985e52056f244223abfe23af1a21d603006b
- SSDEEP 384:ZXQ8Uagyh6QukNyEIYi2mL4/y8RLVH0WoKg:bUagyhihYiDLk5/6
- TLSH T1C61395B157E44918F7B73B3069B4593E49377C91A9F0F39D228060399970701AABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_en.dll
- Size 42KB
- SHA256 43c7383c2b5463bb5e343268639aff19e676cf492e17ffc7633600a7de0ffb65
- MD5 bd7147b4f16432f3dfc5ef62fd5773f7
- SHA1 61eb2b4f9618f53252d57f5687514aca0318e3ac
- SHA512 ebf262506b7c30071e195a2fa4304bb0939ab7306764f098720a85ac4baddd7e1650b19a01da60e29a7bc4b1144c5f4b1295e66009cd00d5cf083fab332ba7c1
- SSDEEP 384:MciagyMk9RiSNyEIYi2mL4/y8RLVH9Wo2qV:tiagyM4+YiDLk5/+qV
- TLSH T1B81385B257E44918F7B73B3069B4593E0A777C91A9F0F35D228060399970701AABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_es-419.dll
- Size 43KB
- SHA256 43360612616b2cc9690447812d6b9d024a9231c4723e7042711e544aa951e1a2
- MD5 4594207d1d713a510b3c77d833d32664
- SHA1 73555a9a8bf8ad42b64ccd448492e1e64c6856b5
- SHA512 ffe65100786cd33e4c9251665e6506ddc4b875426f9315ca051f09b03d645706a47af0e3db0fc3e069d7964226f5ad5e145aa22dd9d905dc51767c48905c3709
- SSDEEP 192:3UWVrWff5pA7FGQNyEIYiYF80dmL4pUQaULc8pq8RuIQCFVHQrq6hrFr:3d5Wffs4QNyEIYi2mL4/y8RLVHQrRht
- TLSH T18513857046E85A49F7B33B34A8B41A3D4D7BBC9198F4B34D125061398970B41DABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_es.dll
- Size 45KB
- SHA256 766c440504bd67564c1fe2acab7407393e5825af868590fe46280a5d35b7d520
- MD5 0fcabd8cde45989b3f02caeff6dcfc3a
- SHA1 0903111934df74226631933c8417f88def616187
- SHA512 c36f66479a1d88fd8979f25b901a3cf8321423057689cdf6697937e711426e5845669ae048bd45f23349afab805b16c99dbeb40a87cc5d01a179fe5d47b4c2ac
- SSDEEP 384:XpadNzf1HNyEIYi2mL4/y8RLVH6kZeRDx:ZadNj1sYiDLk5/nZOx
- TLSH T17F23957156E85A4AF7B33B30A8B4193D4D3B7CD198B8B34D128061798970B41AE6DF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_et.dll
- Size 42KB
- SHA256 0422309e1e82005b5ba9788caf01595f575f712c774a76654fc2437ce63d282c
- MD5 5798bdd1fd575a92d72fc6b6efa1ca5c
- SHA1 e60a47c0cdc752e31984ebba9ceb8b79a4ed5665
- SHA512 83ec60b087ff4daa39bea2c83515828f017a844739b8c49ae1a106d16b5bba6994cfcfe4431d2774487a1e8e3eeb0bd6b5451f9077aa79cad84391bd042753f7
- SSDEEP 384:bpT7bDFbDZETJ9TSQANyEIYi2mL4/y8RLVHixExC:d396nH1YiDLk5/bQ
- TLSH T14D1397B256E49918E7F37E3068B45A2D59637DD2ADF0F34D224060389970341EABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_fa.dll
- Size 42KB
- SHA256 edd8c539f7ae7dce62f812f6f702929f07675eb5dfb06c0b932dedcba7bad212
- MD5 ed44faa88c683e4a4aed48054a1072ae
- SHA1 c255baf4707953d6d0bf087df50911ff82855da8
- SHA512 4c8fa6b3de7846e3cca7d54cab7c4bfc14a484c0988acf46d72ffe34f6f946c76b8e313bd3be8552a31ccec1cebe8836e452a4661f9994668ab6a9a8dfbad8ce
- SSDEEP 384:HMJZMK9Y5PNyEIYi2mL4/y8RLVH+bdZqpJat:sABEYiDLk5/0dEet
- TLSH T143131E368996CC38E7233A30D54BDC3F215361D868C1B77216D8643DDAB0369AA5FD2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_fi.dll
- Size 43KB
- SHA256 32a2b19eb8b2d64b379a412021cd387940be07db4ad449d9ef4d92208c6bd8b7
- MD5 c7c88e48c3a23787f6071ff091efc7c6
- SHA1 76111e21a650faf38608897ac5aa47f2d23bf20c
- SHA512 654a057b0dba73105c16023bc32c14eced8373df6bf7fcb1bd3d352d3c436170c2b6d5d469ae82395d33db25d307b9c0421bec28852ca3618ed947a37df0ff76
- SSDEEP 384:SE7ePEzPhXY7RzYd99hKh1GApNyEIYi2mL4/y8RLVHf/DK:SGePEVmKgWYiDLk5/G
- TLSH T15013867146E88928E7B77F3029B44A2D46237DD269F0F35E1A80603C9971341AA7DF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_fil.dll
- Size 44KB
- SHA256 4ffdb92e9a53207df3dd8c4a2c335e80d676a8969e6851d5708c912577a801e6
- MD5 9bc96932a29ff5295d02a513ea8f75fc
- SHA1 6f412a170075696335004112abdb14661d129811
- SHA512 916cb42b7404bb4255e879d39c2eeaac1667d1b3d06cdd831faf166b90ffc18e66bcfc4130c6318175fbcf857344122861f689c7b9c0085b1234d8b43258eae4
- SSDEEP 384:YthjdaUNPw+B3RVaw7y0NyEIYi2mL4/y8RLVHNGrjxqwAF:uaU9w+B3RVawWxYiDLk5/8j2F
- TLSH T12B13B97156A8491CFBF73B3069A41A6D0677FC82A9F4F7452280613998313819FADF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_fr.dll
- Size 44KB
- SHA256 8466d6fb5c8c40dfe9bf1c042b66b86e0bc0ab6f713d7a22a43db18707d2ac46
- MD5 d68aa8c51a77cba6be833cce046d1cb7
- SHA1 ebbb6c1d2844c2fb7f673e42b5a246f677b522cb
- SHA512 bb343b77100be38aad0fd91f519b210392fda601e379c26462c150007bfaccd1051c71e261966f9efdaa447a83ea7af65ad30975f396bd790b3b1366e9897a04
- SSDEEP 384:JgK98EoycpW4xHNyEIYi2mL4/y8RLVHtJDFZ1T:iKaycNsYiDLk5/XRH
- TLSH T14823877157E44A08F7B73B30A8B8592D0E277CDA99B0F35D1240A07D9930B419AADF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_gu.dll
- Size 44KB
- SHA256 398b7f7bebd8aa48f6fe3a6754a2dc4f08c4bc46d12fbab2ec9e41c6ecc66cd7
- MD5 48f6893231ced4d7e5423fb9e082a79b
- SHA1 9b60b9b2fe172de6c32059d3941a695bbdf2422a
- SHA512 760936c740eadd690dea128ab36609164883ab15832ced45e69c32e67d15904db705c82eb6ac00ece55ad29b42fd82df6ae2e419aa8c3ea40d34304a3b2b436c
- SSDEEP 384:HS53UbeAV4DnYCRfwmkI2NyEIYi2mL4/y8RLVH9Rx9DTex:yJUbe7hb7YiDLk5/TO
- TLSH T1C723FD391A4B5C8FE32AB930A5A4593E532718C0D7E0F343119862799EF1313766EFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_hi.dll
- Size 43KB
- SHA256 9826dcfcbfbaf6af4d05aa1080bef8b7107d2c694d26a1ea49367155936f5e12
- MD5 4395f07b4f88e11d75980b809c65f476
- SHA1 06c0bb2c0e8de3a4ca08aa1cc247916dea1756d0
- SHA512 f5c9bccfa3372e32b6f83bd322e2ae262eb52b2ea5cebc6ebb44bb6a3044b18ec01dafea8bfca33923d4e86b4d42c2b2acb6b7aabd722491a3107b1682fef155
- SSDEEP 384:2lRxx6AN6AQqjexbyqKXhHqCEGNyEIYi2mL4/y8RLVHQm8ra:Wxx6AN6AQqjexbyqKXhHqC+YiDLk5/qa
- TLSH T112135E3204804E2CE35D7E34F4640ABF5CEB6491A9CD338166C471B9D9F533A668EE9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_hr.dll
- Size 43KB
- SHA256 59495d4298b764115706f4521f150e77fe0fe9e3faddaa4506e171c360337d7c
- MD5 dec783deedec97678bae02106dc8b880
- SHA1 a5021dd10f9e04f7ee0d7379a4510749a07bb386
- SHA512 8021676fa584f836858c990e678dd3c1927e4e70ebee822e0706cc87fd77e676ad92abee9df6cf2d560150618a47f405b3e1fe49a23cac0fb1a686e017a673d1
- SSDEEP 384:dsaqdOXz19szMH5KBL/xNyEIYi2mL4/y8RLVH7cvX9JEC7:yaZ5oL/uYiDLk5/m7
- TLSH T1DB13EF7196E41919F7F73F3064B41B3E097B78E1A9F0B34E118061788A70741AAADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_hu.dll
- Size 43KB
- SHA256 9d8bb1be91832138417138e003e56ac61f3e0a1be6993753085335d5b6e1f97d
- MD5 64dc0ab9aa88218db419681bfe0bbfa5
- SHA1 f00d61e7a7128685ffc26f259bb439ad2be6315c
- SHA512 729359adf8e5c73a86ba4528f80b27abe3c71f6e62f3d430921a7ebcf40a5d047a1c9ef0c0568ca1783fc83edc797d019cb61b3cb28b3ab4e2488a8a7f1f3aff
- SSDEEP 768:Qy7U7RPX1C2TycfBwGFTbeSDY6931lBVZpjqAy3FGVswYiDLk5/W/9:Qy7U791C2TzpwGFTbZY6d1lBVZ5qAy3+
- TLSH T19113CB3152D84909F7B77F313DB04A6E0927B8A069F8F34E6180A1BC9931741EA6DF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_id.dll
- Size 42KB
- SHA256 1effc734b01c7180ed875a62ba258acd338f5c613123a1050ef0796224a5be84
- MD5 8815e30e3ef7af69a5658fd08033dbdc
- SHA1 528c2f60434460ba4a07dc9df4bf0edeb96ee216
- SHA512 c9afdefd720ff9730ae6d195384f25c06d27f15d32975fc9913c63ce1be804deea714a79c7d2564037d9cb8734a5b47ca02edf42c7c2e4a82db767b48003350d
- SSDEEP 384:H4DaL3THRNkAHqQ3lFRf2I9ByrUaNyEIYi2mL4/y8RLVHqPDDOd:kihR5HYiDLk5/sng
- TLSH T11713CAB142D8594CFBB73B3069B41A6D0A67BC92ADF0B34D224065389D707819E6EF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_is.dll
- Size 42KB
- SHA256 c451d333bae1a3c1d2447894f8e3a3bf6b4ceed57b51a934e8462b00e793f7e5
- MD5 43d88dea4773c34030c448055e30a59d
- SHA1 728ca65316f587430749878b104f10eadfc2c081
- SHA512 ef417f2d4be76430306b341586424cc54311ce9c63849161dc6d0db444c1043f5b27b81cba4fe958e88216bfd479515cacc77ba934f2b9d3035f1a476aa0e303
- SSDEEP 384:1aciZsioif2lIBuAjYkUVQFoMUefV3WNyEIYi2mL4/y8RLVH6oa:TiqibAIErkUVQF5UefV3bYiDLk5/8
- TLSH T15F13EB709398590CFBB77B3024E45A2E0A2BBDD29CF4F74D118465388931382AA6DF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_it.dll
- Size 44KB
- SHA256 fb92a3d4bf1fa5cda03447b3583e8770a0a8c47099b3eac7af595776404926e0
- MD5 bb3d999a8966586a97fc1c0567306073
- SHA1 5373106fa6937b63f6afc9a4a43ac09a5a047b6f
- SHA512 1fcc1720df865f696ed765184204592d37d76fe2cd08c0bbe9500f4899877936b63557656d8a9dfad8d1e0c2eeac017411b24a0da818f1122fc50d695e9a0996
- SSDEEP 384:x8+DIN+shh3HNyEIYi2mL4/y8RLVHoI33yc:OKIN+q3sYiDLk5/tb
- TLSH T1A623527156E85A18F7F33B30A8785A6D093B7D81A8B4F35D1281607C8970B119AADF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_iw.dll
- Size 40KB
- SHA256 284d5960d302d20a8e7037d44bbf260d911ecba73919126aa50b6a3ad1765087
- MD5 f94b3d39be9d1db1f730efeb2450b03a
- SHA1 2090b7bea39067b30a96d7f3a08baa3b4a71fc42
- SHA512 5bc7db8f0a53e78a7cbc910951151e92d09cb4feac1e33dbaff27ab0d0c99dc87537492eb479c1914bad03daf61a8ef228b591a18295594e4ea2d082a94f13b9
- SSDEEP 384:nixv7hdVexaDywGfJssaNyEIYi2mL4/y8RLVHrxOSc9:i9NM1HYiDLk5/t8
- TLSH T18A1352710A50CDDCEB26FE32A24E4D3E5663E6C055E4735320886470AAB9352DB9EF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ja.dll
- Size 39KB
- SHA256 f0451c7486530b549fe3fe5de9c74372511021c82e0a6216bcdce96382ca3d27
- MD5 f6dd3aefea36926fca66e150109af575
- SHA1 aafd1f8d6c92bf2a562d5943d9486ba164306ca2
- SHA512 1677d9abedd8eaf0b71e7d9b059adf7325e4fa216d7c1a83d3cc2530798bd12d069abfef28ae42922383e0cf780521643a58347653c950d593170b9bdd9fab99
- SSDEEP 384:/b3EHj0FgWKNyEIYi2mL4/y8RLVHxuY9Mj:j3ED0FgW3YiDLk5/0j
- TLSH T1050394B266904C0EFBB37A7050946E3E192BB4D155D1BB812184F03AD670346AB5FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_kn.dll
- Size 44KB
- SHA256 9d7e1b34d7b2dd20559ce9ecd55a0a8200d9d477c27a49502d4de191921990fc
- MD5 5bf71c10f5288913690b870d9498b1de
- SHA1 825d4302d998f2f09322e6f3fbedf5888a9da385
- SHA512 ffe390a3cfba044317527ed9639053345685238305e2f3b2d0f87890747b1348a05a1755b98fa720d03d320dcdd8182547118a84bc2fac6c1e614f33d23abd05
- SSDEEP 192:0QIeQFHcVlOzM3Hw+a1Osb/pSJGqNyEIYiYF80dmL4pUQaULc8pq8RuIQCFVHeEF:fTaUIRBSRNyEIYi2mL4/y8RLVHei1r
- TLSH T133234F79827A9C0AE7D1BAFB7082193D911359C353E1F3813188503C9A707765AAEFDE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ko.dll
- Size 39KB
- SHA256 f70f67f28a4e11e343b4782768f2899e9c28451ed4038c65cf45fc5181c41588
- MD5 4594063dc1508e812ad7fa302998bbfe
- SHA1 d94a3fe4a72e14a7cf94a09d924cb922439ac543
- SHA512 d678cce7c39d6fb570ca17cba5e4e4a701e62bd655e4bfa88e20801e43eb0655bf716ca666e958c76d99120fc13afd1f8084995c480b370ca67f59be314fce91
- SSDEEP 384:0Z+/Td4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOUPNyEIYi2mL4/y8RLVHvrWgx:o+/WmAf/jvUEYiDLk5/z1
- TLSH T15103A4328590DC1DDB227A3165C15F7E627361D059D2B382B2C4B178DAB0382AB6EFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_lt.dll
- Size 42KB
- SHA256 19e071fe3d9174c82cbefa3bca6bc2b48f29d3efb70a6c3dd196e2fc58296ba7
- MD5 83b65a0ffcde4897d218010938ea631a
- SHA1 501990b79bd0231107169d328cc6e59c4d0666be
- SHA512 2656b87c117b4644c956baa3ca18ea46cd46f8b6803a344f80d7ff580c098d0514b363e6341bdd9287a41c34a1af5949c87554ea6b4aba72baaec6757680fa13
- SSDEEP 384:jtA3nc9eHz0CwTmDq092XtNyEIYi2mL4/y8RLVHVEIzVArk:pOckHz05TmDq09FYiDLk5/D+4
- TLSH T1D913CB7152E8494DF7F33E3055B44E3E4A7BB8D169F0B34A21806179C9707819AAEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_lv.dll
- Size 43KB
- SHA256 ced0da6882cdf05604e5f23b5a4f57ace6c4ee5ce8be4bded42b3cac75463c4a
- MD5 510337199ff3ca317250306d5230a9b3
- SHA1 261e56d22f4ee3c382c730e49821cf6500f80a5d
- SHA512 5e8a43082225dd66a38a854e177f81e393d7bad0d6a0fc3abc4b6ed82726752388235d07d5a209c0150ca4d5e1111204b5a6a4f4a61f91cdc94c0db3f0914a54
- SSDEEP 384:kQ6ZyAxOeK6e8NyEIYi2mL4/y8RLVHJz3P:N4upYiDLk5/B
- TLSH T15213967156E85A1CF3F37E3065B04A2E196B78916DF0F34E1140A1798A70B41EABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ml.dll
- Size 46KB
- SHA256 cc3925d5c900e3be8f6fcf84dd0b325bcc3680abd1f64bc1a2c6f1b9fc3c3d68
- MD5 56c462bb69b425f769e87328c6c04a37
- SHA1 6337edbc63cbc133cebf382255af4b29488a24d2
- SHA512 277949942d1ac667ae2f39d5aa95ce1d5228be730980625eba260b672010b68ee46e9bc41bca24d1c8bda006fb64e9a53bc2089961d387f86876031291a92378
- SSDEEP 384:S8dIB7FZygp8/JL+NyEIYi2mL4/y8RLVHsEoSpOH:XcWJLzYiDLk5/7pU
- TLSH T1BF2330761504ED4BEBADB57079851E2F509B1E8D8BE0F390219060B97D3A3032E6DFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_mr.dll
- Size 44KB
- SHA256 fa3efe2998fbb476b083e4b5dd0db8c07b4c8a341918e188e875252b0aab4b0b
- MD5 7189818b0f0e2c3f8ee107a458fde5f9
- SHA1 e0bc1a5c10c73684b3e58b4bc144bb65333f3f30
- SHA512 ba29f0fc74473aa9a93a5a631bd3312a8b923a63bb1be5adf8f988c2a009fd7c2eb56d34bbd98e46b963da276f8dc651a04d9da92e8646d7cddb8a33ff60f460
- SSDEEP 384:8/zdo/7JK7bABkLNyEIYi2mL4/y8RLVHpl2qT:uho/7JK7b5YYiDLk5/yqT
- TLSH T123130C3941485D1AE32DBA70B4A41A3F0CE7288467E8F38516C4717CDDB433B6A5EE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ms.dll
- Size 42KB
- SHA256 ac4096f8ebfc348d21dd721f07e43794f76459039b95ceb58efb6310dc8e8c98
- MD5 f366208662a42245e9acc94aee5f7eeb
- SHA1 5add888decf73e1626b2fe38b5d51cba474352d9
- SHA512 9c9ecbf6d682b23b2d8dc9432e48e25b190f4c6c7245ede0bd40d9c303f7e3466a50fbd9f2d5530c1ef26ee8d21bc5b2f11e227dbc0163600569fa1dd3b3ae18
- SSDEEP 384:Z60OSeyrQLtUv6oNpaMkYjZZ/fbMgTRlRE/NyEIYi2mL4/y8RLVHFu+b:i8Zf3TF/YiDLk5/tb
- TLSH T1FC1399B142D8994CFBB77B3029B41A6D0A67BC82ADF0B35D524064389D707819E6EF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_nl.dll
- Size 44KB
- SHA256 d31b89d3f05c60f6621d5dc320284b946f91f0a3519512f4f40008892c05ac02
- MD5 dece0e6278a4be9fd94206f852eaed76
- SHA1 8cad21915a93fd4e68ca4d59032eea7476b9f7c2
- SHA512 07e90079276198a9045b0b7c15abf2d2b7c602bfef1ab05e3fd740a2cac8c6797ce1954cdafb575c73eb7cf9341b45e061c91d690816fbde8a2e4fbc74f05505
- SSDEEP 192:ntOf6Xd/mkD3UK38yAa9W/1pNyEIYiYF80dmL4pUQaULc8pq8RuIQCFVHHcnFAkK:tI6Xd/T3kpNyEIYi2mL4/y8RLVHHcnK
- TLSH T1A413637247E8891CF7B73B3069B4596D4A777CC1A9F0F38D128061788970741AAADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_no.dll
- Size 43KB
- SHA256 c138bc33de535bc4c4084a6297a92ea4f8dcb477839b19f117ddf30c48e87e49
- MD5 f0a64c01904ce9956887a107bb47da95
- SHA1 d2de1edbfed036705a354fe3be7b13f8a539c858
- SHA512 ca86990b415f5bfca9876db1636845950925724f58c561a2a99f551170f71314380c7cfbce35b0f030603a694465774cd01334c1775785e3fe5b1a1e75839481
- SSDEEP 384:Jy5JZSiyCSiytNRAYiTvaK3QzNyEIYi2mL4/y8RLVHpMKaX:RNCYGiK3QQYiDLk5/EX
- TLSH T1B613537197E44919F7B23B3078B80A2E4967BCD1A9F0F30D124460798971385E6BEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_pl.dll
- Size 43KB
- SHA256 bdab9de34742748234dbd7edb07d30290835d88fefb3d5efec07c3a3fa2c1145
- MD5 3fc24388f3def13f31e7b18fae308476
- SHA1 9be3ff92741fee8899ccf1e7395ddefa261f7d55
- SHA512 27d53e9135c1bcac9b3634f4c67becf3a76d9f92231e22ac8fd5351133a9fac18326d89937f0b0092c5f27e1578128a10fd8d41776503e9e93735613b2c235d7
- SSDEEP 384:c5c7n7KZHCCA7U8Gp6zNyEIYi2mL4/y8RLVHgGZT:v/y3AIyQYiDLk5/nT
- TLSH T1A013FD7196F40908E7F37F3065B41A7D8A7B7C91A9F0B38A224061798570741AA6DF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_pt-BR.dll
- Size 43KB
- SHA256 bc0200cf2aa39daf3f17def9f88d070875738a35f9c92a5147037ba4afaa51f8
- MD5 25f9aa39acb11f6a0717e2302aa2f8d5
- SHA1 7507bcf3871ec2a041a991445276ad42f59d74e5
- SHA512 17fa4cf2eaa2f550c252ed0d4bc06fcd3a769c6767a8438c1d952f03817769d2be3e9dc052335bee8f71f4c1ef1e4f3dbebe64481ae5fc3408f7309ec03f3a66
- SSDEEP 384:jZYxmgZcOZX8FNyEIYi2mL4/y8RLVH9ASc1ZX:Xeg6YiDLk5/Y
- TLSH T1A613A77286F84A08F7B33B356874193D8977799168F4B34D124060399D70B41AABEF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_pt-PT.dll
- Size 43KB
- SHA256 11a9211b04f7b8f7b213c957d8c8af9543d60063b761f2c02392a8c872781a7e
- MD5 2e2a8fca23f34c2570fccf6bd7d60abd
- SHA1 7179f7be334308d349b9a22be99c31c9d7f20605
- SHA512 0e28aa8fc3f9147f76fdf9283fdf18e8807f217ec4696d44204121234141295dad56b6276813192dfb4e705a87fb6f11b718f7c46b1711529d0e129c6a14f3d2
- SSDEEP 384:YJpqzstnEx6ewBXNyEIYi2mL4/y8RLVHBK4eDuj:rIEx/U8YiDLk5/UWj
- TLSH T10613877296F84A18FBB33B316874193E4977789198F4B34D124061399970B41EABEF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ro.dll
- Size 43KB
- SHA256 03aa2cfb87e018ffb00d43f02af28806b7230ce20375d7fc8722dc51446408b7
- MD5 01b1f4fcff2c1bfbe41af328b7bf4abb
- SHA1 ac682a93dea9b313347c347ff2b8c4e84d6d6f75
- SHA512 4cba6e659c98dc9e80006b1dae831ef0a450feff0521671450a252d1e146e96d448911fbc13e6cca93705f54547310dfb69c8138e60a09e2b3d00a7264e5199d
- SSDEEP 768:X0CRNNDM7qm0GdVqT541naEp9YiDLk5/mk:XudVqlcaK7Hk
- TLSH T17913C97153E81A18F7F33B306874193D1D7739A299F5F34E124460788A71B81AAADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ru.dll
- Size 42KB
- SHA256 86fbf734046ef4676f19fab3be40555de193b5604d2954ea59e2ce0c086fb92c
- MD5 daac75e3cc47451966f346db46f93e26
- SHA1 a8a7ee4b11bce0f622f45c712c18333cdf95d82d
- SHA512 9d6feffdbb4620f9912fd5acddf998afb3bb3cfe21cea5a4262899b4a71af0b0a792dbca0542458c826cd224b56a252175db9a2f9a07ae0594d689aa77297b7a
- SSDEEP 384:nS5FA47AvHlho4d25/NyEIYi2mL4/y8RLVHw1toShTt:S4vHU50YiDLk5/+
- TLSH T106130E7BA6688908E715B6701A914DFF206777A027D5B3C2618F7C74A074332772EE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_sk.dll
- Size 43KB
- SHA256 b2943158a333968a6058748e187c376060a0b287e185db6bc9583e2322db8268
- MD5 48f414678a7949171785e47497fb4fbf
- SHA1 f0f01cc0db07f6c5b3c1270c3d76313b24339363
- SHA512 4f70781b872807defb177bf0440a8c1affce866b6d3d85e6396da322a84a4b931fc597e7034766e9e31eafaca707b357793eb322f9d4a603aa17832b1e11b5c8
- SSDEEP 384:YuI8uhJPiR6gLTnNyEIYi2mL4/y8RLVHjYVb2:LO8RjMYiDLk5/r
- TLSH T1B113107252EC095AF7B37F3064B0497E0A7B38E1A9F4F34E5140A17889707819A6DF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_sl.dll
- Size 43KB
- SHA256 8a89f32bd23cf216bf8bf17f46b62af096d17d71f3105803b7897b982c1d66c2
- MD5 6bd2600bf3986cdde75c441e660a94d3
- SHA1 561e263a9981f3400d7370f357dc90e55341b303
- SHA512 646cf570d2ecb982b61cad5e24de5fbad788967e9acc8a6de5ca29736d5bf3b1c7e33ea073201f18a8c5408b0169230872f7a4a3b2f675e25b56f194521cceb2
- SSDEEP 384:wkgTcshVyigOHHTpWBdH1i2IXousPNyEIYi2mL4/y8RLVHCbt8i9:lDhOHHy1YZsEYiDLk5/0p9
- TLSH T15E13987152F8090DF7B77B3054B40A7D0A3B79E5A9F4F30D118461B88971382AAADF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_sr.dll
- Size 43KB
- SHA256 a7e61f272b12d806a3c62591658a84bc100d79c8bb24d85445b879d7e8e1134b
- MD5 a2e14e7426ce6f03596feacd984f78b2
- SHA1 3e9a82fe6e5fe7f11087a66d8a41fd0b12a35da5
- SHA512 91f63151c5e1baa61e0b04c2eaa1f25932d70c7cb12859b3cbbcd09280815d66ce51b17345ca4fecf1c139b76d2ee93fd643f60c2f657dc78efa119bb47711b7
- SSDEEP 384:Ip4aOxCx7UjYN3tGMNyEIYi2mL4/y8RLVHqEImUh:Q40Uj+dG5YiDLk5/HUh
- TLSH T1BC13A83FA5B84908F751B2301AA489FE256B779067E47386518F7C74A138732371EE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_sv.dll
- Size 43KB
- SHA256 5c3c4807aa80e4e6bc24a3e72d2a05de1e705450d3ea9418d7ee57e742336afc
- MD5 74795ef43793bca90595b172a82e0e40
- SHA1 74dfbcd0efe374838a5aea8ce1cf9212269fbed1
- SHA512 2016791866ca76002f267c735837aab1877af69027633c50db9632ab014765c5c1114862a480e0652dad2d81e5f71ea3b0d8fa106fd10619b44f1499d391e9b9
- SSDEEP 384:nK0xC7Ec3EINyEIYi2mL4/y8RLVHX49l0wUT:K0xCYc3ENYiDLk5/I9l0D
- TLSH T18A1383B147E8491CF7B33B3068B44A2D1967BCD159F5F359224064BC8970742AABEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_sw.dll
- Size 44KB
- SHA256 27d25b3687e9734dae0525e9d719fe8ec798e1bd55bf8bc7aec153fae0f87f42
- MD5 275028b93a79c045673f071a972605b5
- SHA1 c2ed1f68fe89a0c616917d321823829cd949fd3d
- SHA512 21b76937921a7bb2d30468bc52d70a8ffe01281b424be63d179a8804cc8710a9a7f37f6e0a709f57cf72a92270397cfe40bcbb43c00ef79e5f98adfc1158cc03
- SSDEEP 384:4pUgicgiY7upr4M5+NyEIYi2mL4/y8RLVHz+7RWc:0UQ07Gr4M5zYiDLk5/yoc
- TLSH T1B623C838455C5D4AF7F7BE3179D06A2D062379A26BF0F385108460388D307A39AADF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ta.dll
- Size 45KB
- SHA256 0a701a4b7d31f0701c337ed4e78f2149918c529b25b97b7ed9f2c646dd54af3b
- MD5 09ff17df7ee72f37b40cc8e75a275681
- SHA1 96f8435d44178affb847d4321344f8ba95f0e51d
- SHA512 284743cc4e6f2944bb5333b86900a744bebcb10c86aef84e54591a0baa6dfc1d3fe7f0cf65abc9f9a411a7ccee3cabd161ea39b5a7ea75064b49da5126dcf156
- SSDEEP 384:NuNwMY51ZLm+4HwNNyEIYi2mL4/y8RLVHSLpGc:4NHY51ZLm+4HwSYiDLk5/SLV
- TLSH T18523323C0A1BBC0AEF21B93179A9593E05172880D7E1F3B02199647CDEF8B12666DF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_te.dll
- Size 44KB
- SHA256 ce030efe866b7db36a75c04a078552429d7cf6d6e6b4bcd23402934d70638779
- MD5 2ba3ceb2021fdc5a50f7bd41f5aea2e2
- SHA1 4dbcec8a11e4a9418b869ecdbe18369e761e8cdb
- SHA512 11ae5e5de24727d8eeb672ba525e165714ceb831b7101f0189c688a70f96641a584d637581d12fb9286dbad573c2b151bbe6acc74c4fd53821eafe69811e2efe
- SSDEEP 384:8bnig45Z4aJ8LD+NyEIYi2mL4/y8RLVHcbllfIcLT4:aniN5ya+LDzYiDLk5/GWcY
- TLSH T1C4232C3949085C0AE3DDBAB074D46A3D186759C06FE0F36290C96038DE717376A9DEEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_th.dll
- Size 42KB
- SHA256 d6d780cc1649824c936eb3fa17c788b4024fcebc4a1080c909fb147b92e83066
- MD5 b7eca92f221b759abb268875505e1a45
- SHA1 c4db75ea49e7864febfad29d19f80f65d573ea40
- SHA512 03a642b4a4386a62a45416cf0e4c329fce98da6a4e95ab5de1b70acf97a3b74dc259b8e8f0892cebbff6103e95debfb2b4914f7b102ba1c02c48c24fe19d8b70
- SSDEEP 384:Tq4lrGsMKNMfetNlNyEIYi2mL4/y8RLVHp+j:O4lrGszNMfetNaYiDLk5/S
- TLSH T1C213FAB182B15E0AC71BB5B0E1D44E3F3C2B6591C8D2F391909AE934D67032266FED6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_tr.dll
- Size 43KB
- SHA256 813a15466aecf8bbb992e21f506a202d5d0be3cfe14e4208f80844a7ed6d1f92
- MD5 490f8a71e5bffa1b37ab9d77a7cb2a47
- SHA1 e4c1565778c0c673e110f5aaa2c45e24125a186c
- SHA512 5d0c8a83684f9947dd271ad8fca53fa1d69ef049d63faceba7f147aae19333ff05dddede7b6ad2b34b8341fc9641c5de2fdc0897d601018ccaea0ac0b5742615
- SSDEEP 768:h1p9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSXKYiDLk5/NM:h1ZhdmvMFGkSxLQKK7N
- TLSH T1AC13CB3143D84E0AF7F33B3428B4593E0AA779E5B9F1B34E2191A13989703815A5DF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_uk.dll
- Size 43KB
- SHA256 859b5c812028204282af314af0fe481939053d9a76f33502e7ee40e258f4003b
- MD5 c84fe14fb9f7d1ba6df01922fc737a3c
- SHA1 449d3ef66384fda8a4d0497585005b673bcbe623
- SHA512 1db7e428a42891d7b1cde89fe8ec532f2d1729beeddd53c9f7a02ddbeb22e01988214e249a7398b741d6e6886bf3bd1be1fb37be1f9398466e17f7901eb527e3
- SSDEEP 384:/tbuKgHWyC2EeovVHE/GfuLNyEIYi2mL4/y8RLVHkPxBlmIT:Fbu2uYYiDLk5/ow+
- TLSH T16E13C63BA5788858E71AB23119968DFF1467769017D5B3C5628F7830A078332772EE8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_ur.dll
- Size 42KB
- SHA256 7501b46601b16989def51a3bec5a6f275323d00d93e4b6f692abe00447c7ca73
- MD5 19c8b231fc480e442ebe6600b3af677e
- SHA1 4d82e2e697044091b30b2c22cd13212cdfe2b0a2
- SHA512 f260f7c4493a0d93cbad703bb514bcd6cbc17f57f886ea65c901c59e00f1e9ad64f0eae9017cbc7cb934df45d6fdd5eb1636a703df9eab542a4210bf42e4fbfb
- SSDEEP 384:VfIoo+OmAcoWu9CeeZyYGLNyEIYi2mL4/y8RLVHAEGL:pIoo+OmAcoWACeesYxYiDLk5/Rk
- TLSH T130131D754464CC7CEB733A38C046D83F262360D455C2BB316ADD643D9AB13A29AAFD1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_vi.dll
- Size 42KB
- SHA256 f403f637ced922caf83e7cf64ff78a110d3efe4af712427ad7965f2e223eec7c
- MD5 12d97fbab697f02274834f8844a0d5f5
- SHA1 0790625fa1ab3496f364ea45acda7c6618588aa2
- SHA512 e14bef552abc3ea3460fb2c01e70e5ea86ed4dcbb637ae0857c2b3c4f5fc936e18411a33f38a3c368f2c08a955645652831536f0e881dad89289d8ecf286bd84
- SSDEEP 192:yAUFZzLrEFUEN+mVNjXvCOAqFjnc7NyEIYiYF80dmL4pUQaULc8pq8RuIQCFVH7N:JQZfKFjnc7NyEIYi2mL4/y8RLVH70IX
- TLSH T10B132C70C62B895DF77237301498193E1D2BBDE1A4F6F342A286A97496707025F4EF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Temp\GUMC7B1.tmp\goopdateres_zh-CN.dll
- Size 37KB
- SHA256 1562c8f7734834f5895cd18ec8d9a315632d0cd559e22a51395f20dc82461940
- MD5 056359379dfe627ab9bb589be7297e8c
- SHA1 c327bf93d8139c6063c666a8f36724dda6fff0fc
- SHA512 406cfcdd819ab4c110a4575dc4644c4803d02fdc4f5f1061198fc4cce6f5dbf08b1859997e75ecca5159999276dc0ea9a5d261c9f5d3e7e17bc2dc531084db46
- SSDEEP 384:oopOyZshAWBuNyEIYi2mL4/y8RLVH/MS/:AZAWBjYiDLk5/p
- TLSH T1D803B47646904C4DEB333A3064D45E3E9A37B1D019D1B38671D4B435DAB0702ABAFE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
- Size 170KB
- SHA256 1dd463192561e8953b0625618119d21f80bf1923828b3bdc97c3d70adaa39846
- MD5 f15bffefa9b2f377a3a49d9dd147f67a
- SHA1 c04a8590c4ab57ccb74d13dd4df4f2049e4aba07
- SHA512 97932e461c250243b5d2e9cb086082c8f9a97d9dde664dffd080f5419693fb35213030eebefec4825b703040863b4c4aed293bcf252a9659355a69a26bc19966
- SSDEEP 3072:vurxDqvsKxxDo4WVSWW/VaO7QAiOWdj/8lcVwvgB+cvt9:vMlKxxc4oIt97QAYxqoB+i9
- TLSH T12C045C1B73E430F9E1B78135C8924A16E7B2B8720B50E79F13A4477A1F336919D2EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1044730164\manifest.json
- Size 95B
- SHA256 91c0538b49b0b2cc56f4f8314dd8a7b1a10cc06694cfb81dca76f522c9d7682f
- MD5 c68f2c41cdff3bf358f7f07fe8ccd129
- SHA1 c6bd4dfc826643860ae32c1e3123d554f76b3dce
- SHA512 ff7b836c9a63f5d158502743938166769dde24de450c0843fd737aefcebc76addf9f805faa777a625e6f0bc3fc2e6ffd8dc5eb6324a730a968f1d35090b0147c
- TLSH T1E4B01220BC04B46B20C01B26003053938B9A3D2A5C223A044556384122FCB35122852D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_11110670\manifest.json
- Size 584B
- SHA256 04e1259680a80adfd0426bef6b17f8fc65d25989350a0ac9b3e49d2da52e3988
- MD5 5c3dedfc7cfab6aadf9a44cdfc173baf
- SHA1 d0a29474a1d20f50bb2d8733ef891947462abf14
- SHA512 faf5c2a6769f428af761e0b5fe044a733113b58a01c84959486ca29b3062cec4fb6fc2f50bc01b1c271a80044e3085e6ae14401baec76975c4c1b35a5020157e
- TLSH T186F0E1A204C9B92624E70BBD4CD352B3E7642DE39345744C0EEBB544508AB5AC16A99B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_12524351\manifest.json
- Size 564B
- SHA256 c028cfdfc2b42d45c0ddeb867e54987a8fc1891ba0398efd6f1c93f932f04577
- MD5 94fec4c76477fe29ca171f066b975cd3
- SHA1 78fe938378dd1bab65e39587044d7d7da5ed319d
- SHA512 81a3ee35b7fdac9b7c5761b0a249b739e104f92f1d2c17c37a69631a0784c735fdeff81c2ae425b097f5ebff2028588463f0305540eab91acab4a35ed1b3017d
- TLSH T1BEF041A00C16A0324498273E9D32564F9DF42F0E1209222ACA9FA2D0F40E47A246438D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1525968447\manifest.json
- Size 86B
- SHA256 31a56f514d228a98683b8cbf7e8a3ced78857ef3e745a06fbc2c5b33162d3220
- MD5 e97d9354ca8a054fb36d180f393b1252
- SHA1 b3e4ec5a6a3751e6d9f0da1f0ceb8ad1da8520a4
- SHA512 7c45acb49bc2e172fae8afa1ec2eb7df0b10e0ce774c578a2b2e68df5ac6d44dd81daa9373aad5ffc7db46073f53f29d3b8921ed2fbf9a47307c599b5bdba4d4
- TLSH T196A012623C00C92724C007640030438343653C0A7420250005521401A14473A01A6219
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_160674851\manifest.json
- Size 581B
- SHA256 e9b2bef1e170dde425ab4e7a432b3ed9eeb71797035bbd1c4c8bac5054e8e39a
- MD5 a2ef8936e74aa803d56d1a94299c56f6
- SHA1 f23852b0123b081b648afb3074e4b4b786c5a6b4
- SHA512 8c77d90f4a7c37d05a08673dd1c8a3ac3603ee605f679c345c74711bfeaa088e464f73de0acdc6f094e9e9aa1e61141638aecd21c96f18aa8801044d79ee74a8
- TLSH T1F2F041000A7AE03621983B290C23616EDF2C37FE9BF0738A109BA1505052EA2CD3C38A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1665409095\manifest.json
- Size 594B
- SHA256 14ff5572db5b76f45d000506116c44f0e2247071644724c22bc57f0d0d52d6a0
- MD5 1714806c98e3c6c61725aaf479e3f4e6
- SHA1 31e03044b8d8b1e0bedb8bc351f57d86fa699bd1
- SHA512 8d6f8a892878d86887ce3e10a0d3be0f111a3dfee43a387a3cb25bb52f490a7ab12af525317081edc3f88d230af5e9083861fc981965fbc98555e9e30d4023cf
- TLSH T1C0F041441F6AD8F2051F5614DD230AA2CB3E79A70704B79C01FF651612DEE7A40BC30E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1700174192\manifest.json
- Size 533B
- SHA256 55a0c0461cde1db922ebc586d54a8fe32eb18029fe463a896305256e0a9335a1
- MD5 e9bfd0782861a462b5d2ef538fe33199
- SHA1 bcf10bd9fc8d4748b79f581d00538b4c1f1be3dc
- SHA512 409b8115cc92f36dd4cb76e34f5918745759123d284207a8a0655311b1451b68afb9a4bff6f6076da05d68cde6313330ad2765fe4a59f9c24a29533f04c0b5b2
- TLSH T197F020044DD9A8AE21D316701D7B62CB4BFCA5E86255F704851EEC53229ACA6323B49E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_1783171181\manifest.json
- Size 580B
- SHA256 bfad155b88d1441588aed8777cd1548d05edbf513bfb6da5917a384db7e3acc2
- MD5 1223821bf843a9ebcbc6d05765cf7a26
- SHA1 addd8545874ab11ab46ef9ab71f1e991a61932e8
- SHA512 8ea7b4d80221020585055b638a9b98061cf94090e707c071d50bc3e073bfb6e0a901b629cdabd56c0f3a490f7c729588f1faefd8a02686f45b33f93821587ab1
- TLSH T1B6F041073D39A4320C0819648E2343AE8F483E27B353E78C0ACA10089494E37A07910A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_2103618838\manifest.json
- Size 592B
- SHA256 8716d7b13188570f04e76da21bf2f14858fa5943881017179f2f34304c99352f
- MD5 ef242db568517bae92d6457ff1078504
- SHA1 22e893aba231265153efd8a9a916e24934e902ec
- SHA512 9aa19f106fcb4c864c2b86ef3d3c8e1188c889616b1317404f588e755d2298786ec4d08ea49770334510257a5f552dbc90a5f9282d1c74042c2712052c79b8fe
- TLSH T1FEF047112D5ED03039D42504CF1331924F74151D4B16D79A67977CE99AC7C7E0373219
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_260439865\manifest.json
- Size 591B
- SHA256 4fb0325523527dd4ce6bdfd48e539a7dc959fff0bbc8b963dc56452ee54c3a66
- MD5 c2274060db42c406bbedbb21143853df
- SHA1 10f3c4db4dac7b6e61507bf5275e3819e5279e6a
- SHA512 405f06d84adc07ad9fde0add57e5bae962bd9cba1ed5e98405e23b5146980e7d125c7feaff0dc60feaf994b5679d393330bcfa4155fba7e515b0132a40f59311
- TLSH T1AFF0E1490C9FE4B51488472DDC2718458EFF3E9ED702BB11049B561472DDF74417625A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_29354635\manifest.json
- Size 534B
- SHA256 5418dd13c0d199a1ee2b0c492e198f346f9034ce484fb2de079f1b0795005b73
- MD5 8381ef866edc4c4a2265ba8e51950593
- SHA1 1d8fffbdd417ee0c1578fc05611661f369ddb335
- SHA512 990e96bb12be1e6b7f08ceb31e7f1806629d3c03dc76fccb217f21627a4ddb989b05208d1700b737d90e694a597f951958d3ed948e8a0e12bfc0334d0b537deb
- TLSH T10AF020F136218CBFE04287310DA381431FBE2E0A350A5048AA2A609142B45B983FD908
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_465922253\manifest.json
- Size 587B
- SHA256 62ec2f8a55cb04d4d50660b7f2d30cb55ea860b09d740821dd47690c32ed6d57
- MD5 25cc03406aab9f714969cb4dfb5a8684
- SHA1 860635f7c7cf8260866a2be95da3f8bb730d5ff0
- SHA512 047efd482b1ed071c7c328743aef7cc393df7568b1149e8b992fae28dd1e8a353f0617cb1900d4537dd233d629a6156461750894282ae25b522e1d9747274f2a
- TLSH T1E0F041414567C07B01481A44EC3F4272CFFD66FA3B40FB6017D6F1046AEE2AA823A24D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_52065673\manifest.json
- Size 517B
- SHA256 b3d527bd2acea9459725d3b147d8334034bd5e45acf0880f2ea119bf5dc5a6f4
- MD5 220076ca8de8af0c5f9e3505e460681f
- SHA1 cabc4816e1290d6fc3ee4c0034d72d2752b72aa5
- SHA512 3a4acaf43ab0e59d4c6fc4b6a3ef32911a03e8fd7527e8af506436cd29f7192be1cffe785f1c84e3c85f59628b0bed53930ca351447286bb14f955c2715f93b6
- TLSH T1B9F00E23185BE0BC264123240DDB9682D5DC87726FA1F41C0E83D5CE4192EA8063FD9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_577634459\manifest.json
- Size 512B
- SHA256 7a9156f3cfa8bcc9093a1868a3566096fbe2ea584a0855ffb1a66b1fe41ad119
- MD5 a5ddcad703b7c6dcbed032d62dee7de5
- SHA1 b5315a035fd3be39b2c46f87c71ce10c77269350
- SHA512 d09beb105d3fe345146cf3d5ac67a94120be47b4bc81612c31ad91d1f8c292ea1abd918a50f8c1a35db319f7bc93c22600a2cc16877fddbc99d0a1e488e7c5aa
- TLSH T1B9F005846D8BD4FC04781A754DA7D1C79DBD02B54582DB84985DB90D4190278C46A4ED
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_588675749\manifest.json
- Size 558B
- SHA256 aa2aeecc64079c5dffbcb7031017b183c3d2f76a5378813002ee6d1e415f8987
- MD5 8f1decb6cc6cc2a873d9f59daf3a350e
- SHA1 3d4b6d154e4afe31ccc96d7f80b5d8cf9e2a8781
- SHA512 9dd2722d25453bd2b180d04423c98c3bcc305b40ebb0b631f3c790cda2d99c1048456473069bce6f361c5741ecb2827f6ae21111ebdaeec8902458a6ec951db6
- TLSH T127F020201B2BE43810C42A778E320502CBB8284EB780230882EE51A1A28EB3246B235A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_750441337\manifest.json
- Size 546B
- SHA256 b1ef0a2c740ac12d0eb5bf0e1deeaf0135068dc4c2f0c225a29466f4dbd93eec
- MD5 60db77645daf2e0cc64c2dd54fc2f688
- SHA1 a4bcce917a3733614cfc13b320d7d697ebc1b229
- SHA512 e72168901338635a68da1a5942340cbfa11d6505853899fbdcd8cb96d409c75c9e95ffa2fcd09fb9f7b4ceda94453727c9bc0687881bb41a5538f218f3a48848
- TLSH T124F0200C3DEBB8780819570C5EAF4C8171FE0EF444A0FA0C9DB6CC6001624C0882BC0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_824917873\manifest.json
- Size 587B
- SHA256 82e9d13da276d20aa981b6ae470e6b09685d139b11e2061b2646d27973fb82ba
- MD5 0847c4b1c422f2426be00eb7ec937691
- SHA1 d0f59ea3821761651e394e17fc6519fe70f0f74c
- SHA512 68523169094ebe910910cf29be8e10547e1994714d371a6f9f41bcda906d0942ad8bc5652aa1acd22bb7553f9be8c7500d9deff36bb164ee0b50c84e4acd1e49
- TLSH T15DF00C49497AD072261C0A364C0343428F2C28AE3B816F680EAAA89910CFB6E417660E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\3c2f7832-eeea-4d37-a587-1564c0956cc9\2dd3bf61-d5e7-409b-9d3d-50e3c745961b.jpg
- Size 417KB
- SHA256 f219514eb94ec57c320a3bbe6cb0afa6d70fc9312d9152fcf0b35b187a9e0399
- MD5 34ccc80d58407b5ae5ef5ac5aab91bad
- SHA1 ac0af76824530ae610b1080c6ca838eae9486af6
- SHA512 3dbfc4fdeebf86d901de10a691a3a0a87816777975f307780b2b4dd617b5e1920f0e5edf10be8b62a6e7e3dbc5bddead9c527c177585c788d8b870cc48deb5c4
- SSDEEP 12288:bbBac35qeTt8NA/LsCNeiXukAWoTscnYTHfTHn1C:UG5qemNs1XYwcnwfT1C
- TLSH T1B39423BE4EA57FD3C4C84370E19B7BB366D82B2421DF089E40B5ED41998356A29C6837
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\412e2691-d708-4558-9b1a-269f681564ac\45903185-12d0-40a0-b575-7cd1efbd949b.jpg
- Size 240KB
- SHA256 77e55dd2b71a195ab481d3dbc185d72179903dcfd4525a7fc99d1d1787eb1e39
- MD5 a954a5fd1765ea3f77eaacc16297b624
- SHA1 39ecf452b5cdd5cffbf3837c52ed2b0b9efdc242
- SHA512 041a9133339c294408e4f3167338b45f40c7dd82fd309e1ec72b9675e0a59b553adf5d061cc613cf1d73f84997fecda0b635c89a24350a858df181fd437ca6f4
- SSDEEP 6144:Co/TQM9+xpH3PmuISW5yASoyI+JihzkIEHGkfaX:VTQM9+xpH3PmVl50FIrzkckA
- TLSH T13B3423EDA6999DD7ECC0E130C8E0309B3E441778C7EF8782C616226ABF1F659659F241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\4ba7cac3-3a7f-4634-b868-ca6da5683dca\2c8aa2cb-f950-4b79-aff3-da35a38dd690.jpg
- Size 368KB
- SHA256 17647f2b50a189001f0c62de4e91cef030fe577253e327f04072be7a4a8e30ce
- MD5 f4ba751b6a67a253f84ff89b9f49fb60
- SHA1 bd2ea1ebdb55033f6348dbf737be97ced8e7b03d
- SHA512 c8843c8e04f92ae5c2f357db09ff9f6d80e280e230fbcaf6abf5f4a67df18da4fedef8cb9617329bf798198f262a3107cf02a7496263d35343fcdc97e4551041
- SSDEEP 6144:N2KGCV60rMQtepKzEaWldSfRlKEA3B/fbMlIToti6FevefKFNcGDbsM:OC40/6KzolIDKhRXwlIhkWIM
- TLSH T16F8412ADEE70BDA3C4C6A7340695702336B7421697DF3051F7AA48B63B49520FC6C98B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\brave_metadata\verified_contents.json
- Size 8KB
- SHA256 5f0b874eb115ca7359f5e4594ce1cf472760c75420f6e026a2f74755b0765a6f
- MD5 c7408bb1456d0507c75f1ec6cb1b11f3
- SHA1 af1f23c8aef896be4d1495ebb6fbc54dc0bf44b0
- SHA512 b4862f98d24f350cb7fa035cf2c85dba4504cafe84c0df1b2f60aff475867d56c410c14e9552082d20641146d9da4dd172d046ad04b146446773ce1d95c80fed
- SSDEEP 192:RSk43t6bpynh+DFL6t6iKkucPVp8znEZBLClp7LF4cN+JDEi:g96bMnh+l6tFIzE/Cj3VQJDd
- TLSH T13D02E871EDA8318D3C09376819BE7F4B8B69D1A8724476ABC8D15E84386250794F34FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\Inter-VariableFont_opsz_wght-BtFs5cFQ.woff2
- Size 341KB
- SHA256 2a54364257349b6c145fa4dd7ec41d3e0b8ab3144205b6f0cd58578aa370e671
- MD5 9dfe4dc3cbfd6c6d65569bb98b0255c6
- SHA1 c4e14405076c153cf2e02e2b43dc281f7bbd423d
- SHA512 fa9d51999aeb98024b90b0181af77d8eb5a0447785e1157043bc3d4ba161ae20788af1041999be4c6407d61ca507a974c71118a1ded0ca5753db1cc879b859f5
- SSDEEP 6144:LcYAtdJQ95LaqpHuVFCFxMv9Xvjvu70XIcXp7/j48BeI1rI:wYadaToV0F6VfjmIpXB/MwI
- TLSH T1CC74239BC48F97904C8571EBA331C8838449BF5B51FC9E60ED5CBA2999D2B8758E6308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\ask-brave-icon-DdJTJrmV.webp
- Size 2KB
- SHA256 3788d823c7714a2e36547bd5fe86c834b86cb6c182858e047789aee196f1f598
- MD5 474e7356dd1ce683311d22489d5bee3c
- SHA1 693b5b1e78b3b9406630b055939d908f2f3157a8
- SHA512 9b0fc43aefdaec4bfd558169f75fe83ce60de4476cd3d738b3bd31a9dc7142edd276689d0872adf131840b8c28346a02db35a799974d55d987c3e5c34534aacf
- TLSH T18D411ADC0A876B9DDB68E0CCC76D6B069D1022841621DEAF5B3A0D3FCAE8DB124164DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-warum-haben-schnecken-ein-spiralformiges-haus.webp
- Size 89KB
- SHA256 e0b0cfe5973b946bb2919d87d875a34e2b525171f1bfa475c0deec0e2a044736
- MD5 75ecbc1779c250019c555faa099b4ed2
- SHA1 fc5afd2dac0ce8d1534eeb62485a41fcd2ee13d5
- SHA512 3de95eebe6465cfe7f7955ce19ce22f93c7748d90be0687918a684e8e1b72a11004177225e227eef887749a1eea7c0581850f31008bfa22d44f19813f447d371
- SSDEEP 1536:blPwGZTZSZ9ffAJyVh31FudOdIPH/ahZgfQwnANkhCP1V+9ixHQHkrtjAcYg:RtSn4JyTlTdlhQdnANk9YHQHkOcYg
- TLSH T1F19301C35040F370A8F5E8B390CA2A5720F212BE6EC9789158F495327E5ACE75FA2D84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wie-schnell-kann-ein-gepard-wirklich-laufen.webp
- Size 84KB
- SHA256 3bb3d5f492e71d4ad79872906108125d4f01c2005ab27552eb3d5f52f428abda
- MD5 d23cf64c989bde9c816a788966fbb38e
- SHA1 c3c4ece19bb2d17e08e5aba7e351f66e1f6a0d22
- SHA512 b4e8c1821124afde0692e41ec6ea2631b360ebe7d5f1e4f53367c597a53b5b43fbf378ca07b58191408e8e4303b7b089bab0da9526f6584ce71d398cf379bff1
- SSDEEP 1536:3MPrcH96sQvzLXOQFjloGYg6XbUhXHe/sKHSZ3y9+t/KQbUbXwIJp:3MPr+0BPeo2GYDXghXHJKHAg+JKQApJp
- TLSH T1308301C0C1C6B82ECCB4D4B286A244B9658C5DBDA2E41DCCFC2B15E7499DA18DC2F979
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\de-de-wird-die-sonnenfinsternis-am-12-august-in-deutschland-zu-sehen-sein.webp
- Size 66KB
- SHA256 e1930e71d842ad513c6c4faac354aad6a6cb80339633f89156034ac51bc673ef
- MD5 874822330a3d8a3ca35208806383b36d
- SHA1 9c447727885ebc63dbe85ef2a3aa41dec42cd51f
- SHA512 5da766098902f12ba0ce924369f591d5acc9ad86a6f38df0cbe0d2d99e8c2121976da46ac11540ef0bfdb269b5ba7569aaaed2716e5cd388c6c7074adcf933f2
- SSDEEP 1536:CbfxEHGuwhXa+NdVJ4QC/2v4AC05SXJlqc1oaiLUy1Luc:CFEHGuwE+tJdC/1H05SZl1iVSc
- TLSH T19763E1876BCB31605361D9A7591F7927D1BE9A20E7C6D116F87CC136286C8FCA6C8E30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-whats-the-tallest-free-standing-structure-in-canada.webp
- Size 64KB
- SHA256 83a011a9a26d8c47ee8e55d4c6af92e80f64a104166bac91f508615aa4c25716
- MD5 bd729e24a2d0d524becdfe70f770c132
- SHA1 39f34c1a3d2ee1f7d633e72ad7608757e4fdd41e
- SHA512 b5fa2197c22b717dcf78e015681a93ef5bbc60c2eb5839bb5a68ad9f19b5c992f92a75b6ff967aaaa206c4254546307515e2ee1a41892855a25bc11a5f1e8dee
- SSDEEP 1536:6enr/U0mp5PfT9MYLG4Sv1bH/2DRtK9uRmC2Agse8tO4R:6v0mjfTqWQ5ytGuYCrzDOk
- TLSH T1CC53F1DD9B3F4755D42083BA9FF80A2034BE7DB00BD8E5961D9B2481889B6FD407C8B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-wheres-the-best-place-to-watch-the-perseid-meteor-shower.webp
- Size 63KB
- SHA256 7cd1aaa11e5ecdb89c3b1756f4d201d5fb4defa34a737a671c70f4ce39e16512
- MD5 489e9d7f1bf6ec8f93568b795b4984fb
- SHA1 6624deca2d80039ee320243b86c84aabb851d588
- SHA512 1b29fcef36013c4612a3c6b69e3cebb6c75ee5679631518e4db2ee3080a905dff82e9212c00f04422e02cf37aaf85acd2955fa76785eb8b07263a8b36243753b
- SSDEEP 1536:GQjLj0n2WNjgyNKuIupkfPsmzveyRV+A6diB:GQjLj0nRjbNX5kHsOveyCA6Y
- TLSH T13653D03252879F43F0E854305765CAF1652AA2AB9F5DB68F1F7D78E5B80F92C000D1B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-ca-why-do-loons-make-that-eerie-call-at-night.webp
- Size 61KB
- SHA256 b4a4149a5d5820df9d290ae2b82138a5a86db000393feb74acfa0db0b65ad920
- MD5 64985103ee56e5d2ad0dce4d50c4ac34
- SHA1 2f47490c57ce1260dca23c81f87019db7230cf6d
- SHA512 b5cb91cc5dcccd6060a55f3d71336aaffd49a5ced9d154694628335e523a68e6523cd5d478eeb9306d5f7950acacc719a2a30723972261de7cdcd745bee76d91
- SSDEEP 1536:f6pYdPGKNispe9LXLS/fFXGrwVF2jlxtJ9m0clK:f6pC7o/mUrwVYtb5cA
- TLSH T14853D095A81CF515BBE30B6D511F7AD1A74709332DF451CF83F0E4AA3811E92CE6AAC0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-whats-the-loudest-sound-ever-recorded.webp
- Size 113KB
- SHA256 fa4536790374bde58f92fa2015544b893437c528ea2bc1e6935a419a3a7cc053
- MD5 4ffb8deff0e60e159860419bd1c8934c
- SHA1 c15d4b33b8221524fb4d6d3eb5ef8cf948d025d6
- SHA512 0ea0b71c71ed9e3d2c890fddd210d6d6d170d51ccf7f4012f3bda1cc4de7c99343d34dcdcea2ed7b6d8f3fa66f9ce65c43d324ba9996f3ba3a8a5462fb8cce67
- SSDEEP 3072:W785SAXA5CSHlzLvgv3ASFPne3H21EwvciqWZ:CiSBRvaRnkFx/y
- TLSH T1A2B302CFF2BC92722E94C4C45EF207A5D2EAF05E31480C75BD876A562604B663F0B267
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-why-do-robins-sing-through-the-night-in-cities.webp
- Size 65KB
- SHA256 159ead72d2a82344869b7b2635e18188178b8550c94ae5dc1d426bb53f7f031b
- MD5 7d96c3104f520b46a48d19a86d29bbc0
- SHA1 1eefe9f5b2961d4f4cc6f9d7e2d9df76eccd3857
- SHA512 a645e5cd319c1f69acc0525fe94e286cca1d1934855919d787c27e1cdf5c89bbbca8c3b11b2f1cb221ac524d509cccd218fa92ffb030980703b448756a5b40fc
- SSDEEP 1536:j0yLT96rTmHKDesqaQRHx6wCTUskOw+xZaenY+/3cd+WbTrPK:j0yXYTQ31CTUs8ssS/3cXTm
- TLSH T1C663F18434D08A71DD077FF3A3EC85BDFF9A90232492122CA444894D16FAF6BD25A65F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-gb-will-the-uk-see-the-total-solar-eclipse-on-12-august.webp
- Size 60KB
- SHA256 ec3633708525f629e39466e84946b74ace63b66fb36ba6fbdbe0a513e2c175ae
- MD5 e4611eb2d67bdc427e6e6825eb5d09d2
- SHA1 38328e408448bca1a12d1b82b53678e590a02a71
- SHA512 ab2c3c28d5c0bfd48aa7b651e89634eff295b30733af1010759b3acc7a9e7fa208177d20f64d6d1edde8ca7dbc693dc7d85a7c2508ba280e3bb763618923ee6b
- SSDEEP 768:zvPnmdzKwdT1BmW8NLPPNKskv5t0S1gZrdMdGumgK39yuO3XGelGWZp4sZEON:zWHdT1VcFafkZhI6w2ezZp46EON
- TLSH T14953E1CA684CF075BE53D7F1C48232E84B2581F9C96926EC2785967623968E1FC3D9F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-what-does-space-actually-smell-like.webp
- Size 80KB
- SHA256 0c40d0a8cbdb67b6fdb20aa4d0a01bec08f862fcda6058a759a2e479cfe736c8
- MD5 6be12fba3ee92e3f080d8bd4ee464430
- SHA1 1e94b39a5c98ea0c7367f82b5d0cd36474640891
- SHA512 007d9253c9998072c5254d1a2f5d4be8dc78f6b7457d672d2b10250305084f65536b96d43448a779f221250da1b4d3cc97434791975f4ef634ffc26e304bfba8
- SSDEEP 1536:E9aZUSlQqDaR3Mt+Wy0RbSZj5D40/xdWEEeHRCvS0PmFNtNYjjj:E9QlQqDOmy0oj57CbeHRT48CjX
- TLSH T1CE83F1F38871A8E6C58CF8FD1D28D3A95EF0A615D5B96CC5F08EED4542E04D0A70276B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-when-is-the-next-total-solar-eclipse.webp
- Size 67KB
- SHA256 c14968bc2fac58ef7e825fb48e4df2031de1ac753058e923221d8c99a4f88da4
- MD5 6cfca0c99a4fb1087c74a7bc8056ace3
- SHA1 2ac188da7690efb04c21d012e92b9a1ec9395004
- SHA512 aa68b69afcecc66f034e0be94d92aabc8b4b84ec2e0a36e72c16d35e02afeab71974d1ca473cfac9f0547a978e10112c96eaa1c9d841e5bd270640adefa89225
- SSDEEP 1536:+H5f9SzoF5vkDV402ArrITzvy/j2YslEHARvkDzaU4h9ydesZ08CQ:w5f75v0Zr2zqr2Y9ik3aDydA8CQ
- TLSH T1D263F14181C193B6C8390BBC0A0746DE73FA691B19CEF96F5980A7DE3029DD98DD41DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\en-us-why-do-flamingos-stand-on-one-leg.webp
- Size 97KB
- SHA256 e6900ccbc3cfd91c5c8dd14ae66dfd46687c4b028b62b0c1c26a726ba8b380c0
- MD5 3181cad53e2faf3d52c5e289468669c9
- SHA1 7f4772162e6ac32033c6c1a831402c4c7d263a48
- SHA512 f807cb9e58cf7996f4617d8d68936b9a9dc6c2bc590942ac76297741aa34bf033421d6f95e487ded7bd5335da9177611b1de30a03ab76fadeacb36b5fd74a134
- SSDEEP 1536:j5eoIDzCvJcu6Nc2hshWnV+Ywdd4HhddNAGAs2RoMCxUdIHRsUwK23IG:j5oChYcksgVE74s9e6d8RiI
- TLSH T1E5A3024165B8DA30E2B4FF728B676CF9944184E2681DD48232A2A18772F363736F7D53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-donde-se-puede-ver-mejor-la-lluvia-de-meteoros-de-las-perseidas.webp
- Size 80KB
- SHA256 59d78c615a13235834d28ca4aefeffb5805bd06ff6553058f84094fbb86b5acb
- MD5 e08237a8e3a883bb0f1a8a8ba96547b1
- SHA1 824cf66955f3f26ca90a11cad7381c7b6b0f8f8b
- SHA512 c75b35123d56872bfbbc2e053ac64357f9e5c79c01fc052dfc6ddec88731321202827b9f78a28fcaf476fbbef19d7290ae0c273643ab3e8a5f97cafefd701f7d
- SSDEEP 1536:ZEtgJ4R45JBXq2CiLBko7N5DYl6tEa/WP0yw8hAZNanBVidi:CtgJ9UOYl6Wa80ywOAZ2
- TLSH T14183F1F4180D97DBF64023766143818DF1262B783481DB7479AAD6C1E38E6DA3DD0ABB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-delfines-duermen-con-un-ojo-abierto.webp
- Size 66KB
- SHA256 7bdfc33b83981fe9ea30a7025b80e8526314d1d6c67f98cbfa02e892fd4ce8a3
- MD5 fac5fbea3db62cead184ec1991a14a14
- SHA1 a511ae075724941f09828675b144b046a42538e6
- SHA512 ce9ca2f061de3632c0596d6bf0365711d762c06f15dac6ff080e1321b2ea52c6b5765568b8ee9ee94258c82f1fb3323964028fac767b5abdf53e065b203e6181
- SSDEEP 1536:bnHDZyjSlacWmCz1MkP/DpAtPfzMZGCkEwew5RBT+LT4XO:bHVocYWCDpAtPfPhDMLEXO
- TLSH T1FD63D01274E25750F53451BABE1053A730A2C83CFA139267119A26EED3DD206EEF8D2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\es-us-por-que-los-pulpos-tienen-tres-corazones.webp
- Size 74KB
- SHA256 98c8de5527043a62670cf1608d99ee8356392c68e049c1bcc2172f5c2a2a0151
- MD5 b9dad7e134d6a3e42c8f66f104f9f769
- SHA1 e47a3c87c6a0230dcf2011f91a0b64088dcf727d
- SHA512 8205f6644ef6502918140a878ead539393dce7867a9370960e52f6572327f147d3653cd64f4603649598f182a496cac7071fc72e73ffb9888944746e6b96eca9
- SSDEEP 1536:I4UsYNnR2mqu9y3SI8cMzwd9Q5ZhuS4zmP/ssM5wLqhCABdyy:/UsS2mqnCIsUvSRnssMOqTBcy
- TLSH T1BE73E04042BC31DCF62CADE071F9891AB21C71FE64E0BA7B55DBAA3E6580C43B1D5936
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-a-quelle-distance-un-orignal-peut-il-vraiment-nager.webp
- Size 69KB
- SHA256 9f638f93fd61639a580d62c7fd9e5cc878cf625f6f0b5cf894b6d00ee4339483
- MD5 0382c02c668a91a9373e8461c9779dbb
- SHA1 3bfff30e2e5ef1a460368803b2ad34366200edda
- SHA512 9d7f7f32d0ba4b4b919a353268a31dbf4816e4c20008bfb2136492ad991352aee1b5b40b50b5d3f6cf90b406d7c63c81212d80b676f5b9638879230be0a18fe3
- SSDEEP 1536:bFKWBSC8FbH1llybmliRyf2Grzk4g9WgLL8PYASseKdmFoPGFW5:ISSjb/lybmliRyfPftRv1
- TLSH T12A63E10A7D02BAD6ED4A207A6DA710F204DF972D370C69D83C0899EB49BDF05737169E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-le-castor-est-il-devenu-le-symbole-du-canada.webp
- Size 79KB
- SHA256 276dfce7d00b7446a0846a5729089335abc606c0a3c955b6a855833a10a8bd58
- MD5 0dd8a6ed28007198dc5ffb9682b02c8b
- SHA1 a08a49696951b1db2dcd71ea0f6442b8a98a9467
- SHA512 f019f3c251f83304bdf74c372831e8e0dffe7011cb635b0bdfd00938ccd538e12fdcb90ad85b91d25c3d8e4aa80aa12a94d86301852a767e02b156593534e58e
- SSDEEP 1536:oplKQHdeNOYVRrEzf216h0O+m4Tgcwk9TRLrrrKW0eAuDcrW6j5Y5:Cn4kYVRrEzf2uh+m4Tgw95rPpUuDcrWN
- TLSH T13883E1C4CEC9A865D991ACF433E0896303D43646AC7E8143DB3A3F48538E541BF91ABB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-ca-pourquoi-les-aurores-boreales-sont-elles-si-frequentes-en-ce-moment.webp
- Size 73KB
- SHA256 23f18315f7453efdffda5e41e1f273f00c41a2d7956472efc52cfe52c7ede866
- MD5 462f8670067d2b2486bf5498b19c539b
- SHA1 beddd48e5a6e38b148144ffa80c4e3d22d7e3715
- SHA512 a95a2d65cb6ca3236221dc71ea194aca5d606335b20b3b6f5765f62775c2444eae411969b9d7eb863c1744d9e9f70bebdc1f583af854aad6fc8a43489aa4954c
- SSDEEP 1536:nZeyOBrn5BSOhKj3qL7LTjL0CtiWLTbOeY0rxiwc:ZrgrSOE3onACMWjtU
- TLSH T1FA73F16FB22382D5B5E4283533974469CF920B5E4EEC0ECAE3D46C944684AF5828F7F5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-leclipse-solaire-totale-du-12-aout-sera-t-elle-visible-en-france.webp
- Size 72KB
- SHA256 0360522c1179aba33cb0e6b379d4014a8ed3d36afc31d3cc2cc789b29e85cea2
- MD5 b7a60799297987ea2bd2aa9e45825abe
- SHA1 711682c3ba0a87bd8c824864407bb86ff2920dcb
- SHA512 96023cdc40cda55c01555a0a0b14f216f5dd64ceb1570ec595cec428a2d7258ccdbe41b456eb403f91bb2465f7746f6c06ac3f730d8bc4b2b11a33d98d2d6972
- SSDEEP 1536:ecStpDQgKzAW6zBGJwor93RXHCZcsPvaCQxYTEpmpGJUF98yqAlWBpl5zvAq:e9pUgD3wJwqXCqsPvse+XJu9HpwDeq
- TLSH T11C7301CF54C8720AAB7B7B9D910B4CA2265223012CD01497876F87CF276FBBE7649857
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-les-chats-ronronnent-ils-vraiment.webp
- Size 76KB
- SHA256 973af3bf072efde4b78d525386c860b54aa8059a340634e714fbbbc519ecb96b
- MD5 161bd22b7ccdcfda109e7082a11c1ca6
- SHA1 70026ab67cfd19dc677f74f9822c4481b83a997f
- SHA512 87f70a157b07675faa148e6102735eedf8a9e5214f0e9caa9c75393117cba4ffdcb3818a5cf613303475bd8aab0b6e92caca197f76734a5e2a4c4c4d2b47c4d6
- SSDEEP 1536:2v5u7KPqfyguGLNu8iqz9eM4WHV5UCOTUX+G0Rg50yWrJBqc/VIc7h:ePq9ugNu8iAb5rUCOS+Giq0nrfn/VIc1
- TLSH T1B873E0DBC9A3165ADE4C9EB451248C3EC851032B0BA357B07BB87EC7E24D62B5A714F4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\fr-fr-pourquoi-y-a-t-il-autant-de-boulangeries-a-paris.webp
- Size 81KB
- SHA256 23d5cbd6f35e51b7a6e140c588dc700fc603c4184260bebcdf90b99145cabcb3
- MD5 cbb9fb11a806d9a545e8436d45d98707
- SHA1 f9beace944bed44c9b69069b419fcb0de7cd1f4e
- SHA512 96ecd91b48a195dedf86b66d308cce525a6aa5666949b1f31a6f84669f4ed1b6e4ab6a2a488852f4cc1a4c883ed59c54e6058cb797406e26a18046cb91c62e16
- SSDEEP 1536:/ajZVKtAV+vrjCoPbiI54d0q85KeyKyLG2v2zekcrVyS6NJ0+5YbSS:yYy6biI54d0PKnFLG+2sV/6MS
- TLSH T10A83D1E79E75D0CEB5256D3C08CF69379C28F9DC7B0469D3321892B21AC0B7B21C6669
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-1ilobi2k.js
- Size 179KB
- SHA256 7481ea913dbba3b04d178b8e3757cf38c9e03f0a2cf4993d644fa4d6f83089a4
- MD5 9a94c3ed1fb05eafa7d91b1bd8f45d01
- SHA1 cc77b5ec0c9279da694f026bb5eced53e013e682
- SHA512 64b7820de249811ed0d437f47517774f87ea010993402b85d271a925574edad741a5c3755c093fcd69a04bfac6ce5d305ef20cc585aad88c14e25c2ea0675c3d
- SSDEEP 3072:0jR4yeD0Vq/8+7g4z1CtAohvCXO8c6vAwyttr:0jR4yeD0Vq/8+7WtAohvCXOQvAwyttr
- TLSH T1FE04D9A5F389252302FE20ADF82F62EC7DBC505164098D54289CE45831F9FDE72B7BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index-C8g22OGQ.css
- Size 30KB
- SHA256 19b099627396007cfcf21d64ed208361dce53926523439f3102fb7ee96323ad4
- MD5 1369fc734d2364d7cb71d73be753e60d
- SHA1 e175e60408b262896a2431c7165fe81b6a4a4baa
- SHA512 a29370051b9ac68fdad9739a094a375503accc057db84636013db088c21a4cd7e720e94da8c32a1c52c04888dffd9038b571594ba4596095b3ba476b8c29ba69
- SSDEEP 768:l1FXs6kFa4Fke5lqxjEeQCjLAhH8TuJ3zN1bZ8LhTDZNNE:l1Jsho4ae5lqxjEeQCjLAhH8TIjNvahW
- TLSH T141E275947EF105287D67D25867ABE7183328E0836C2BCD6D76DC10689F893FC9A93B44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\index.html
- Size 4KB
- SHA256 e64e0da634bbd8b22e6c8762f323bd8a556384523987e45488d8c05d6c65b162
- MD5 d290994811d8336b9a6a4eec7d56b9d8
- SHA1 a172031bf0a4c9ca707b04b3be108ea4fe281804
- SHA512 17f31dbe4489f88ded2e34f6a1bc1009873e2b489af9639d1365a8211304b414dc13aeee6ff5f524c42766a5634b2247d774acf13838da1da33543579fe3d2a3
- SSDEEP 96:d/BOFHgKYAQK4bL4BVWIOda3dtPYkt2d8AMzR5Y9TqOTG:JsDoMBgG3bAdOR53/
- TLSH T1A2A18541A4F31A3F3BB82795B89BB0917A4A9093B718E358F09DB0DD4BC9DC254F30A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\logo.webp
- Size 6KB
- SHA256 fbe1831f3abb9be1d5b81785055bac244f70553e51a25556f558c31cb2ac6e37
- MD5 a7b77da98f19f969fd737121c862790f
- SHA1 f1402e029b8dbbc92a0dfae9a51eb0413fee2890
- SHA512 d1c6e773a0db7f9d880133003d25acaaf3726ee97e8ed8f76ed8d7895cedabea02cc3d99d0df4a25473d5ec4fb5ca9c823849ebfe3006eaeeb08b6b5bfad5441
- SSDEEP 192:m3LGUqY7tdtVKbHS06xVNfDgte7lU92e4Q+hd6mWOtv/3ImkKAQV1HCJcT25Q:6LeittKbH8xzmey9z4Phd6mzWmxbHCab
- TLSH T1A6D17E2E928B69648EA7EFA543C331121B6010B4419207A3BCAB4445834A6D27AAF4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\mouse-pointer-DSDsXotA.webp
- Size 136B
- SHA256 c53bc691edd32cbc245bdd461b5fc36ef21afc3d8e4304f0df49119204e0b0ff
- MD5 b9f03ee12b0e0c2956a5a0ac3a5d3245
- SHA1 5b1fdfcf92ee03a022bf3ce0233e0c4da6c2994d
- SHA512 12c8d19d5685ea7b993d3a2758c8ba060620cfc26415ab7e24a73354fb5e1051ed5f7e3c0e7a796ce8250ceb80c7af0c7606eec69764b7e6878ab12b466a3098
- TLSH T1B1C02BC18C09C050C5107C3AE4AD78B0F847105C41950F011DD02C303355F0CB9A5AD9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-icon-BD6Rfjhr.webp
- Size 1KB
- SHA256 02f34d12e8f5f7a2838bde1be407fe1f9815dae8678cd6c77c7c031a6f41d8df
- MD5 eaf2d651f993812cc4be771e566460b6
- SHA1 8db35f32194de0003253730b81dac6e78622f39d
- SHA512 5d834e7c97eeacee4c08eb62e0f6051e80f2c0f4e68299ef248ce238084b7a7edf3baa4bfcfff8b3ff78a43763575d32bbf766562e37533cb10dfaafbb983796
- TLSH T17C2119B2CB667417C60AB05F9014A3C68FBF3B04E2A9C786A5A229D47124B292E30225
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\search-logo.webp
- Size 5KB
- SHA256 3a1dec651528a4b789020b9bc240f7c7a1ffef36cc3024095cc6c6c73da7ec85
- MD5 beedc26a7a9638bab3220ce8a4d74007
- SHA1 e93b44e4da9eccf5bc2542125102ef7b1711c445
- SHA512 f1e92a5622988833d013097e2cfced6cf8a4577030fa354627b5fb8a2b4aaa929e54c5be3cbc37e8831c09d4de445219c23a8eb611aa0b6543077d09c4ee24f8
- SSDEEP 96:Z7aQTdcNRoI+x/RnP4NUYVDdgowaBB9D6BwAW5cZL+gtCSJHqriPM0m1ajm0i4d:LTdcNRobx94NUYldjwaBXu05Avw5iPM6
- TLSH T1F4C18E50C35296D7C8D393F788D9FE17509A8EB109140C91463DFD30F964C697A2740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\ebec0987-c5ed-4874-8fbf-032c1cc6da91\wallpaper.webp
- Size 38B
- SHA256 2f9a4c22931833a8fc296bf89b86d94eec618752a62a1add43b753a77c80852b
- MD5 e277f4ab896e59909e8ede6d9f305d53
- SHA1 619779f3d466c6a86f30c9ae0c2f07e99954724f
- SHA512 4e96670e14b4d802f6d74d258a03dad7e7101dfabd97724f7da64c4aa89c2222392919e4ef13271d0237274c5fc1b2a33e53214889745a14f755211de1333ba9
- MD5 SHA1 SHA512
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\manifest.json
- Size 546B
- SHA256 54c625cb73cb8e6adceceb1b6ca380102f125f95fab0f589a840cf2cb8f83ea2
- MD5 82325d53c470bb18d820aa5734b1eb13
- SHA1 de0697174661c8b6b7e7c9500ef7082bf078e8ae
- SHA512 21aff6952b2e8c2cf08ce364f31a8a7da52afeeb96d6a160721930c4b04b4d9abadc5b747d20aa1e42fcbc45bf87c4975d1fcf5025deeafb68b6dd95a8573bf4
- TLSH T16CF020442C4AE8FF04EA490C5A3F1CC11BBC7AF2A2E0F30839DA9D2C0086D5A863009F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\photo.json
- Size 50B
- SHA256 c9b5c6de15d08254da3d561470114637abdf1715f2b24b4747152fd774d81bac
- MD5 e859f2fb97f6c63e2bea53beff808b3f
- SHA1 450de59b6cbbebd65faed92333edd73bab6fe984
- SHA512 2bdb6f863aedd3a9324467ff399e6b006e3b8f747f7352807c2d07eec50e3000abb08837baef5619e00a7a5b076fb5ef15f42fed66c2968a4c7ec5b7d14801d1
- TLSH T15B900254030309A1308402F04D0211C261D30B5B0CA0D5A697580AB8432007D0851264
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BraveComponentUpdater_chrome_Unpacker_BeginUnzipping3240_957768086\tiles.json
- Size 30B
- SHA256 c79b6e5f6124ce0dc47ed10b897778a67b06bdc8d3db1b5d37ae119460df8fe0
- MD5 afc03f12232a656476bf3bd6f8d0024f
- SHA1 e44a48586d163f20e223c742a66ffc560ee53fce
- SHA512 bc1034f0039401e67c7234af87101da9cbc37a578c062ced3c705051fe003ae57452af180100a56f3be9833713064a64e8df1275a988ab006c298e1afe21500f
- MD5 SHA1 SHA512
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\151.1.93.129\Installer\setup.exe
- Size 5.9MB
- SHA256 64e32a25723b51059df1f780dec066cfae5f9da1df05ad19a5fea899461dc650
- MD5 7154026b1c6f0abbd4c814560be0f990
- SHA1 c2652b1590f405755630db31d9cc018947155794
- SHA512 b554f371b5aad1df1b8bcf85db0df0dc87423744b544be00a2fe3a65583b5fdeec3c0ca6c8bb28b8f8d681963696db5935bdf1e2c44deae4031c322ce5462c87
- SSDEEP 49152:pppINuhOVlGnZgcRJqBzytzPoN8725H0KIRGrl4Pdv9J5aYinWMGbAxUEAVIzK6z:WVAZ1PoN8IH0IyP7JpwUnyvCa
- TLSH T1C2565C53F3A501E8D06ED974CF6991229A257C8A47B0E3EF1AD436E11A71ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\Dictionaries\fr-FR-3-0.bdic
- Size 1.0MB
- SHA256 6cffc13b549c33d44180a3a7b13943fe0eadfbe80bcdbccc76f67c55c2012968
- MD5 386474a60c8feb88aaae21975bad3aa6
- SHA1 9e48bcaa1730d3f33a2928756fe3db9c3c1011eb
- SHA512 b0a22a8f4920a2d457e1bf42c78a38c6c2f75a1e2ce4c19c2b0b82826723e0496af555aae223370f4a0c7bbbd0f0d2e9c6e9237f1d216fa59d84aef7c20d4961
- SSDEEP 12288:CrrXE9qcG/vREsQPpFL5zF91aapxRhcnkqzdL+Oj4iO1SkHk4CC5SHKzMc+I5:v11pZwyjfEx2d
- TLSH T12535B641C27996F3E0496638381716752DBDFD097A3582F10AE878FB3B06BE88D66713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4388_1332246125\Chrome-bin\151.1.93.129\resources\brave_extension\_locales\sr\messages.json
- Size 9KB
- SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
- MD5 be4d3ff630ba68c0c1ef6332335aa4fb
- SHA1 eee39c1e1fd075bdbaf15e00dba66b68fcd03789
- SHA512 50ae00273c44a86ecc6a40b3010d92bd860061d89072e72c95ea2171ef2c0cb7d31b711639c3a5e9d9274159150488ec7dc1869db3c2efac50ee115b0ec3d5bc
- SSDEEP 192:RUt3IkuwVCnSuvPlxuTQFDi41vjZpNns6:syjDNs6
- TLSH T1BB127D00DD703DBB02DA05263C7B7084B73407AA52257D2CEADA919D1B8E9FBD4BB385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping160_324628841\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping160_398181637\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1035858450\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1050990374\manifest.json
- Size 1002B
- SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
- MD5 9be87722ce3608a2d38a79079feaa394
- SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
- SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
- TLSH T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1437964722\Sigma\Staging
- Size 36B
- SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
- MD5 0163de1b14421d4eee3757ff76fd81e4
- SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
- SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
- MD5 SHA1 SHA512
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1437964722\manifest.json
- Size 132B
- SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
- MD5 a4d9ab812da8b2906ff9d46f9ffc07c3
- SHA1 48b428dc760bc008058e6df47a9f05f2f86b4abb
- SHA512 5a2ba950ed85ee55bc1402d57d09ca8d54c0c2df5b43a402bb8bf3668920a40d584fa18d270376b046e23be00698bd1399ef6a0b695ee6c0b99fb454616b1cb6
- TLSH T1E8C09B115801797654DD77F00D29D7526672CB1D1494250546F5C218EC2DCDFB5B330B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1568158566\manifest.json
- Size 102B
- SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
- MD5 19322c8a94f1ac01a70f8c58cdbbc720
- SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
- SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
- TLSH T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_176810339\manifest.fingerprint
- Size 66B
- SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
- MD5 06d2b48de0edcb3e022ed639f0fb0085
- SHA1 32f93d5a76998c407087269794026d1ea028828f
- SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
- TLSH T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_2098062532\manifest.json
- Size 69B
- SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
- MD5 fb0d9796a86299d3689982f7a949dc6e
- SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
- SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
- TLSH T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_2930904\manifest.json
- Size 76B
- SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
- MD5 ba25fcf816a017558d3434583e9746b8
- SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
- SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
- TLSH T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_423546921\manifest.json
- Size 116B
- SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
- MD5 daf93729356a67ea1f849554827fdab1
- SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
- SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
- TLSH T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_538651183\manifest.json
- Size 113B
- SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
- MD5 7ef3c71464d0fef472bc1d81fd363c62
- SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
- SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
- TLSH T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_569019086\LICENSE
- Size 1KB
- SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- MD5 ee002cb9e51bb8dfa89640a406a1090a
- SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
- TLSH T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_569019086\manifest.json
- Size 78B
- SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
- MD5 259f068207f60fb9d4448c02c27b74ba
- SHA1 99131d95cce94750a928738a99caa5c710bbc924
- SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
- TLSH T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
- MD5 SHA1 SHA512 TLSH
- Path C:\System Volume Information\Windows Backup\Catalogs\GlobalCatalog.wbcat
- Size 1.3MB
- SHA256 0c669eebedb3541976222c8de22c64510eb2c6eda50cf08f534aee9eed3d6b38
- MD5 b4196f5e2e8f480e4b71803fa9946a8c
- SHA1 7d899ed63652ce9df2a5fa1e291144d5c436d432
- SHA512 51af1e3d35021c685ff30ecbfb5a32ca04cd2ab6d1d5d1150cc57ab510c05b77c25401a13b3d2c9e20f40d87b054b21532731dc7def7c6af38032dfd6883b9fb
- SSDEEP 6144:EBVrlz/gc9KdvuBTmDSLng3Xh+AyrpWaSN6wqqax0y+05TbT/4lzMTLzV4XIYYPy:Orlrgc97mkq9KOA5oflfnUVDswy
- TLSH T115551C116FE44308F6BA4E30AEF7995D123AF492AE40975E2249037E1D32B65CD35F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 1.wbcat
- Size 167KB
- SHA256 c782948243fe7d01b2a2ab923e264ef0031e5f37c5a6a7bc77bc2bf513bef95f
- MD5 265ccda26b78ad302189bd4b6f9d7137
- SHA1 22f9f943922665b807af3a6d57ccbe9b8559641d
- SHA512 47cc51d99021447403ff380ac34ab12a231804c69bc9c9b2c2c2709b9dc2868fba1714d0ffa1dcf02bdb1e9fed08a1ef766b2ab6447baa6d0b20149539939f37
- SSDEEP 1536:ws7uYOeCArh7kxxaVfXEC0erl1odY58yT6SPh1TbT/4lzMTLzVSE8J608j:wsg0VfECvl1T5TbT/4lzMTLzV4s
- TLSH T14AF3D9136BE95624F6772E309FF7912C9633F8929941CB1E214402BE19B3F52C962F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 2.wbcat
- Size 225KB
- SHA256 5eaeac80f74462667abfa34e068d93c7e8c0866dec313be1028b9dda68068cfe
- MD5 35ca338ff63bc6b15615235126e51af3
- SHA1 45baa1e3046ddc9124b54b70f036bd0f31e41aa5
- SHA512 3e3d3360f1fa84868de0ba1e2ab05d812c9adf29a47e3dd2ce6f83159991c24aab1a7fb6bc01cfd2b84da5512a85c53cdae610620402c95f7c4a4d652ebe941e
- SSDEEP 1536:b9u8HaWKhMy1Wury8hylSkNpYTGfycgD3FjGhnU/2AV+Gla/UvS:hu8oVylSogxsU/xNlY
- TLSH T153349D65BFAA4114F9764E302CF6985D412FB4C3EE91AF2B2345076E2E32A45CC25F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 3.wbcat
- Size 40KB
- SHA256 c378b5924a8d795c0d9870cea16f6ba06e9ea251794878e97f4c8692eab9a314
- MD5 b1756fbbf6c8ab5cd0ef9d04b9d34805
- SHA1 6b40aa2db6537222c06fff6d07d342210c56e8bf
- SHA512 791a11e6b4c89dae052e81b66f7fe7641026a141a55f613c11c447ebcdcc6d27efcacd29af37004485b234eaf1477a4169b659c17d77ac03968728278807d4eb
- SSDEEP 768:taWthCqtfJwRDt9CQRzmeJwVSdeRHwYldr1:ttRt6RKQRzNVjgdr1
- TLSH T16A03CD513FA4AA1CD81A6FB11FFFC01D0329A956DB06636E134243BB5E81B998D91F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 4.wbcat
- Size 124KB
- SHA256 8b5a6a14a3c5c5cbfcb4817ef895c51177bc66eeb628f47eeb63e9c9f263fda1
- MD5 b46f827d332533358d056b113937d473
- SHA1 7e8dab40d2be0218f59a85dbdbc2a8dc36e783c9
- SHA512 1f743a9bf24ab3078889b51df0e7bcfdd17aafcba629fd0b1a320825ea57e02b3dde011d32360a8fb1a3b2bb237fc395b6ab94bec8cd3c9424fd969b0c5294fa
- SSDEEP 1536:IzLhZKDiplz6gzbyCoWRLFidEOOKOO3OOkOOhOOpOOYOOPOOU8Mpr7GQXddxjHDf:emTwiU8MprSGHD8qSM
- TLSH T13AC3A9907FF41B14E9691E701AFA946E463BB412CF15A36E1A46033E0A66F95CC21F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 5.wbcat
- Size 84KB
- SHA256 649f74318ed58434067beb0a721977f4aa10a400fd8ae7b12e09ebccb22ef4c6
- MD5 59de30394f9ab45c680fe79a98b06bdf
- SHA1 f52301c85677ab934dcac13abd67eee1913c3410
- SHA512 cb62ade488f04925c2872c65081ec185c8aec018e4d574228f8101b82972a11ca9288de8c62b9acd212b9b285a7c8f49ad865132809deaec17ab7498f30f367e
- SSDEEP 768:bty5ifyojkFDRJYd3F9IbgIg1IfuDvv6hJ9JQLISxAVnk3:OAkFD3YdVO8Ig1IMayAZk3
- TLSH T14083AA517FB81628FB6E0C701DA2482C563BF1628E00675E5E17037E1D79A5ACE3BB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 6.wbcat
- Size 380KB
- SHA256 7a735af8fd4da66272600bb471d33c7f4d076d365c2dfd76b7de78153dd9be02
- MD5 a29ed408a27a54ffcfb65e4a36b88d2d
- SHA1 8ddfb958fd20f6c4eb9c5198633309f10a26ea8c
- SHA512 324193b123c599c80258bc6f8d0ca2bf84d6555687ed182e4510f07b76b027712d3d898e3da0637427444ff38d3098b3080b8e257c3cce94cd7012cfac5983b4
- SSDEEP 6144:3u9TmWSLng3Xh+AyrpWCttTt+tmtctut6tStmtK0OYwn9A+iB:smD0/wn9A+iB
- TLSH T175841E512FE09305F6BB8A38FDB7569D2736F0D5AAC0D35E204902BC1932B71CA79B19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 7.wbcat
- Size 216KB
- SHA256 949b55f170a7ff7e188e089141f05f89fcec5b8cd6c6aac80cd32df89625f1a9
- MD5 a714413f040ebe2db9c1702dd56e6706
- SHA1 464a4e2f57fcd9b3edc56e0b736cdd5155451078
- SHA512 ba04ff99f4e1d2ca241f624e747e58edf77e241e80752f7e69a838a93da84b3035cfb2f2279fd6074b80cc0c2baa94c6d1736a370a2d1b6da253b288194548d2
- SSDEEP 3072:lh5/YgtnPP66703qvhqwqa2tf2Ck276QY7oLoK/PAX4jqexDxNR5ef+IKMFH6Jai:tvtnPP6643qvhxqa26SjV
- TLSH T1B224ED2526E84319F6F78F34D9BB5A642636B0D1AA40C38F119D077C0873B6ADA74F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\System Volume Information\Windows Backup\Staging\{D03CC750-DB18-4646-B221-55030EC7CD53}\Backup files 8.wbcat
- Size 192KB
- SHA256 20de54257c65454792edb15d652cec3cbfd32bb1a83b90f7b189bdfb5a93b605
- MD5 bc98d3d23b5fd65f5eb34c359bff9c90
- SHA1 a0a9090814e6a74e7c024032d5674c9fba327338
- SHA512 46aa03e28bf52c30d6266208de8b28df702c7570f6c09226923cdd3ed4ff5c9542d23e72f6411645960c172b046f3291b2ac79eddf77e735322f398718e6e47c
- SSDEEP 3072:LXKTANG+G2pncyyRcbx2NX5y2IhaTUjtUZTJuTvvX6wItvN4FxoIzyPyKyJk:YAN1Zz3S
- TLSH T1C714102426E4571AF5BB8F34DDF35B552636F0D1AA80D38F105D02BC0972B6ACE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\CertificateRevocation\10693\crl-set
- Size 1.5MB
- SHA256 4c8e6315b4c3a923c0600684ca0c890849a7c5f2cfbf0ded2333a724af7958c1
- MD5 554ad8d04d024af51e49c29e38e26a08
- SHA1 9f85b039b15e15b996c6d565d1cec00de4e2e67a
- SHA512 c2f00049591cb882c27ba996c2c69515b62424f094026eda3c2da26fef4b984774da67193ab0857dd96aa63b99ee3d3af61a4278fdf388acb14050a34f78b43f
- SSDEEP 24576:wTONFC3s/54O4uO4nbmiIpM5WUK320eJtOzYbR36xSQasilQBcgV3:BXR4O4pqgG5WUK32dEzYbR3QSQajmH
- TLSH T1AA7533BB567C2718DF5B36DD008AC1631F36DCE28627A8EE1A91036F0A531D1EAD1879
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 7cc3a6f11e21e1bfbf2802ef5571a2032cffbaa37c6d6d15d0f649631cd05109
- MD5 834e75d224b19d53be6cdfceef3f3a63
- SHA1 161c25a1f743a8c89468546ea1bbb2eda1a4df55
- SHA512 cbe80ee50d3548a21f352f922363f7242ad8cbf3ce18cb6fe014953c41927dd175a0a101052756ba1f44ba4529e437b5dc1209f8729ef564534926a3caff7440
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\0dc270ef-f547-4b7b-9dc8-f497be6afbe6.tmp
- Size 165KB
- SHA256 758b1c4881e371168047e53d2219d5262ecb96c6f0f26f2a83a553fe9cdb060a
- MD5 0d61959956bffda7a8384cb7ce68d6bd
- SHA1 cc70aa6fc4a12b762b7884610a28e03c221ab9ee
- SHA512 51754f0a0cb23be0982b8578f9ddbed0544506fbadff97e59878873f93d78634c7da60d954c8f1cb717c9e4f35a613b7b455914eb468f05b9aa55d3daa6c544e
- SSDEEP 1536:gwNyTwB6zqWP13FRMsBFX1jkVXvEgBeeDyGfj2kqwus3KC5RxF:j/O9t1oVXvrTus3KCj
- TLSH T191F35155215054DED2035734CB2DE867BB76AEE92D36B9036F60BEE6BA7B1C0BC401C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\92ce5ef6-daa1-4c2b-933f-6b1216447a85.tmp
- Size 3KB
- SHA256 7a989fe8abc16510cd941b141b8dc91b7a7ec87ce1047d53c8e2ab50b27bb5da
- MD5 cf01dc0348960ec9a09d5e6246cc8302
- SHA1 9479d6b022934548772bb2366584dc6158785c43
- SHA512 a351c50e7113597ba85fc0328eba47379d3d3e3fee5aa499a256d6516f0a901f84120a6f949a868c931f2cbd15a4de5bb4721d3f7eed89a782a449cfb0f79700
- TLSH T14E71612DC0A55DA30DB2B7A9BC390781FA61467B12404C0E7E7F028D0FBBA778084F19
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_1
- Size 264KB
- SHA256 b24a282bdd0acc816869ec5195ff16d658e6d2e0168620ee22bfe7cd65c5edd0
- MD5 c4290d9c820c3cade56b85459d37ccd9
- SHA1 f8181850412d1e79aa0c446bce568b7082c5489b
- SHA512 015fa732cdd0b4f8be81fe2bc0e3bdfca252d6dd6c7e31441619d9ef1fa4693a5c6cfd2b420e6a8159a85250f611a2622ed56fd95895d01087e295e5d4833d98
- SSDEEP 3:MsEllllk9/YtlGallVlvmHSt/lbTVh9R0y13R0y13R0Mq2b0kVAaHsS7oLHX//:/M/PXGuzluHGpZO4e4eMqy0UA9SS3//
- TLSH T159448CFFAB804389DB200EF60103A51C84339019ACC34FD6F52025B7B8D0FAB8A64E1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 6cd0d0d884d6c88fe46a6fad87d3bf4bf2d9f396de2182cd1998c0a6a1fcfa29
- MD5 18be33c968e1b3d9e65e3c9ff689bbd1
- SHA1 8a0ce158c2d7ca8da1acd311bf2843a4b45a2856
- SHA512 49dd2ea5cd4f0bd72794ef034c4f82f4d777251310f253c32096f1e5cbd9ac5d2360f58676caccfd158d99589b8d026d78c8634f2928bbfa29a7c7c8ad6088e4
- TLSH T181412DA8FA1D0835CB1A597EEFC9700070FE41472613ACC844CCBCBA6236B80A334E83
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\3ac2de50-fc85-4ab1-bc9d-831dd2c51b94.tmp
- Size 354B
- SHA256 9f668b16d6991ca4cead0fc70ae5ecf5165c771bb8ee969646f8cfc78fd47756
- MD5 17f7883ced63c34e349b2eafd5eb0aaa
- SHA1 c002b9063980e6b0bc9ce5f4f4a9b22820de4323
- SHA512 73c1aed96bd417af5ae073eb27d51a622c699b22ccc741af8a8ccecfb6c7c847261c3dede90b0c09d50099a64670a6e36389128e325c1df1edc50c41093b1365
- TLSH T119E0C0A3C2F499BD4A1143F05714690BCE7D0500C31C7D29C5E4BF1B53E1468950080F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 04cfc703d1a4f2380d2f7cb15d78163af85908b34415d8e3c27a6b5d1deb02b5
- MD5 13bd1b3ee0aec1e1f8f73ba8594575a0
- SHA1 5b32ab587fa9e284c95ab02fb13710be697833d0
- SHA512 816f8a0731ca597414223959fd6e98d13b7664bd8aac903a5c6125eb3a0e77fe000359fbc45422a716109c20bee5133d1760ae69a4318e092a279bfb622d4532
- TLSH T154415BF3C7F9561E886212F09729B92ACE6D0918C3183D29C8E4BF4BA3D1471E200B4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
- Size 17KB
- SHA256 4cac909eeb2bf5f3d453d46d0a89f071d1de0c023e7ab2bc300e0f3d2d57003e
- MD5 2e7fbd780d355c28b46725440063ebcd
- SHA1 a76facc1f9c881c8741c13809262fc163dd53baa
- SHA512 91ed11255499d93b3a3376053ede19ec85ca740963e315c84a2d7b28970d0192dd27c3dfa66dafe4e88aeba68d8938fbfe4c78c0475bb4fc49332b7ba3e982ca
- SSDEEP 384:zwrHERa0OaaEJrUHERa0taaER3SelX1XW0lTd1:8ER4aaEJaERnaaERCelFXlN
- TLSH T1FD72401864A86F3B8FD6598CF7763F11EDA531049481B885E5B43EBC4BEACF4221B427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences
- Size 19KB
- SHA256 b2e7e04e97dbaf16b110cf3c30328d4b32eee380568350c8c416d55cccf6d9de
- MD5 dbdc2b8d1d3a4f2fe8b455add6c01495
- SHA1 5751b7f0708399a3698ee1e178de8cfb91cfd9e3
- SHA512 05704514abc18efc357ce655d36efebb7ab34efb507ca5a0d0882f7dbf09783a58e01d466740d160c7ec4c3aefe294ec0e8da9b825b89ff23c6d31ac90ba7670
- SSDEEP 384:zwrHERa0WaaENrUHERa0taaER3Sel1FXW0lTJenfJ9aUg:8ERgaaENaERnaaERCel3Xlb2faz
- TLSH T1E792722964686F3B8FD6598CF6723F51EEA5310494807885E5F43EAC4BDACF8221F427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Secure Preferences
- Size 10KB
- SHA256 dac9aa37418cfa9d09dc0ec9fcbea6434b39b900a154ecf90c37df3cdb978876
- MD5 b0183c4411811ab15ed7f91812aeafce
- SHA1 7bb0bd44cb4040925532b8d59935c94c2079c492
- SHA512 2a25fe568d284c24e086d23f9fe802a2bb526fe4062c736b3e201fa912ed51f248d5745bce12881557e459c148595568cc8fcca425441828672a876d5b61a009
- SSDEEP 192:jhLXZ9jrbCgnLjzd6RMhrgct4rbhajt0sgcs2Gx6PTJHInaUOsLRMUJuixjzzgss:tLX3jrbCgnLjx3h/BTg0bJ2aVrUJhq
- TLSH T122224CB2AC1DCE7B0F56F6ECFD27B683CD990B1887544D0866E6954C03D5FA5220A293
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\f60bced9-9c0c-4c1a-8327-903c3a1655bd.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\FileTypePolicies\145.0.7584.0\download_file_types.pb
- Size 7KB
- SHA256 a1391aa8d42be124bd50c493886fe7b3a709059ee20b0e012b421390f4a3864e
- MD5 7dc81804b51ea4b37bd595b44c7e087c
- SHA1 88fa328e93247b5d8d8aaca3d83bd8a803bf1c28
- SHA512 8028fda2f5fcf3b7b23d09bb0a35f6e885417b10bf4512aac1d109d4ab355804c9f092f765c3017b87d120c7d00d4dbe8e628ccc8b15b807089e2b9b1b741f3a
- SSDEEP 192:e0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmifL1YbAnz1BRsO1v:e0aEW8SsWk/pvtHB3Nf5YKk6QKEa4pmu
- TLSH T1E7F1E9C5893A19E83C31D391F1B9C120CD15EDAB9C6F248E8BB3529B7BC1D868E27157
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
- Size 15KB
- SHA256 2aeee37b52744ae4f3f3f6b4b508bf05ba1a8ad1a340cb55f9e0477e4aface01
- MD5 c02b5b25a46b9177e905493d58bb7030
- SHA1 f0252d08d45dce9533c15fad3a127ea7b6b5fac5
- SHA512 bb08efa51a6aa64f4427a367285f6580753227403af4af5752e51baa8cd49578a3ea8f5a4e654a6107bd73d19f733329da075531e0d28388bfa8fb16e63db957
- SSDEEP 384:clOtUT1LbEeb0+aq4Q/Ct4+yCwB50YGcer5LxSC9nO0:clIUW+aq4Q/0/wBKce1LxSC9nV
- TLSH T122729F7E68B7CE3289F7C0C47A173B56AFB5218AA1904EE0D9F19D0C09EB5ED1202D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
- Size 55KB
- SHA256 f826124f69210932bdabf01ddff44fe4b2fa7ceff5158921dca8140402cc91c5
- MD5 f6deb36dbfbcbd1267a3cbcaf140af93
- SHA1 709390f6ad891abaf2b5ee96ba51d51907308da4
- SHA512 6ee7e396d5326c2f55d8d2ee5cc0a2aa86d6913f2ce055f428eb65e042930e9a72519d0ad5e37ab663ebdb1e2558fcdcef1d53c489051c82451e75dc1356d50f
- SSDEEP 1536:BAwjii7Z7VlbAE3r2HQXchkAIY5BmvKJ0R2HBrCWvz:fGiVH2wXchkWN0wz
- TLSH T12543D026645B5EFB8AEE8A9FF51E3AD69B7C7082A04D51D4C8C6DD0D24DAC4D2303823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
- Size 55KB
- SHA256 ca8973b1d8a3e8b1dd323cf8151303921fa9d8c2020fa8498eee0c28615866fd
- MD5 1b0296452319fd21820415a210dc1eff
- SHA1 55d3f9463809bc98475eea5d31db525927e32b0f
- SHA512 8bd4bed1555f9649cb13d53c60797fc7580e2ead08763993c7fa8c20aa5840a8edc01e4f9de7262215f2a32f1f89c5d99af124e96338bc0bd628c3d81f7eeee5
- SSDEEP 1536:BAojii7Z7VlbAE3r2HQXchkAIY5BBvKJ0R2HBrCWvz:9GiVH2wXchkWU0wz
- TLSH T14D43D022549B5EFB8AEE8E9FB51E3ADA9B7C7482A04D51D4C8C7DD0D14DAC4D2343823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
- Size 66KB
- SHA256 0300270633a6b4805b43e1fcd723f06363abca785277598161df2ddf368465db
- MD5 4a175dd38eab8d7d62f085340ad94662
- SHA1 6206efccb64a124bf20a928238dfc2844df028e1
- SHA512 49ba6ea587438f2c09212e1d8c5b22046fcdaf95ae5fac7ebd5159b914891b43bed94b1768e4736335d5145ea6565bf8c2265156cd3b335f9d41e190bf18d334
- SSDEEP 1536:BABjii7Z7VlbAE3r2HQXchkAIY5BkMficXxeLKJ0R2HBrCWvz:YGiVH2wXchkW8M6cXxx0wz
- TLSH T13363DF36A88B8ABB8AEE8A9AF51E3AD65F7C7143504C51D5C8C6DD0D18DBD4D3243823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State
- Size 53KB
- SHA256 0db5b0a5001ac5ef725707efd9f375f95958de0ae791089363d3065699b5d880
- MD5 3405374a7289adfea4e6a6e18c0f0656
- SHA1 156b08fd65a7e9513086ee8836a9df552b18d4c5
- SHA512 908478eeefaf9a1a56242f660791d02e21f270d7837f5a306ad3f4433d021783001de385b8ede4b3d9018767276071dcfec09b47257c1c1ce17c33b3a2cd59ca
- SSDEEP 1536:2Ajii7Z7VlbAE3r2HQXchkAIY5BBvKJ0R2HBrCWvz:xGiVH2wXchkWU0wz
- TLSH T19033E136549B6EFB4AEE8ADFB51E3ADA9BBC7481A05D51D4C8C6DD0D14DAC4C2303823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\P3AConfig\1.0.5\p3a_manifest.json
- Size 437B
- SHA256 9f5f196db1a077339eb8c5eaec285bbf2d8645ff890985a808b3208ef5cb5ccf
- MD5 aeadb8443ee0d094f57d9e63030d70da
- SHA1 fe59c3e510a6791f8c01102997c9b5fdc9d519ff
- SHA512 a25e8af16c6ea2e1a4ec617ceea1fd117dbd2459c7262a564dd4a304e58271929334a7732442ee9099371c037adfcf534683abed039fcbb0c5456e274880868b
- TLSH T17FE0DC16190E4EF39EE6012190AA19035CBC042284C43CA451DDD76EC1CDDCD302221F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei\1.0.474\list.txt
- Size 263KB
- SHA256 f5b89c2b025e874a12f0c6208267c10c462171e178093921b9d0047a2ae16ef4
- MD5 9e3b67cac58a520c9cc8eccb793ac8a5
- SHA1 0c43adc1561eabea8f18df897e77cb13097214d4
- SHA512 13e90d5d4ac42caab38f0d5381f9a31bb07537e2858cc70e6d2b70660032272b57322a6e20b9024d8c56b80e2651060250090a9787e9d5ee10f3193ad65e2e73
- SSDEEP 6144:jjLFHsdlLuRjBJubhXfCs7mn8GynCVwYSUx0fPbEgf9htbv7K:jjLFHs3LuRjbuby+ZFUx0fPbEgf9htbG
- TLSH T1144427279D14262662F6007E38B8A94B5A20A3118167FED69FFB910C7FC65C671F12FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1499\1\clean-urls-permissions.json
- Size 333B
- SHA256 ae19d4b67e3268d5739e35d0aade25c9a1389493a3d9d4f01234ff437350ba6b
- MD5 88d440eac242a3353ff8d9e17391832f
- SHA1 0715c58d4f3cc7ea985e4ead4d169337e0011cd8
- SHA512 0fbe6ac8bc56fa6d33525e7b2cf151d5cb16205a0a21acab53de2425be0b090bab10babd175f7839a5926ec3427a5f221bcd9026b0b6fe17fdc660dd24f943c1
- TLSH T191E02D5ACBD89F9549418C9A6015A2D97616520BBCC6B9D1F71D407E8F0C8AB386D148
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1499\1\clean-urls.json
- Size 29KB
- SHA256 b464f77d0ebd5d67633ed264611374babf4fa55c08313a09f5356381e76c9c11
- MD5 f5b59fdb6c1c4bdb0b763038710c0fb3
- SHA1 99438546e4b31d8d9e1a9a808512d5017e7094cd
- SHA512 e7fe71d9ea6303565cd861ea5baf863eecb888d4bc7cc12e3bf22ee0e1b5e12ac60316c8821622b961ad64176c3f75a8f75887af4f5c926d0c09ab23d2684ef7
- SSDEEP 768:uu4PIS9VRE7E1dMQMG1LekIUnIDYpTKdK7sot1F1P/mJ:uu4PIS9VRE7E1dMQMG1LekIUnIDo+dKK
- TLSH T1A7D2BE8AF6DD8F4714A8C9256869D2C427224187FC987D84BB8C847E1F9CDEF247A1DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1499\1\debounce.json
- Size 12KB
- SHA256 e5924b59ce1a3c3fec47e8dd9f9a6e38a43c8f05a8777767069085716c670dc4
- MD5 f5f131cc0d986d599b3a2becd1b47b76
- SHA1 57676d4b7a913542aa9a2a84fdc8ba0553343083
- SHA512 174dacf497a1d5b59c3d544ec7f7667a44da84f1aee4669b97d76f93205ca82ef0f89be491fba80b0851430bf4baa9290a8e0cb19add5c332fb67112fbcdc6c0
- SSDEEP 192:yL+yWAeNl3L+089MDKyr2GDxjg9BqLFYTADsOsGDq+Fk6IlsG8LqV6h8WVWXMsE:KQck7JiBE
- TLSH T1B442CE10D2ED1F261408C6756C2A94C1B6251087BCA8BD98F74D91BD9FAD8FF367E2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1499\1\https-upgrade-exceptions-list.txt
- Size 1KB
- SHA256 ec12bca633a18d9d3aed6d3e54a7da678f3d70e84e9bedd911e968fa912ad58c
- MD5 f59fb819a1c0e976593a7aa28409df16
- SHA1 5ceb0b7583a8e1023b5bf628582e240b1694cba8
- SHA512 e7713d2ba0872e5c18fdfcbe94796351ca82fea84eab63480a609b6fa6b91e0600478e60ec30efcfd38cd5b7651192da908c8eead2896dff0d72e9d214dbf769
- TLSH T15431B7975D207760D77A047DF84C2AACE426E7108035FCEDBE6974D042CA78D326BA79
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1499\1\webcompat-exceptions.json
- Size 4KB
- SHA256 8eb6d20e4185ccbcdd162258aade6be5d10640c1d67aa62daac06f70e82a8d1b
- MD5 04d50f7003bf1d6b526702b58cdb5ae3
- SHA1 fb681021b4b2cff8fa30874dd7ac612dd3a29971
- SHA512 6db38e1dbe3df9795a81c9b738a035aab3a28758a6a1c2f1ddb611e9a020942e5ed1056a13895b9cf013130b08708b016d06e32308653f83b390cfd506bd64c2
- SSDEEP 48:lE2Kw3E0uE0rE24VE0wE2iEE3YHAE2JOE2YE2/El/nYEkO8El/7/EsTZqE6TUELm:+j6cTQVO
- TLSH T13E91964BC5ED4F825C48D534BCAA99C07222114BDDD5BE82F42C107D6FEC8EB25AB798
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.24\photo.json
- Size 10KB
- SHA256 9076682324d3dae2c496ad99ee334b53ca1f44570332793a3142372f773941fb
- MD5 f0c6a1dedf4e6ee7c0622a60a64b06c4
- SHA1 0004a08779c9e0cfd78e1c2b05fbe650a4b5b4f6
- SHA512 f38049cc72106d6b52d4fe4f771aedbc8aae11c6bfab6663edb8680cdcfe78cee933692316d201b9f54eebe4d51dc81355b922d150b3f66948eb6489c5a1470a
- SSDEEP 192:9I22/epqd0Ht6G1Xgt2EWBUGKCapET0V+K5b1W+yJoY5/cCTTry7nzKC7gLf:9I22Sqd0HtF1XgQEWBLvamAV+Yb1W+yz
- TLSH T19422DECE9ED529AA4F8046E1868FB99FF49C0509D4E75C46BD70828C00F931B9F58F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb\1.0.16874\list.txt
- Size 48KB
- SHA256 3ceb6f097d7a56fccd2414e85a3e375e7d23f89e5f63ee654bc0040582a73f56
- MD5 4c705c368370775482415a8bf4c6d7b4
- SHA1 d447915ba3204186c4ca5433d1950cda92f52555
- SHA512 3dfb4b37dd4780069d93600aa4e6801f5a71bef82672ea67090f4c5f3cb457d330292c57435b00b7ef412faae39e210d953918d00ae26ec58931c6a751120e55
- SSDEEP 768:N9OnFrR5mcWN0Bg2o0W6EfvWNRBanJ/wB49Tl3ksF4WfetzOxgRw//qbnPrFI4k:SV60s0PUJo29e6wwia
- TLSH T1AA23E507FD510A32468AC25E387979AEDD307B19C11FFCE25EB701391FA598520BA4FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\bgifagoclclhhoflocdefiklgodpihog\1.0.62\resources.json
- Size 151B
- SHA256 d82ee302e1bae15a93f8ca5a04fb57943b4596d7d21fb47f0f50ca16be26dcff
- MD5 ad0d90ea44a599ed9c46598c5b970897
- SHA1 aea60798a90c0622c6724f80181280664614dd9d
- SHA512 5ef602e5e45607549ac1633639909015fd8e2b76844d64cec4132a0920afac35c3c4b6e073fce51e3b195cf989c5ab13c76d081a381a4cd8eea41e4ce57838d5
- TLSH T11DC02B0F2A097BF09720530210A8B91E83D082C1446B89BCC398C4CC0117DE460D3C02
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe\1.0.19892\list.txt
- Size 1.5MB
- SHA256 1155f138995cfb92a60f709be64280ae66ef75c8f0ec9a54b4ef4f7317a5d3bd
- MD5 33f27612a88a7e192c860cdfd7088f4f
- SHA1 73f9a3124a915b0f054bdf1129160f1ed6c47acc
- SHA512 e577325524b71998678623e8bb0ddc9a856f97e211a4c366e25a5608aca83029375a7ca7e232669cf9b42ff63ae16918fe82e83355046d9bda9b5af400cb0f92
- SSDEEP 49152:CwsJUwe78gHlNC3d0/kA3Qq1a1JSgi+impl:CwsGliqM
- TLSH T16575D70E7C2E153D07DA51AD68A73F0A7E1056119197ECFD866A32383F91A931CF932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cemdlagocoimleflkfkjoihojfainiho\1.0.113\manifest.json
- Size 504B
- SHA256 cbbfc823da68ea0f426b8ad29af54b52091f028f774a84af6ace7d060d6f5773
- MD5 c8948ca33c7b4776c3f2bb8c099b378f
- SHA1 0d019b33da860f94412098fc7369c0bfd19846a4
- SHA512 fa67a5a3489b11cb5559091805002fa602f72854bc3e83ca565fa602dac8518b85f5a914c58aa81807a537679b117003d6031a24277c4076207903f35ddcac65
- TLSH T16BF0548405CB9CAD33957B24F9F54B33A17C01C85126D020062D40A4B477FECE1E0133
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cemdlagocoimleflkfkjoihojfainiho\1.0.113\query-filter.json
- Size 2KB
- SHA256 c7b7d0292dd5c1e0f00f7ff27d52621ae07f8dc6e76fc2fe8cebb4b92d614a0d
- MD5 8ee9ff64f6fb98c43861fd5767fd81c7
- SHA1 e92e2404633d88256356be0d5420a08f353d957d
- SHA512 08e1acab900ea5adeab96fa7e04801a4ba8d48c8977ab5f45be596fdf9ffbfcb43104bd023fc54f8f3af1b1ec650ad7448f94480db0a643b7306f90ea8ef118b
- TLSH T1CB412D06C6AE0E9104B8D1666C8DC18032544047AD907D48BB5C0DEECF6CF7F15BB36E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cmdlemldhabgmejfognbhdejendfeikd\1.0.110\resources.json
- Size 151B
- SHA256 c8bd3316903d4bef02c7dd68513b83e7efd1ba41ec71d12610778c0c211d5200
- MD5 6f46347eb8bdb2e9ec9af83579d18bec
- SHA1 086aecd9cc674899ea16ce62a75db54c18c98dc9
- SHA512 3fa1301024dc5f7931d984f8344869152e76f985d5660940c63a60068e33533282d62ce9f1d568d600af2fccadd71e89e3f8ea184718f19dd616ba54572587db
- TLSH T172C02BCF790C3EF2D37413055684F20B876041C2042B809CC39C438802391EC20F3E23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
- Size 11KB
- SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
- MD5 e4037bd1ac0223417fb686339e377e9a
- SHA1 2c1acaf29a7af097c36036bf967204e8e30ef7d9
- SHA512 1f72d211d61a0c5aaa976dae7d1f6268d792af0cd78e94c3630147fd7aae8c8c9b58fb5cbd2593e6707ea9b5c2247c4a5cc936de581924d0c4ddd16815a37b70
- SSDEEP 192:O7jf6mUD50aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmifL1YbAnz1BRsO1mwkSVU3dz:O+50aEW8SsWk/pvtHB3Nf5YKk6QKEa4m
- TLSH T17732B7C1993A15E9BC31C3A0F1B9C1218D16EEAB9C5F148E4BF3429B7BC1D868E27157
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
- Size 3KB
- SHA256 2ba4512806ea8eaa1a1363942a23e30b9c942665549c61f90e089ec4ce1aefa4
- MD5 46d4aa097519abdf9f9cb2251b34a8dd
- SHA1 d1cd1f43d9191d13b5fbdbf6b1d279aa1afb56a6
- SHA512 ec2e55b1475e323c1b3b9f277e2349b7ce34782572b16ed9393e071d1d961e863a5caec55c6e66820babffbf716985a11e2397ba9586880a2e80cdca98594011
- TLSH T161817EDC6A1F7453F80B69F8F231603BA300ED1F4F90D67A0D62501868D8F955F55249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
- Size 16.9MB
- SHA256 33fa8d15806becd8c0926fb455ccb4b63942a7b41df8b0c0fded8acc97f3ef5f
- MD5 162a611c20214ab10bcdc0b1f838c007
- SHA1 b84ca442768ded82d2e8edc9332c75bb2cc491d6
- SHA512 864da767e34967553015df2588fce973ca0e0ff12ba32217f9b18c2f9c090ace78d218c370838853a7d7437295ce44e15783d5d66b32a6c9661da98ce35540c0
- SSDEEP 393216:05olp3Khjb2raQ2SBxfpgPBzDmjo0Y2VIciE:blp3i4aLSffKzDm9LIcl
- TLSH T10807331D3F897C72ED7F23F281D75719B8254A2712C6FBC729858B25E0589C82CAD788
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\34165ce7e02bc3cb2e3038de3d59de0d49db4458a649e4d03f83ec064b61d9e2
- Size 178KB
- SHA256 34165ce7e02bc3cb2e3038de3d59de0d49db4458a649e4d03f83ec064b61d9e2
- MD5 b44d620bbc90b484b577fadececddd2b
- SHA1 26cf8c67d04265329bb200717902d63430e44fbd
- SHA512 65b4a783da64ae674471cec981468282916e18988ea8c9db23143619c296cebd9deb84f23eadf92f435d0521d2f19efaaf53ca283691d4922bbe7f72d888545d
- SSDEEP 3072:o1mqo7rFSMG1rN+oTd6FP5gGCqdbAY0G4TlqycRubcVVYYgQxraIjM8:Lq8IMG1rwo0P5rZdsTxcQbqVYYgQhb
- TLSH T16E04125A28195815FCCF2836A1F18E78E97B2F97F8483C2C2549A6B2FD0F6895CC4671
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\619d31454cb82f8f7de80910d3151acd19e9af79dd95fa0ad20537ffc8e77a40
- Size 3.0MB
- SHA256 619d31454cb82f8f7de80910d3151acd19e9af79dd95fa0ad20537ffc8e77a40
- MD5 24bbef8be9597d93c2d4670aa034d43d
- SHA1 168ccff5d622a16525a2332f1dac26584bb51822
- SHA512 03b8920cef777b2d2989d302a4e82869af9b1d8d07dbdf636f8a73173b8d456e7e1761549cae83d288f47408009d69dbbf990192cb13befa548c15712aa6cea9
- SSDEEP 98304:e/Jzu+sTxVKp57eJfUI7DwyyNvVQlFEEMi:0Jzu+sDKb7eJfUIN/ELi
- TLSH T115E533DEC8B1FFE3CDD5D370968B2F63305B272401DF9281F968A5222282E43588596B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\69c82bc03ad463df73f0adf15796a08b918b23d3a52e49199b654c2db9050df4
- Size 12KB
- SHA256 69c82bc03ad463df73f0adf15796a08b918b23d3a52e49199b654c2db9050df4
- MD5 663fbc8d6573805e57df83042273479b
- SHA1 e392b7f34651c9f5d64d6521b266fb31037bce78
- SHA512 eec207db12417bc843d07ef26515e431e1463d62ef4e02ec7d3a1ffe4806adcaa562a5dd134bdde0b684a23b5378bbc5e4fc5114df95544d185a48d44860be97
- SSDEEP 192:Nt80rIDXCzLLyHYR5AuNuOAbI7lIECYNArevAGzjQdeLbm1GS+wSG4QodKV59q:nrny4R5AVOjpCYKy4GPQde+1gnoV58
- TLSH T1A042BFDA878063B2E02ED6BE1089B21FCB849F64B78B454BA9271C9B6D353208FC5074
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\6d7a4a96e2b56ce8f264b28b2d5027e4afd565f798cce03571545ba60fe600f7
- Size 1.5MB
- SHA256 6d7a4a96e2b56ce8f264b28b2d5027e4afd565f798cce03571545ba60fe600f7
- MD5 b094e284d8920bef3420aa26d7521332
- SHA1 2d33c88ad8c432248a3bef86f50830cc17d89766
- SHA512 3e0da0da12716b4e53849d201da40dc27d3b33a6278ee24b58b5db26907a5fd232a8c00804df022c0c856676ad5450bbd0a87a42dba688c44b3a9f60ea977b09
- SSDEEP 24576:CTONFC3s/54O4uO4nbmiIpM5WUK320eJtOzYbR36xSQasilQBcgVN:bXR4O4pqgG5WUK32dEzYbR3QSQajm9
- TLSH T1297533AB666C3718DB5B36ED008AC1631F36DCE28637A4AF1991036F0A531D1FAD147A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
- Size 264KB
- SHA256 72c4905c214e35ebb76e8cdd0eff88c3f699256d85613aa31684423c72d84a40
- MD5 fe6467e75cb93cb3459bfb59cb87fb1c
- SHA1 1e16fa34382d0684331a8b2ccf267994d55607dd
- SHA512 e90b915b3dd7770604f91cf6a1b5c9f8bc594213b72ec530975d04833adc3924835eb054012261c69556afe0cd9f4a4def28e7fc5415d6a100104b49657b88a3
- SSDEEP 6144:f7OHhdtMdN5sh1T1+K0uDza28wrsIZjpA2Lrk/tXEhI9YHViB127Ynx5q:a1MD5sLYKzna28wjjpBUVXEhIgVK6gq
- TLSH T1204423B8CC47647ED92D3E36302519A770E874892B61CA97A1F3BC23BB4D6FE48185D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\752d722a65dbd61ed2dbc07703f6c5b0b565ec7b5d333a59b78191406941a41a
- Size 3.0MB
- SHA256 752d722a65dbd61ed2dbc07703f6c5b0b565ec7b5d333a59b78191406941a41a
- MD5 d74947de20142854746f31420c9bcedd
- SHA1 8808c763648d37851f4557f43882e4c5d9c46323
- SHA512 89151e6988ac3334ade3dc57378905b401c783881e64c564dc303ca366882ce3e6b5ddbb56acf2503a037d8871d964d85eeba18021f79e6d03902ba6f5fd9a53
- SSDEEP 98304:I/Jzu+sTxVqp57eJfUI7DwyyNvVQlFEEMr:KJzu+sDqb7eJfUIN/ELr
- TLSH T1E2E533DEC8B1FFE3CDD5D370968B2F73305B272501DF9281F968A9212282E43589596B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
- Size 7KB
- SHA256 7eb099993dd4489cdc6a350a73065d8f0a532e8030266b536e3c97e12e6cdddf
- MD5 7560d840d67c71f4341f6feaa2572f20
- SHA1 0ef6bae1a678f488b145e940acb1f74f40145d52
- SHA512 23e6ddf521b6fc234025f80b9b524ea31734dc05b6932e408c2bfb511ae8e72a8de0ff87f5d79ab89c159695f7c43e8196a0627a62333d8f7531d06f86450403
- SSDEEP 192:NR9TC7sNjOYYCiZgPldeoKMFTekPlcNlJTV/jklqJalMv:79ePCiZgPeOY2yjP/z7
- TLSH T1F0F19F8078B029B1DF65C0B72C6505507701BAF56B998CB2B8CB146FCA2CFF85D98C57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\8500527438f6697cff37f283193ae137b837c9b360d52bc7ea64d97abc88f605
- Size 5KB
- SHA256 8500527438f6697cff37f283193ae137b837c9b360d52bc7ea64d97abc88f605
- MD5 9ee84e485860d46b17bddf90e377ebff
- SHA1 ab42536efc4bfad53d5dfaa5e361e15ab855c6f9
- SHA512 bed1cf666359400f519806f817278140c17f6a05be53d441dec0c6e878b0924901277b035a540d83d13b6965187c4ced183e75709dff10c0c20e8da61e2ba7fe
- SSDEEP 96:N98PDv5I8rWKG6nB+I92pJ4MMqnw0qvxKRSs7/oMCJAi2Tgd7ceHi:NaDBCKG3IY6aw0Ex8Ss7/oMiADgJJi
- TLSH T1C7B17E2C8C5A59A0E47B15FCA0990436C564FA565E5F50230A0A329CFC4D3F00F97728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\8ea6b448d3d3e9daf22e4d3982d8dc129e2b821ad20340cf2dce3f5570183d69
- Size 475KB
- SHA256 8ea6b448d3d3e9daf22e4d3982d8dc129e2b821ad20340cf2dce3f5570183d69
- MD5 7febd1a4cd98b285bb98b384b4bc0421
- SHA1 b7d41e290793299bb1fc3cb589a86b27665cdcc4
- SHA512 2d66dfcbb417ba98566ab7cf7dcf907bfdd8528aa7b1226737019b1bb0b74c96b734457e21a078bbf4bc75f50b46d4774cb22fb6f62d9930e7a7ae3a3b3bbcb0
- SSDEEP 12288:b8PRqkNxE6vGP45id9z/JrZvXyQ9n8rgqFHiAAQQ:oBLEa+2idRRr1yPrg8QP
- TLSH T12CA42339BA2A09C6F2E3A63FD5E3125A6C7111F293C24E5ABCE651BB2D0CB414D13C75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
- Size 3KB
- SHA256 925faa0d68a91520e4762217f7addb7746c23f33ba83abd1739b5ec1c84dd520
- MD5 d1e639b4447e689dd9c2743869fabfa6
- SHA1 7ef434143975421b41cfe06ddae5d85d32cc560f
- SHA512 e035ac78dd7035715f9114c20f206dbf6c1b5f95f413ab51ff76bf98dfe674c3c9b036972d0f2208bd8acfabea29db04f154dc439a09af9b66f8a3f1dc289788
- TLSH T1D1815D2C8E067162EF169A7872F6E11BB310CFFA8C17A117081324B748C47F5934125D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
- Size 88KB
- SHA256 99fa709e9f36ed8d826afeef1778ee8d770e231e565114e85677718bf99979c9
- MD5 deac0428775acc62a769c1b48129963b
- SHA1 5a1fa0a27792a7765749160a123baa8381bebbaa
- SHA512 927a4af724af1af42ada0e6ee68b5374a3447e236f7038c9dce77ee22a890c69470496d0426df5d8ea2e34701881cf23e871f4cb9656adf872b888e172c1b84d
- SSDEEP 1536:BIGsJy8IX9P6yxEw15nd+75G27i+JVuG1qe6e3Z1HEvKNfCoybfJ/q:BuJY7+w15d+p/d1qepNBwJ/q
- TLSH T13393028D8222AE1BD15C6230BCD4C45B7B5AC9CE96FED7930FC245E498DD4C8657E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\9cad77bfd7ae8d0fe404e6c974c1c98771ed76a7ea47d86d3187c5bc73592725
- Size 6KB
- SHA256 9cad77bfd7ae8d0fe404e6c974c1c98771ed76a7ea47d86d3187c5bc73592725
- MD5 51fa10cebf5cf1fda36a185a7a109801
- SHA1 2f2d12e4a6da3ef50173ad811737b3412a200acf
- SHA512 08e98c8af0ca4eb2dd025b90eaeb7674a633022f9d01b3a2f7c1a8730a78d98c3859f63a8e6fd1bc295143c72269882232fbf37bc0d0b483eaf5fc2b1fba4032
- SSDEEP 192:NK7iCn/l/YTmepkO4r2h0IUXAtz9fUGvB8zw:o7lgTBN0AXc+9
- TLSH T1C1D1AEC819462358F474E57C7A923F724766AF206D02E0EF2A125102ACFA7E12FF4927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\acb05be22407fc4915b7412e4b9648f156e47b57203cd5ebc5deb7a2d65ef8ef
- Size 479KB
- SHA256 acb05be22407fc4915b7412e4b9648f156e47b57203cd5ebc5deb7a2d65ef8ef
- MD5 b315bc4ebbf6a24bb61840b1d0c83abb
- SHA1 463bcd9f56d96143ef84baf5a2c00f12cb635193
- SHA512 9f174dee0123ed04068b24104f820ed7aa1e3f96ce7718f0ea17122586fbbb53eb550e961c05318c1c11666a51f802c5604be41fc4761d98d887ab0345437c59
- SSDEEP 12288:lyNzrWZuD2/THjmKVPVzlwdtajbrFobPedVyXwu7c3e0:WWZuD27jmKVBTbrFKPUsXwoc3e0
- TLSH T170A4236FDD08319DDEB98CFBE5CA1BA0ACF7E06247519856A02CB4577C11AB1384C7AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\b7b07a18-ce0c-4ddc-a263-fc83cf5677c9.tmp
- Size 1KB
- SHA256 e2fc92042ba8e9c52cf3d806e00a26164db3fbb34b05d42ebc72d0e096857920
- MD5 09314d8d19651d6df09fd11daeb10dc5
- SHA1 0131be92cf55ef292421ecdb2251e3b907f9a41a
- SHA512 f9f36e1ec3c51271f8fc8204eeff26f967c7c149572ac936e3b1ef4810410c844940abf7a1c14634decdfd5be9b87b40e4c9f5fe7bae09c219bcbd2ad0678f1f
- TLSH T1312153F0986D1BD40692BC6FAD5BB2BCC5C22A41F132703D0CD9A31957BFA89B11A43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ba5e891f2001230698fa4a4796a42b4adb4982b05cef14015807f4a3b1c16cde
- Size 1.6MB
- SHA256 ba5e891f2001230698fa4a4796a42b4adb4982b05cef14015807f4a3b1c16cde
- MD5 9c7e540c03a267495a7d333524595287
- SHA1 bcd4fad09a91c7d4515e964764a0c2b01064b5fd
- SHA512 278c0e1995c921b0832fee6cc4a5955ffdb9f4ffbbe6ad84fe10b61491e94d29dc3cbfd17c45bdedc2430158744f7eb41002c012e3d68c4f064373b52e14f358
- SSDEEP 24576:9KM0AhmJ8Qlkv3nG5HWH31VbHxSXMz937secbrLUe5rJOpyNZKZHVK:IMLh+kv3HH3DbHgXc9LseKr4m0VK
- TLSH T19C7533C67391AC0DB9E6D7153396BCA6BC472A09578CBF0F374988DD17A3292A431F81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
- Size 19KB
- SHA256 c8135ab210c4837f6827290a655bef8c8148790a6106efb33466583f228a6d4b
- MD5 1b30fac8b49251e81dbfb329f603da5f
- SHA1 2ceb0bcbc69a7625f8ac2ffe3534ecf9607c8430
- SHA512 3dc287caf862f10b4effb88f5e045cc32a65b3e31a2654e86f4df56828e413d53263198b94f0938f6609983b88796bba8b7b5dbc8227a21f9afa042b370fccd8
- SSDEEP 384:chvb95UDMKMQsIzKrWXDWE7ahKC+FQMzhYueDcOAxDzrgnF:ch551fQRKgD1ahK7Jh5J/DYnF
- TLSH T16B92C0A868AD14F7D808EF363E0365DF1B55FEC11E8BCE654087284C2CBEACA521201F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
- Size 48KB
- SHA256 ccf200ecb56ced2a4e403ddc1db70ab6deeff64d846fad60e90d226d83e686c6
- MD5 851384d5ffd965f4f455ccfd2290374c
- SHA1 81b5cc86e1132c5d0ba7b462ea41b1fe391b5b00
- SHA512 c806d96673d1a068b3b9e2253628156c5f5ef82632b497f35c7a678e6764ab124f864ad6c3bbf1f3a345876869860ebac2733bae01d2d881c4f7287428ef50c2
- SSDEEP 768:GmrPZteVCrc+R5d+RlfkJ7o1BexHM0d143Bk4wK+MwO/e4C/y7BGW:fPD4Y0qOslMw14Rk7K+jr/ydGW
- TLSH T1222301128C1CD7B6E93A7236F096B7696334251D09756D5860FACCF20EC329E93DA13E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
- Size 3KB
- SHA256 cd90570f02ef6465d8e324fb9eb3729b08100f73cdd8c521e3c819b001526877
- MD5 a310f65b0f29502c5f2e753746fc6943
- SHA1 bf42c008c987714ed99356e10425c8b1e00e3822
- SHA512 ed490ddf4cba23f83c00ddf52165a1bdfd882ba0a6a449cebdff9b6b4c88000a5c3e6024e22518ab9f7a81387ec7e7f68174363f68be9cf3f0f0ae048bf114aa
- TLSH T14D513885038423A1FE390E3C306A365B3580EFFD5D4EC1B72A2718060ECC3B82BE8212
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\fc608a02fc210508263947d934bfaf33f46cda7373e96fa0ce2fd8b83dc95ffc
- Size 3KB
- SHA256 fc608a02fc210508263947d934bfaf33f46cda7373e96fa0ce2fd8b83dc95ffc
- MD5 78dc8c8442101a73560fd0155581699b
- SHA1 1dc173bd40084b6dea50dddc2c7af44547e24289
- SHA512 aa5c1ca9f3517b6adf7d64265c6ab1cfff01eb3ba2a768fdb75a590168fe51cf7c31f0a84155bfe60935fa6f1dd6ef60c3efd1463d1f85c6a47c55f47687c299
- TLSH T11C611908375AD925F9B6E87C71A428DC0721CF5D9E1684B71ED5940F65D8BF14FB9008
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 8d5395e0a6526fcecd1257ce6ef957f42ffcf089a031e9d205af2ef548cf4563
- MD5 d321297f32d5ef6fd734205113381d9e
- SHA1 d5c5affd8bd90b0e8b5f5a9113791d3b4e74878e
- SHA512 a678ad56403bcb2d52dc49a711a969ab5952469b10036b98a3a692f6c8e5107d946e85b62d9036a1c550bf03c5170d54436708e8098b06dcdd49d1e2213a4f37
- TLSH T1E941B6F5682D27D405923DAF98ABB55CC1C63A41F531707C0888EA15077EA8DB21A87D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\d915ab4a-7235-4754-8e55-2deca777c958.tmp
- Size 10KB
- SHA256 0424766554388a690bf615cc50a956eefdd0ecc595479115b5021a198f62b397
- MD5 f09a339bc9f0c270b436e07b55c1ad5f
- SHA1 182946e71abfbd641a7b4cc96780ae2670d12246
- SHA512 84ec4bf568d5971f84ea098190665c261b544175b97348e7ddac9dcd956def0b14f674606b59446a2824652f21420e44ae67ce605bfde8c6a90fa59886ac75b3
- SSDEEP 192:c+39XODEIeUHGTtX+MDQM6KAfuO+ykl0RB521vVubxwcZEr5SwkBgl7ZIC/UM3nA:b9GJ/Ct4+yCwB50YGcer5LxSC9nOr
- TLSH T18B32AFFE15F7CF23669694843E1756296AB5228EA1E449B063E0AD014AB58FD0115D23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\dkpggglmbjhgjhachikgmohmecomjndo\1.0.0\list.txt
- Size 82B
- SHA256 cb579177e0666f82bff258cd06520a74b51377ff80a3a537cc311ac926fdad98
- MD5 226642c6446ddc48c3af06051bfebc56
- SHA1 a39486d8d17f90b8e8cdc83a1b0f4c59151acc72
- SHA512 3d4c7b2b1a8b54af179c1fc19e027e7e5c4b3020027ca5da5eb431bd863a818d9a59230acb51a42151f6f58bb0de7b08708a71103073710d34993f00736c197f
- TLSH T1F0A001C08BA088043BE5031210CAC20AE22827F20F6AFACE220005010A233E0CA3AB2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\flnkmpokemfpaajmiimmjeiandgoodgg\1.0.1831\list.txt
- Size 562KB
- SHA256 23ca7e94b75fcd34c7671c5d7efba09d31543f7b8251a16ec1a063d6ec3b1561
- MD5 7124dfe29965ab1d87fd3bcd6090237c
- SHA1 50d115a97aa74bf67a45811c0809a1edb91acc3b
- SHA512 ad52d8dfefa3bbc8071149a696b137b53e4aaee0f3080129f5adcf3b91a9fcce6e8adfdc6249214a0b11d5ca0e7a5c7d2ea0c5003215256da7db2781243d8d57
- SSDEEP 6144:ZIvyAiBqX5J4pCuLkxawDwM1XrETupIHLRNSGF0VdKCEz6GYvU+QJQaV:ZeiBqX5J4pCHawxta1WwRYvU+Q+aV
- TLSH T166C43B638D18D2AB5DF19488BA9A3145F23DE7C2E187EDEE692D410EB50805273F727C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc\1.0.95\list_catalog.json
- Size 57KB
- SHA256 c672fe16368803183106c2b638062e0e0bef0e137ec2f5de8c0e620fee5c0a3c
- MD5 c8e35519542aaf88fa0a8eafe6d5cfb8
- SHA1 64bc4847995eb9dbb69062688b86e2f806722143
- SHA512 b1f7bbfc4b07c2f29f9beccf12bf25fd5d68a236fa6001ed062cddc6d6d6760df0478c8e35020abbf84bfbf8843b2ae30c154bb83a7add5f5a58e78beb145e2c
- SSDEEP 1536:8F3qUZzg4XPwDTIzXybHgeP2wZaZArqadt09aC7ZLLr5Em8fNGydr0VkwTnJ1x0c:8F3qUZzg4XPwDUzXybHP5MZAWadt09aA
- TLSH T115430BAF86B818E90FD439C5DC9B24CBE9B410BACAC1F49FC2B4DA8C065E695C115D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo\1.0.21363\list.txt
- Size 5.0MB
- SHA256 d2171c714ca8fae552447386c464b5b1056b2814ec85072559d5690e6ca38f51
- MD5 b74fe96e47c401791d7383f6d30123a3
- SHA1 f2a56760e23068806a5b79ebef2d3c7c53058a44
- SHA512 b5f7580ae2710c4e40ee624e170c822e89aad7bb3c085aa5596e6363df9caed328e785147203dd8f4426591bc88fdedb28d03a6b0a9987541da30197e531e899
- SSDEEP 98304:rzupW5tQMTgXM4N1A7rBXwEif54uik8HPFHeR:/uSQMTgXM4N1A7rHif54uik8HPFHeR
- TLSH T194363BAB4E2516780EF15BAC2CE9F64EE33203B4D647FCDBC9B24118D91895622B747C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\jmfhneobcdckobmonkfjkbknnjjnegoh\1.0.0\list.txt
- Size 350B
- SHA256 693bfe747e6e0b253544f81ff1bcfeabe775310872497e6ba324bd2c9e7efd1f
- MD5 05c966e98b4854fa2bcd860e06495a4e
- SHA1 a11dc4ee01ba8db6c3b43d284ef8f3d849dfce60
- SHA512 301013e8d04d074577de7e2680cccf2ba7f1ce17e358f2d5dae6e3171415fb9f631d2abe4c161e25e051d82fc1d6744e8e2cd8f532fb0cff79e7e44e93523164
- TLSH T15AE0269D425C8523BEF20D64C423A099F6ED9FD05303D7C052A22279A5293B5ADDD3EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\kihnoaefogbkmblfimmibknnmkllbhlf\1.0.6942\list.txt
- Size 1.6MB
- SHA256 191a7b0dc6bafaf25cbb7cb6e99c634b929870031b9335845ace97815a068265
- MD5 98f3e449e5f4b0b89b9eadb255e95f10
- SHA1 3962c676e28ceb72a1d5f047b9eeedc0564a2767
- SHA512 d0d50bb51fda815aff0fd8cec2cc27d498455dab536d09e73907cadb23e2fe3078b8b38f5172649a363cac94b7872ff47baa3f9cce1860fdb3fd0166533dc2eb
- SSDEEP 49152:e9igtukH9nFna8Vtps+CcawUYBKxRrDvACOdRltKf9fg5NxCds6sA8acI4h0lJ2p:I5
- TLSH T1327582479F45017E09F40B3CA8DBE70EE1382BFD4196F9DAAB6102E5C6455CE222B63D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\lcenblphbmngnohghkhpojmpflebkcpd\1.0.2495\4ba7cac3-3a7f-4634-b868-ca6da5683dca\cd51bf18-1293-49c8-b17f-2ae61bff4664.png
- Size 41KB
- SHA256 93ea996e94f18cff0b61ea0314e7ea9b006fd15cd08b4092b1610eed484f4970
- MD5 b0cf241d40073be94b65bec892863fca
- SHA1 2cff0713574872a106aefe245e39cfe5da97acf8
- SHA512 4b18e0c991d9c6c298aea007d2f96a67b3015f61c41765d44fa4d2695bbf52b6caa6eabbf4241331706d28f2944f799b027f67fbb2369128a85554f6bedcf89f
- SSDEEP 768:3pd9bMOwMzCq0cB6nHIPzVV2RQpRS+PORu2v4RVkkPVPpzZ+x3REiRN9:3PFMOFmHsWyRSMmIqKl+tRE89
- TLSH T12113E1C5A8B0E7AF4E674375AC8A8FA7D45B3709C8CB53D2E411D9BC105AE97810D84B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\lcenblphbmngnohghkhpojmpflebkcpd\1.0.2495\campaigns.json
- Size 4KB
- SHA256 08eb3d7d991ce904b290a888664d1dec2926c6b3396975e494cc331e923ecc1e
- MD5 ffe5e6655f1e596444be99d0962d8fcc
- SHA1 59203470202b727aada987b2a451474e7de62b3c
- SHA512 803016f8148b5ad40f313f2f55a7be8a3a2e6598ececf4c15ff29a5dd1216448558285ca8a853350cf2a530ed012c7290c84c30dcb41ca06594fd5ef086d7d06
- SSDEEP 96:epupo1PrXCBc863Q73PdDT3T4oj58LsoW8L/ePoW8LK:SkI2KJc/pLEi58It87ePN82
- TLSH T19C81B746DFF3B9722B4A53F3717B669730A6A9B443D0C98190833DE8C099926272D74E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop\1.0.151\resources.json
- Size 975KB
- SHA256 0575c0544522bd9534b2e7c5df2794629c3e83e09ca49c64956d6868f738b86f
- MD5 dbfd369743ae58e8f006b5b0880c8722
- SHA1 cbd5d2c872c50ba79a528d07ca3830006ce6cc41
- SHA512 7b9774b57f732da6a09ec6a41a5e325766462a9ccc58e5a5d7152c514a40e8bccaada98eb1ba1143b89afcf7eae5ed67db7317db680ad1bc571ea83b7e4e89c2
- SSDEEP 12288:Pqk7KgJPCtDdGeOI2o9sxD/3SKc+SBgWXo8zV/WRWBn8MG2x6X:PqkaMs5S+nCG6X
- TLSH T14A253C67CF4F2D459BB499471ADE38CA0E9D178F64E308CE961ADB8C854E43628CC1ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\nlpaeekllejnmhoonlpcefpfnpbajbpe\1.0.517\brave-checks.txt
- Size 4KB
- SHA256 8727cfd9428a028183ddf2435846c2175eb346c2af2bb38f1567e05a8706b296
- MD5 a38a0d650b2e2bfca17bb80d21edfe83
- SHA1 0e5e44221c87a5a7d99d90b6cdd1589a87337a4d
- SHA512 f1f1b28915bd14f1979df0d4595b34696bbe3a11c0acf6c91535727154313a9be07069fc71dc1b11831aa4d75453c50b1a0d0858742977870ec641b7fc816719
- SSDEEP 96:XBRZbX0Ai7DlBREfmTK+JqzH96IWKaxWeA0w5jFargdXVpuGFwc:XdDm7BBsmGNLfWPxWfMrgX
- TLSH T150A1D6889F105A9437A0053EB4D9338D29C51B674C65FAE8EEFEF988942568E31312BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
- Size 3KB
- SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
- MD5 5e2067a92dcfcb05537479c384a89725
- SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
- SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
- TLSH T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ce21c4893164649e2a8d138d930312ff6e751c03f4114a0efd55e7cd95fd9779
- MD5 bf8be24392b8a9998ebc080264d89e7d
- SHA1 1ae929e093819bc356c3e992973079e08dd5b775
- SHA512 7dc7ebe58a26f311a11f64396c7ab0e117ecda9417f71f2d3ae65b78a0bfd495452448aa1bfac0e296bbc5673d4914363afcb26b29d8cf29d000501b422e0abf
- TLSH T14ED09B7077CDEC11D5450471D86547536D96CA8C24D7DB076015801D58557D9B39E067
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
- MD5 252c38f22d645a5fc39fa9f1fdd92b34
- SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
- SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
- TLSH T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
- MD5 da79f81681859af2b76762aa37a5f73e
- SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
- SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
- TLSH T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ebe98ef140d8f148adb58316b037791e8c69861901cd97fabd5e03daa14697a5
- MD5 55a45a92a862090801378946aabd1fdb
- SHA1 d535e1f647fe1be5580da02dee8d4f5e769ab613
- SHA512 d89f68d0a926d81b6d3287734e5ad6e1a926009ea17651f8df358d937079370e6fba0ed8ff1eb0c34f0c189db23d4b8d76d99882965c69b03ba9bfa44c2928ea
- TLSH T101D02370B9A9EDA0C82C0030C43002017E6686B930DB9B032049880D88B02C0F2DF8F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
- Size 60KB
- SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
- MD5 b90c0e06b88c09158b13db21c7fc9ef7
- SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
- SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
- SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
- TLSH T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
- Size 68KB
- SHA256 9e4788840f43b463a51534f036f6bd9a36e5293bd6da8e4654b43e1d83714d81
- MD5 0032df338799c529f8900ed1df3fe473
- SHA1 3552463fe133dad96c5fbb369d3225e51f729c51
- SHA512 15265ff935bcd4e70263c233fcc97185785291a454838bde98267e26dc2143af16720dae70710ff0149a783ffa484ca7478ae76fc451fe2743c2c1069d7b04e0
- SSDEEP 1536:U6UIpg9QPWEgHpuRQAPmrc930G+7F4rwzk50fpuMSKlZh:U6LO9AQy+GnSfDS+Zh
- TLSH T12863129CB8B56F8C40B28EB153ABA01DD306C65DC47B93FAC214B64F029D129A43769F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
- Size 63KB
- SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
- MD5 226541550a51911c375216f718493f65
- SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
- SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
- SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
- TLSH T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
- Size 19KB
- SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
- MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
- SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
- SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
- SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
- TLSH T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
- Size 38KB
- SHA256 c6055b57d5aee320d1e4334dbce0ee8afb0b5e006f0290bc41236930848c11db
- MD5 2d888bcfc3a3c36fdec7a01e9d086cc4
- SHA1 9b39a3f2bacf2a489f910ea6517d076f95ab5a3c
- SHA512 8231c95001a06ecc3274b44640b582f935ec21344b501a622711795c9d89f7d3a08e0c84f859b22ac7af8a37a43bba9dcfc4dd1eb9ff0286c62688c2f53b4f74
- SSDEEP 768:msFkD7e9LVxiDhJDi6JPH+0749gFkpIVqNlpnPN50VrEmctTNGiaZqj:RiG9LVx2PDi6o0s9PzN505UJNuqj
- TLSH T1AA03E18C9B5D00A81FDADBF4992E25CD9114387190A1D4F365FAFD450AECBCA13DF650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
- Size 26KB
- SHA256 85337ea547e087f11716940e5708d35d17b8439d1e39a14395f1caba204396c1
- MD5 51871d687456d1c88df317881fb685db
- SHA1 0f047a53402675ed3b472be6809d3815945afaac
- SHA512 90aa82b910d7bc366860a8baadc2b8ff9f56d47e040b6f4436b8876ec552cfea9405cb448cc83e9419bb652cc8d9038cc31505a5f1a422184c26e29fee1b5140
- SSDEEP 768:SUlnedygxCBkXdWwYN+oXiBEjsSINYedenS:deggyGdVQ+oX8csSIES
- TLSH T13CC2F1D239B19DD14B627F287874D1C32E1C77528E0E66FF7485B9C8259BF886A92900
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
- Size 332KB
- SHA256 83369449537e50ffc43415d1a1ef34766da35a53e6de3e3807468d8d94d6dc9c
- MD5 18279cf0f0eb3df4d591d696e8bc3e0c
- SHA1 6ee8b6fcbbcc0c77bad3c858e72613786c0fdac4
- SHA512 ac2a0b427d7e7fcd29e9bdbb03b25fb4dddc2ee36f81d717722cf60fa75a7349fdb49764b50d7c5ca8f33107c3a92ef3eff7196a1b8e7051d47d959b2d8c1184
- SSDEEP 6144:2vNR3ufg24HmSon2TSm1v27uF/hD7O/fLg0C3D8s5XIv49QnJwYnV1h6gzKxKX0:Q7e0G0c7wpvO/fs0slIwYV1ogAD
- TLSH T10474238B537B887E9D126D7AF89A3578D4EC00075E3ADF1FEA6860DE5077579C0B8180
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\883d8def98ea4d44_0
- Size 2KB
- SHA256 fb01269c79a8499c94c038150b6760bc133ef17c25492a5baf3a8086885d8ab5
- MD5 6a02a0f8382c8fff9ba42f31cb6f9be9
- SHA1 267bf0a05ba4d0a08dd2400b5248502cbf3996ef
- SHA512 6d5a139a4a846cf89bfe183d08a43f69b8e3af842a3d3806371a02d17a7db857cee566127d57b45b3de74b638a48b2de2cbceac9dfa8e06ad0eff4a2abbf6693
- TLSH T180414183D7852B08CE1D66FA45D9ABA69325910D4AC2C73B21D0C32E1CD92E1CF16345
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 7KB
- SHA256 18393e18fef867cd8f955919a6ba71a31f0e484d4fe913818149b645b9bff04e
- MD5 05de10fe190c12a03e8cd320416de6cc
- SHA1 a6ace3d938383995fb58af2d6edb88d5f1067910
- SHA512 d9a56a2a98319ac946e6a7b2380016b0157dd45e714287f13d5943327c055bdcc1e4de1575a30a0c23e01aaf1e31aa7fb22c6370d1eda226a158f4372cbb9f84
- SSDEEP 192:z3913V5+/EV6xe8weSngPPizPFBOB5LByhg+iqKgbhsHJ705Aygp6lGpdNJlX:zt13kCvg3ijSig+Cm2pwm6oVb
- TLSH T1B8F1D755FE411890FBA4903482FA4D0E39F3988765AF0E8D3B18743AA70EFDA7061F54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 f27462d042462e347a3082487c8262304741682f2be238d625def6440c26b84e
- MD5 c1e014b35b7e391b999a052c5f335d6f
- SHA1 eb9e65a76ccda2cf6b4134599553456407e81dbc
- SHA512 e7532ead814ab7d453e1b55b40bbcce1e81262f0e2cf0778958dacd1f5bce148ea59b6f49d4b7b011010e506316636610df62db31e314076d60d52562ceb2d2b
- SSDEEP 96:GVVrRqub40sC0+/WI8ZkLWK6piecSOgFAjCUyriIgIOEW8WU6WyyBdOBhj8tm+hy:GV9/sF+/eqDrbcdg+x/BQBXkqwJ8tbJ9
- TLSH T1C6B1F589FE411851F790903092FA8E1F38F3999B268FADAA37583474AB0EFD73411C58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 61B
- SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
- MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
- SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
- SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
- TLSH T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 23KB
- SHA256 75b9362bd0702b36d862bf74e221c1f07b89909c1a4ff320e37692fd6acb39a8
- MD5 2326cae13951b1ef485f772c346b79ea
- SHA1 a9b2476465001828e15852f7ee3859759d344b6b
- SHA512 531a1b2d9fd4a8cb0988967fd12ec4119cb3e701daea8ba806053237c10bf0d72e888a31ba1e034bbca5b4e285c27303d4dd9d3a58e5339630c646b8da431e74
- SSDEEP 384:DFNOm3D95eQzLdJKqoruOVJaWu61e2e1echNezM+bk4DNki/qi7v+huVPMg98uw4:fMIctBQT25
- TLSH T12BB28DF3C7E4862DC81252F05B146E17CE6E0928527C3C77C9E5EE9797E24B2E28164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 211B
- SHA256 7d29b06556f2dfb89e65a5556b67537a62fcbf6c26c0f39df43d30e7b119890e
- MD5 f0ca3ada658df598ebce90978e95eaf4
- SHA1 7e9b370ed24f4f48bd2afec4b31b5a46e102e486
- SHA512 163237cc8a87ad00c2edb97c30361d02daab29da54ec9ad018a3b0c0cd02f0a5297f3424c3b4011736057b9fa09e88cbeacb35c6ba4a53db6ae5fe5e85d6a0c6
- TLSH T1DCD022A3170470B4A75D3ED3906EECCFCB27002148CA9DF420D068DC693646C054B1D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5bd1b4.TMP
- Size 211B
- SHA256 3d983c73ecbb6d0353879406c529ef82bf553ae1ae0a7e7b2fcbe7fec4bd64c8
- MD5 3741bd774a67bf27235250d9684e99ad
- SHA1 e924313485c911cab819566d4cbf908f26a77d55
- SHA512 550164ee1ba9d9ced760c5506720481d8cd3222f5ed1bf9c180601dfca38a037dd0fd89e4827137822f0f6f8a3ba1159fc93cf47a7cd0b02b870eb5d15bc28e9
- TLSH T11AD022231700B0B5A76C3EC3906EECCFCB371020088EDDF420D0B8DC4A3186C090B280
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 b6a0eeba3346c35294877090c49b6bd6777fa8634d10431070cf2e60b1cd5c9e
- MD5 a17f9d0689e7e4675e17853aed50146e
- SHA1 30a26e059bbf8a1443cd9b2f1dbec772221bf8d6
- SHA512 582c5372da99a7a83c1d1fe351b7b6dc1d4ebbeac96fabdba6e35aceae20e93fcd00f6a1048b78edf65ce068c184cdb3091c62d6fcae06e1a76c230bf81bebd2
- SSDEEP 96:sa2jViqWRpscnb9VuDdHWNi046W6hfuH9EOx+WVoMfm+uecpYQj6J67OwUhgNVDB:sxRkXsIup+pMHW6+WNGYjxhgF
- TLSH T18CE1D8426E38A93B4CCBE51DBB267B13E2F6502165C50A4CEBFC965C099B6CD230780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 23KB
- SHA256 eb9cb31501f4715864b11fe18dc36fa912975b1de26ed8cedf6295d37847b908
- MD5 6a07a44428b997e68d0c8abcc7d50082
- SHA1 f65b64face10a2b00a703438cdd7b4f9a55bfe52
- SHA512 d349cf2e760cdcc902f4fb5493125cbc15c07dd8afae1d573ac7af0d3507b3004abcba5b4c7bbdd5b9800443f1b933dd8af0512da5d3cf3b1c990a8c2257f6a4
- SSDEEP 384:sxZqnARm46/f/svWvO9Y1Jh6gzViXY5oHbam98luvtHVIOxTWgS:s8ARm46/fcYO9Y1X+HbNBygS
- TLSH T1A9B2C5A27434C56B4AD6D828BE71BF27D6A61062CC961E9CEAECD81C00DE6FD2605C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 e6d384b554ec1f86f80358eeb552cb566d68c33e8b53f6db6de25baa2615e995
- MD5 e547858e5e73fa82d03523c6d929000b
- SHA1 069ef202d44e4806be2aaa24b6d81c6ce6de8206
- SHA512 869d785867325ead4c0235a280371e4052562a4b06aa902164cb51adb1da3ea2c521c4f7b21786a4ebcfbc44e0d42b7a7f0eb295d0765b9e7850d46259de4661
- SSDEEP 192:sxZ0QUnyLfcB16/f/sfD9JYc01yZupTMPHW6+WNiNKfYfF2gadIg4M3WCHS:sxZqnyjm16/f/sr9J18yUOHb9fb/3WgS
- TLSH T1AD52E952A924983B4DCBD619FE357F13D7FA102198951F5CEAFCC51C04AA6ED220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 32215f948cd2ed12dd7223f45005ccd5bc571e09337ca327a7557245e964c29d
- MD5 9b075d40eb7851f43b07b6115720c6a7
- SHA1 4c94b384f153cf24c20dc46d56d8309bad272769
- SHA512 69ebd09ba4b4fa1114f186bf77689b3cd486cdfb5df203ce3bc712433d5592898100fa5107b66405ea5d23c8f2c2c183d008dbedfb57eb26981950aaa743f4ba
- SSDEEP 384:sxZqnyjm16/f/sH9Y1Eh6gzViXYHHbEZ7NWgS:s8yjm16/fw9Y1Q3HbcsgS
- TLSH T11E82D4A52420C46B8DCADD08BF767E13D6E650638C961E5CDEFCC50914AE2FD260AC2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 22KB
- SHA256 384feba486e7e8b4a2bea22eda61d64df9606f2a1e0f99f2a18bffe091eb854b
- MD5 7adbe5d24132322062af6a9fdb559518
- SHA1 9af984d8e1c7eab993319ed57edaec056977557e
- SHA512 622c3eeb84fdcd41f0eacbe1565356f6a58837c1973ce2c3d327861b95bccd7c3005f4a23353f9a607bce38f361add8620f20e99db45ce20f8292285657416e3
- SSDEEP 384:sxZqnyjm46/f/sH9Y1Th6gzViXY5oHb298luvtHVIT1NWgS:s8yjm46/fw9Y1d+HbSB1gS
- TLSH T146A2C6A27434C57B4ACAD824BE71BE26D6A61062CC961E9CEBFCD41C10DE6FD3605C4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 c0541d731aa31b604f4dc979f31dba5b94d10ee70d3aceee8878b33aabd47433
- MD5 b7e3381d58ed4323de0bc6100fc58004
- SHA1 ebb77555833dbe9cf9fd24135aa85e0f67e7106f
- SHA512 bbcc2bb6575e2f1cba1989ac9e6ba1bfe9bcf709eccfc28591bf7759e7b91350e49975ddb4f58136bd73335d480cdb556bc14338aa02e7eff794326f3ec73b28
- SSDEEP 192:sxZ0QUnyLfcB16/f/s7D9JYc01yZupTMPHW6+WNiNKfYfF2SadIg5OM3WCHS:sxZqnyjm16/f/sH9J18yUOHb9fJn3WgS
- TLSH T19952E952A924983B4CCBD619FE257F13D7FA503198961F9CEAFCD51C04EA6ED220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 26KB
- SHA256 8f79a1e223b1fe36bb11d020a8e9abad63d6f4af7a7d2101d71374581f6c054a
- MD5 bbd4d2d29c6d0a7ff0b529a09355e7dc
- SHA1 1a2ff872f2290f5f868f74ad03c5c4031e6b97c0
- SHA512 79f88720f055b86fae84a5f4dea200229261523d9e6512340795e5598406d082e6c859b30f1992ca2af521f59b1d8616bb8ba2771d56b509b22453397b86dbb3
- SSDEEP 768:9/mjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+FCrofUzaA:9/mjYDmWvmKyEu1jakPLZQFZM7
- TLSH T139C2FA3B244CCF7E4FC41A9DDC5A6F973EA802C76A588D4047FA994C02C77EA512A49B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 8beb12ce1cd73a0287dd5bbd4bab55f9cde9444692cb122d71f68b7e9d7a2727
- MD5 50fe6ed63376d978ad31cf2d92139fb6
- SHA1 e3da88aef5d3bc46ebfceb748e7c1037f258ff6a
- SHA512 6338dfe45e8600652104ba3d76e2d07659b8e1a8deb6795ef8d2c9994fc696985e08d5d55a143f5a2ae106311a3385b004a4e6808e074bac3df7c5cc67c84138
- SSDEEP 96:KYTCXzd11+zFUlNT+KVLNR+ZrTcBjfCs4KB+6YQKVuKew:KXza7t
- TLSH T14291572276BA87913D3F3A0C8252AB168A42B2E3341CE46B77BD44710E66F145DFC8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d11e9907-f18a-403c-97e7-436338ed0461.tmp
- Size 22KB
- SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
- MD5 dc2dabfd9cbeadca467ec254d1aafed1
- SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
- SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
- TLSH T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 b7117aec6c9aa74ab76d675f88d7b92e704084573dbc39c37a6ac66681db321f
- MD5 b3b1f09bed1189eb4df47673dcebce9d
- SHA1 8d025c4f7531f83840bfeb0e674df603ba016574
- SHA512 1fa0065ebcd2abf60f4a06274ea35abd69706b6b67d6a98c6d82bf4313babf337f8a11ddc06b2610f8b2e5ccce72c3336cdcda71d3aa4743831bb6dd3bcdc4cc
- SSDEEP 384:nqZcIAsNtJwrWKcf+s78wYOpjXK+gkdBeRs9JKgqijUjF:IApp8LxprK4dTjKgqmUjF
- TLSH T19D928E309829AD7695E6F246F48B37634EF8607799D06FA8E1EC6F0D008569C271FC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 b3b8c83f555121bdf3c34bd19b076852b268c08630259664b7923ff74a132722
- MD5 466412fe99ca086c546a1a9e4655de54
- SHA1 e936d19f95714aee1e33fa667d6717b355c7ac35
- SHA512 2192ce43692c64b658f6f3e9fb03e1a471f1a6e6dcca2ae4dc8f1d08f9ca6f228d4e9976a6ecd521a50eb38066487734a9293485db554732b26a08810e3dc12e
- SSDEEP 192:EONS6hZ0QmiUyS7Xpc/+jViLjzorwYOv5wOZpqU6:EONS6oJpu+s78wYO+2MU6
- TLSH T16502EA35AC687C778EE2AF45F48737235FE5112BA9956F84DAE81B1D00C769C2307836
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 d90537fcbdd11ed9c0984bfdc78241cb1aed60f3eb1a5bb49581a75a434a6e83
- MD5 78ce7649ae0741e2431ad9a4025e81b9
- SHA1 c2a7df0f5b209a28dc0b1011cb97a02c2a2d2c8c
- SHA512 fc8abafb4aab76b6f3f0341e896c64c22d9c9b3e9155fac2e07ea6e159ff822facb12d1b31d06fe105b1737e655dccdc43c6daad15d0b7015c32283d89b37938
- SSDEEP 192:zssNq6hZECQmiUyR7MMH/+jViLjzorwYOpjXTe+U5cOTIrqPjUO:zssNq6A+rMf+s78wYOpjXK+ncNUO
- TLSH T15F120935A868AC6749D2F645F08B37639EE520779D856F98E6E81F1C00C779C274BC23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 ee50fb273083cb158e7b16df5fa68425e763c9b203778be34230bf0d152baecf
- MD5 df8ec88f814c68e5a152d09b372fcf53
- SHA1 e843a48e6f85dd9d8378662ada1ebaf479ac96d8
- SHA512 9a4999ddc02ee4b747cfe562fe3e87a55881397a6ec6f0f1bc8cc05904794cb14413cd7d1ca76d1625a927d3104110eb553f97a4579194516c927a41a5b71b59
- SSDEEP 192:zssNq6hZECQmiUyu7MMH/+jViLjzorwYOpjXTe+U5cOTIrqPjUO:zssNq6A+IMf+s78wYOpjXK+ncNUO
- TLSH T14C121A35A868AC6749D2F645F08B37639EE520779D856F98E6E81B1C00C779C374BC23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 c924eadc549ed9d81d3d31f9e9c9573a95eaf2fb738aa2ce1e23277b4ec15a0a
- MD5 65d5962510bb380786b63e793b608ac5
- SHA1 18fc40d25fc2b3fbacefeabb4fe22403d6ac8553
- SHA512 f861214c49372c817e5dc5365178c334ffe46152cb101368a4f852d30147f978683429cf3e0a73e29a2c034951c0893657b5bca6014967c8bf014478d0e3427e
- SSDEEP 384:n3ZcIAsNvcwrwmt2f+s78wYOpjXK+ykdBeRs9JKgqijUjF:/A+3tmLxprK0dTjKgqmUjF
- TLSH T17B929F309829AD7695E6F246F48B37634EF8607799C06FA4F1EC6F0D0085A9C271FC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 5a3cc3d17c0ead62a10df222cac4898d0dc60cdc939496cc49f98dcee925e742
- MD5 5c354c25bb7c88c491c8b11f15c91c45
- SHA1 73d0e0295e2c7e798d8d15d688a58bcbb1ac9cfa
- SHA512 4b79a4f62389bc2f9cecb8ca5c8179acbb4c59eb381dfe3257a952d9ed4399542e007918c1842ddb5e97a2c33d46694ae093118a3eba0ef667564798e9a5c3de
- SSDEEP 384:nAOFrZcIPnI3sNR8TUNTUlIlcwrwot2rDf4x+s78wYOpjXK+lkdBeRs9JKgqijUx:hFzQ3wwgnltRxLxprKfdTjKgqmUjF
- TLSH T176E2D5F188D79936E8AE5783A37E2E528EFCD05374849994B7D85E0CCC425BFD30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 d508d4527e7e2393f25475752ee40b64ddaf3339d85e29de9de7e2ad12cd5992
- MD5 e51f3f9471d9352e769211d8882af025
- SHA1 c6afa02f4a2aeb89c96fff0ae567fe4ff20eea25
- SHA512 d00513388b9d56e5ba7d9771a88852f88079c19765a6aa1268a1d8950d1e70df5b170309764b5b7aac4aac89eb21a565ad30ff64a7498bb8061a44f1f142e8db
- SSDEEP 192:0ON56hZ1QmiUy57XMc/+jViLjzorwYOpjXTe+U5cOqFrqPjU6:0ON56XAMu+s78wYOpjXK+n9aU6
- TLSH T18712FA35A868EC674DD2F645F08B37639EE520779D85AF98E6E81B1C00C7B5C274BC22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 3b09a80409d83f5426f72218b4d2e55c4f2eff4196209570b288ab5bb5955ef9
- MD5 c73e6f52c4f0f56e968ddfd59e74521d
- SHA1 d7c0021ac7795903fb89117e3fa8da61f56e89a2
- SHA512 68fb175058e4829012ed6f19edcdbcfe31d1063c780f33f31b3739a12309591ade0bf8c0f7802dad26e6fe53cb5dba0966341bc08e0834f02d514db41a96d88c
- SSDEEP 192:zssNp6hZECQmiUy17MMH/+jViLjzorwYOpjXTe+U5bOilqZgXUO:zssNp6A+XMf+s78wYOpjXK+gddUO
- TLSH T15F120A35A868AC6749D2F646F08B37639EE520779D856F94E6E81F1C00C7B9C274BC23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 bba792a8bf106d69efbdbf4409ab3e55e760284890f85c41d4ab4f57873c9522
- MD5 50596bb60621d6fd8899abf8172ec2b3
- SHA1 d2851fbc2768cd6e6928975a3c2d285a9e4ae6c8
- SHA512 d84de821f5bb34b17cb78a3265a855ff133809b896b00409145a3b0633fbe5a8a0d6d4792bd56ee196f1a35d5e05f2c95bf9c2f02e24b434646e2a7eb2da36d9
- SSDEEP 384:nqZcIAsNvgwrWFt2f+s78wYOpjXK+GkdBeRs9JKgqijUjF:IAiWtmLxprKsdTjKgqmUjF
- TLSH T137929E305829AD7695E6F642F48B3B634EF8607799C06FA4F1EC6F0D0085A9C270FC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 9519aecef1d0d2059ff73c6f08ce5988e4b7fce30bb57be88855a8ee0e2df78d
- MD5 301a7ea116965cfe3678804a0a382727
- SHA1 7313dbaeb3de689dd09bae4f99c437affadd7564
- SHA512 c366d3aacb3346d3529fc339542a9e7a6e6224e41c9154dbbbb5978405217e358f5b05eb246cd7b74fde76117baa62a09e0fba4110fa3381e47defb75b5df0b0
- SSDEEP 384:nAOFPZcIPnI3sNR8TUNTUlIlcwrwot2rDf4x+s78wYOpjXK+xkdBeRs9JKgqijUx:hFHQ3wwgnltRxLxprKHdTjKgqmUjF
- TLSH T1AEE2D5F188D79936E8AE5783A37E2E528EFCD05374849994B7D85E0CCC425BFD30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 d4bebec1ca2909523e1ad692d18c57e8ece62f7b4b81ea44935027a9645c69eb
- MD5 1a388ada8c7baecd158f5bc0d726a8a5
- SHA1 ce14fee7a889eba44faa03299b3ecf96b0729dae
- SHA512 cbbd0311bdfc0f77c52da79d69866e6153b2c8c1096ba41475e8ed1b5820afa0fa3f6e3cd6f54045096abf74a46342775acfc6f9f132e1c065547af3fa42c764
- SSDEEP 384:nAOFcZcIP43sNq8TUNTUlIlcwr1ot2rDf4x+s78wYOpjXK+X4kdBeRs9JKgqijUx:hFKg3twgn+tRxLxprKOHdTjKgqmUjF
- TLSH T115E2D5F188D79936E8AE5783A37E2E528EFCD05374845994B7D85E0CCC425BFD30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 b47169bb2ce800680cd998f76d6441845a361d37fc617e0c389a56f13d008da3
- MD5 ab730456c2ddd4694649389e72aaa402
- SHA1 3078527c28d87dfd7a31ff1297089d07d1f02300
- SHA512 7d8d5c18d55779f4897250b11c0b13b9c5364688208cd002c3a63b33e094333ea1c0df48264b519655058baf06a9672c8c53823e9f5972964d4f0bf439eae102
- SSDEEP 384:nAOFEZcIP93sNq8TUNTUlIlcwrgot2rDfhx+s78wYOpjXK+XBkdBeRs9JKgqijUx:hFiV3twgnVtUxLxprKOqdTjKgqmUjF
- TLSH T19EE2C5F188D79936E8AE5783A37E2E528EFCD05374849994B7D85E0CCC425BFD30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 7523cee2b5e5e7f6086cca3133c7447e7a18a40dca84d7d6e4bf8e96f80fbdf0
- MD5 c658b67db8dc7d25459b7a6503b49ae5
- SHA1 65a621b1a03f0ba2fb04d32938503e4ac09bfce3
- SHA512 fda08fe8642beb63c2662029a9988490803b513cd67d510e940ad9adf5920975433572b040f042cd2abe81ba8fbe56eac11e028348105b709b7155e0c28cd6e8
- SSDEEP 384:n3ZcIx3sNvcwrwYt2f+s78wYOpjXK+ykdBeRs9JKgqijUjF:/x3+dtmLxprK0dTjKgqmUjF
- TLSH T1C4929F305829AD7695E6F246F48B3B634EF8607799C06FA4F1EC6F0D0085A9C270FC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 36KB
- SHA256 0e4d0527fc9ac6b8200971f0b192a7a443eec1882ea7cf3eaafc3d716816ade7
- MD5 39039cc629cc2b77e65f971c5d20e150
- SHA1 f0059fc521f66b8f5910d8c398aa62450048c9e4
- SHA512 b597e810ebe100e1da682f4e70cf7f22a967fb20a5db3e2d564b2ec37f5747bf55dea2071bb7b0a6dc05e529ad38ccf7338dadcd7c728dc016e38b857cf6f24f
- SSDEEP 768:hFxV3QwgnNtNxLxprKOadcJgv9tdTjKgqmUjF:RV3U9oOkrdigRUjF
- TLSH T105F26EF184D38DB6D4AD97C3636DAD1259BCC033B4889998B3E8692CEC4B5BFD306815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 65fae94089d5f141ce527a3c366b9e663e415f78d2f537602fb3a092e95bf5bb
- MD5 36b49688d1eb894f3a27a984fb530c1b
- SHA1 45dc86e8d1305ab93dc24baea9130440bf34b257
- SHA512 e252d6f6d1a6bb035b4b504b4b57f923fb36779624773bacdf47ed443e0e90464f23964628374d0654d0b083c629fee860c9817afcd192e857b06cfa3d25b0e8
- TLSH T11AE00203A73404FFD138433500675F6426E3803042A206068E1051741C323081FE1B84
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 2c700c9d1859f5407b16640bf25932b37c4bf1850c51c72bc937b329e2b173d8
- MD5 d1bb202a399726c0269993497f0278f4
- SHA1 6bd03b134b77d125c03081cdabe127de37db2b64
- SHA512 a4155de2270044841442a1d9a6bb3db386b260a54ea13e8bbccddb4af391d5daecadc7f930e2a6f4c28664951a9c141c169af0ea65dd5a61284386d52f876e5b
- TLSH T17AE00103A72404FFD179433100A75F242AA3803052A206168F3451782C323082FD0A84
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 e12fe296fcce3724c7276cddd93a8ceffacdb9422d984f31dea86c673d8f02d0
- MD5 dd53572555c58a7c412bf27e3648c354
- SHA1 d381e6e43597025d98fc4bee387a570f9a8db04f
- SHA512 403900a714bd37c6ed44a032b1a1e9f87241555849fe9bae2701ec0c38d142bac00b8ea278192339aeb4bc8b8677e73f49012b57215999da9e6d9b941ccabd65
- TLSH T137E00903A72404EBD169463100A75F243AB3807052A3025A8F3451782C333092ED0A84
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5bbe99.TMP
- Size 392B
- SHA256 64617c747ac4965cecb08930b929db16d7c1eac81683594c73458bb137372ae4
- MD5 2d731ce62065d9de50aee331b619fa33
- SHA1 c6fe14a57c9565f1c93b7657a1dd7a7c50e5bb38
- SHA512 2ebf6b027f31f97fb61e5ee68a4bf9bcd9fdd1fcb1325e284e2a6d180cdc8422b3f287a9226589169533b72f60a909d401a5b85e18abe02727d2dde32d8555bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\85eb857f-feca-4839-84c8-cfdb7bfa2878.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 78c3a979d1ee50a8622da8875d738c349523c59a5a19fa62f1b28f981dcb2fbc
- MD5 79fe75483466148327c7a2b02e3a059f
- SHA1 273f5811367dc5841d7cc9440d7c0ff6f163c425
- SHA512 1df569823633be9d5930d1aa3e308fa5af374dd830f593f2f87e31b65b6bde54b64871a59b4086bef3764c671cc92874e7748de0151042f5b6e6651ee0e6fa6c
- TLSH T1B7411859A6E91108B3B76E5A9BF6696E447F7C372F07D45E10110E8F0A32B40C861737
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
- Size 22KB
- SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
- MD5 d01869348d5a783f61f90cbb27b82a78
- SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
- SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
- SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
- TLSH T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 5e49e5f0973d01430a3185e5b393f6e0035e97492f0db4d9870507069f13167f
- MD5 5c57e71a1b40cfe939b3a2e7efde3a3e
- SHA1 a6a1039eeed24d056e73f44af6f126e58428eae5
- SHA512 dd0fb7882c51b9dc4e9297e495700d2acb003c7a3f750cd705389e69500e16120d670c500032500bee60d24412fe811df1bdae267c20f6df5978060dc385aff0
- TLSH T190D0241FF311013CC01030731403754C0C45C35F4445C300553CC51F5F440500F03443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 3b6deee2c128626cbdb3e33547c1b1f9afc91f09914bcb380d2a889056d96ede
- MD5 5fbacc5f47931bb9b13d3a6ec2fe4288
- SHA1 9254782fae63222141c8fc7f8d98d29de2022131
- SHA512 14f93f10f324572948fa8f681c8b4acf9f427c7b355b836e55a96ec0725dfb7e93ff76e3a2864c7b825906cf78ac07ce618bdfeb863f9409d32d2144eb18cfb8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 990a7c756a27444795bf42fa27be6ded7c446c450e554e05252e4f8e7ac3cf23
- MD5 afe91c20a5cdc660d5f693a2d49d07ba
- SHA1 a42f24793bce5b6128593425365af581681b6624
- SHA512 ea916dc4234ade8c9f8009d24cd11417f0b5452485a085cb667a7fcf6ed5a1958349411eeed1412d4c2d4168fc5683978b7df5679795ff8e8764e721597e4fa8
- TLSH T1CFC092A3B4D109C6CF129B3D5D495D8C7AD8C49C58C90767E1A3C016DA3FAC8868BE99
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Default\Code Cache\wasm\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Default\Network\Network Persistent State~RFe5e1a5c.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Default\Preferences
- Size 6KB
- SHA256 71f2d4ec211c68a1eb13474885816ba0204f304813018cfacebc68da1ca51a97
- MD5 6e8da34c17f5dc7bd6c99b3542e4d96f
- SHA1 f8e4cfba9cd072c813b5122c2edaefc82a7113b7
- SHA512 825ce3b02f27493011fdddd947d2dfaf1c0fc9802211bc32531b3c7719f1ee0528b143bd47892a6aa7ea554f56d3618768de5866dbc3bca711a8ed0dbb8eece6
- SSDEEP 96:stD85kx10rb9q3ffydC8i0vhE8kqGTm/7qx+WVHMSm+uec0l4x1idQjB+gDgcM4B:stD8CHjfsC8pabi/S+Wie4xwdoBgcMI
- TLSH T1BFD1B7426E286D774DCBF25D7A25BB16E2FA605265C21E58EBFC861C04E66CC2307C0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Default\Preferences~RFe5d928e.TMP
- Size 6KB
- SHA256 98f99c134de98b04b297d795af76c0ef74f2787ebc0b9cafcb11dfbc749f5c88
- MD5 f5cf52336bdf3b98614272232212e6c3
- SHA1 51974617e986020becfc5908d18f241b235df140
- SHA512 456ce1fc4474d3ab786ed93efa6971c92a25a13aa28b5fa22c1e7d089516f9ec1e9e5fc367b3f33156357399999e56ed3fc3a29b6bb1a90fd15acf9e01002c4d
- SSDEEP 96:stD853Yxx10rb9qIffydC8i0vhE8kqGTm/7qx+WVHMSm+uec0l4x1idQjB+gDRcN:stD8BOHcfsC8pabi/S+Wie4xwdoBRcMW
- TLSH T11DD1B7026F2869774CCBE25DBA35FB16E2FA205165D51E58EBFC965C08E66CC2307C0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State
- Size 16KB
- SHA256 777bf06d649f19cf813e7fbfa65941038236820649aeeeaa378376fc5f8a2917
- MD5 4a01302df138ec99af30ffd79a76bd27
- SHA1 d63f8e6eb8c2b4c61b83c8401fe4a9da474c5161
- SHA512 5d752436fcc0643db34144fb3decee99c4e9a7ccd68c31af6e0f18cdcdf9ee0a5d45d68f6cdb0999e80085c6fee661f15349ec7447efcad0ee0850aa43eb27bd
- SSDEEP 384:zM+aQikB+z/xvxjg/qhEWNb+hKd852U1t9z/:3/UxvxjgC+ki52U1tF/
- TLSH T1F3728D3664697E3359F3F9447A5C0B4FDABA546280826FB849FE2F0D02973D81342D57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State
- Size 1KB
- SHA256 fbfce2b42ffe7f605ac5782b60dc18157d596c4ff2fba9c37852412769de0734
- MD5 2f3a1232c86b85633ec7931595e3742e
- SHA1 6fa995add19a471f06aaeb84a6faf58484e9ea89
- SHA512 1fca57a44d835d190762e2deac84dd633fa88aa802068512ef0f0be98dd564572dbadfb934827cf1c0667328712c66fafd57a47220116bf1d0fba3ec6fed4636
- TLSH T11431C9B2B0943B712EA15AC4B2456F4F5D32203B80619F6890EF1B1C02E72DC6736C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State
- Size 2KB
- SHA256 1e468e01c9ed798ce04b75414cf043d53a30449844e938aa774e58d7cbde7ed4
- MD5 9e2a8fcbe0f59744b43c6a9ebf0035b0
- SHA1 b0278a196e9d21f37edf2df5d4965f44ef96f6ef
- SHA512 d11c671865f1149371e5575fa015350f390a811f981dd59b0373bee70e1916fed2ece07f553b081395cb21ad4711e89336711daa67cd6a3aad00e151ee1283c4
- TLSH T13451C77278047A774BE29AC4BA493F179D37607685623F7099EE1B1C01DB6AC2312C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State
- Size 3KB
- SHA256 46740e47cfdf1c36735a929f57ad31327f7a31a805630b35aa81a061647fcd62
- MD5 3caa1d0def728c88fa3d034de903a830
- SHA1 04299e0cc3074aa98e8a1c3f86e1900e3fbe9232
- SHA512 deac851b4194dcbf2abb7c4b54346a4f46bde091a18083ec253995d453cdfc014112d4e4405d34e0e62f88b5c6ee27353d197717bc2b127b8b599c25078c8682
- TLSH T1C77196727464B5374EF29E84B9852F1ABAA62037D1913FA4D9ED1F1C01DB3D82312C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State
- Size 16KB
- SHA256 ea31f9ad0ead8854b1f904820abb673e45d9826d5675bc024b47f02655081bb4
- MD5 87497d30c8e5e913a23014df3e203d91
- SHA1 e1bccfccc71cfcd55eec5b342b577ea518b3ff2b
- SHA512 806415ac4df141387a72c043761542986f52c49c07ebf7ff2f66d4341869ae21537d8bec798d0c29a4c0c96f076a769e46c9453bbc4d3a099783085616bd58ce
- SSDEEP 384:zz+aQikB+z/xvxjg/qhEwNbfhKd852U1t9z/:G/UxvxjgC+1i52U1tF/
- TLSH T163728D3660687E3359F3E9447A5D0B4FDABA54A240826FB889FE2F0D029B3D81302D56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State
- Size 17KB
- SHA256 942cd84ad27b80830401464c426537e0297ca36d46ca4f6e8f9b41af26f1c0b0
- MD5 45bc210c321a4d48303f27429a0aae9f
- SHA1 0cdd211a6b9be43593821fadb1688da5e4e5e542
- SHA512 56e5c43b3c0d02b1e59e276249e06c382aa72a9d71b70bac139760a86271e57db91a747f243a8369d78b616318b49205c385db0218ace958ef7539e02d3cc943
- SSDEEP 384:zK+aQikB+z/xvxjg/qhEuNb+QKdp5lTe52U1t9z/:5/UxvxjgC+RhlTe52U1tF/
- TLSH T1F4828E36A469BE3369F3E68476495B8FDAB5546241C26EF88DEE2F0C06873DC1306C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Local State~RFe5cf3ce.TMP
- Size 1KB
- SHA256 ab526ffd0702eba5c7c252504f23805377d6460c5b2aed3168b33c7235aa727d
- MD5 5a0a49d36b314c2121fcbd83726daca1
- SHA1 894268658e51f16718849204ee8416b99312f16c
- SHA512 4f3af52125592bde9ad50a14bb7f54965a27822d7c9c91961ae30fd41f52e4110ac7709ed605f312ef77b9af7272b61864b62bab1ad3f43df72d6e76e2b0419c
- TLSH T13721B7B2E0983AB53AA159C4B201AF4F1D32203B40209F2CD0EE161C12EB5ED5737C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\PKIMetadata\46.0.0.0\crs.pb
- Size 233KB
- SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
- MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
- SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
- SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
- SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
- TLSH T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
- Size 16KB
- SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
- MD5 ca6e253c3fc7718b4455493460053be3
- SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
- SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
- SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
- TLSH T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
- Size 10KB
- SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
- MD5 8061c7027f406f3e20ea5d26969f00bd
- SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
- SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
- SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
- TLSH T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
- Size 2.1MB
- SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
- MD5 43f62d9f35fa6597cec4e2ad5643e282
- SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
- SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
- SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
- TLSH T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
- Size 24KB
- SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
- MD5 aad9405766b20014ab3beb08b99536de
- SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
- SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
- SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
- TLSH T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Part-FR
- Size 528KB
- SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
- MD5 6804859c589fa0ce46529c3a53b882d6
- SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
- SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
- SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
- TLSH T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
- Size 19KB
- SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
- MD5 3495430eefd1e96e8bd95b67ccab0f91
- SHA1 54129d2d72e062ad36a66922331818e81bd34df3
- SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
- SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
- TLSH T162925151887035622F2F50CEE0583F8E1199767540AEE6DE9FE48666F28C0F37494EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
- Size 4KB
- SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
- MD5 db9a3dbc4820c8d84a0a569be1234dc0
- SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
- SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
- SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
- TLSH T105817615A4A024423F2E5668E03C76F911E8253880F6F7D5EFB19975B30C0D778E497E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
- Size 689B
- SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
- MD5 108de320dc5348d3b6af1f06a4374407
- SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
- SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
- TLSH T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
- Size 4KB
- SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
- MD5 26c006f350f70dbc8c18098b773c3d4c
- SHA1 eb015f7010dd74c874675d0599e634027363b7b4
- SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
- SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
- TLSH T13F91B8037E4409276E95D005C0ED209E2DB5ABB0C85DDDC99B964B7FBBC8C8BA4961FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
- Size 668B
- SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
- MD5 95aa820d67ec466eb3444a9458eb7e56
- SHA1 f93e178ff40310e071e4d596f0aff0514666f787
- SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
- TLSH T1FE01D3D7D86197676FE25AD1D02E73C9F04456F26050F7C10F55315857A8A432794CE8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
- Size 68KB
- SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
- MD5 478a605d5578236f2d1ddc93c2f22456
- SHA1 917f05453d497b3e3de684a905e141972c34a267
- SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
- SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
- TLSH T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
- Size 1KB
- SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
- MD5 3d90e5235a4bee8f1dccfc2aecf7c585
- SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
- SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
- TLSH T180214F8685D038316E6E148CD55C3B9C12EA3A7040E6F6DCCEF486A0B50489F7280CA7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
- Size 34KB
- SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
- MD5 d32239bcb673463ab874e80d47fae504
- SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
- SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
- SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
- TLSH T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
- Size 754B
- SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
- MD5 1d06d58fe9131c14ba5ba5ff740b020f
- SHA1 e6ed812e23e201b20170e928686a5d612165df85
- SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
- TLSH T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
- Size 105B
- SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
- MD5 57d5a3548911886de2f3bd3172e808ed
- SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
- SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
- TLSH T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
- Size 20KB
- SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
- MD5 6959a6835772c67f4e72105e4be259a2
- SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
- SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
- SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
- TLSH T10292C261986035523EAF019DF1993FCD69A4633080E9FAE9CFA0C636B35D4D335948FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
- Size 3KB
- SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
- MD5 e018dfa2df54c80ffbfd02c6d2ff5430
- SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
- SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
- TLSH T16C61D918252024211F1B526AE55D3E8E69F4233904F8F7E08FF04EB5B10A4E738E5B77
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
- Size 5KB
- SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
- MD5 dee2a727844dd3cea088941e82722406
- SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
- SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
- SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
- TLSH T152B154B2855079922F7D01D2F9D6225088E482715CBEEBC747A1C61CCD1EDE735A835B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
- Size 32B
- SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
- MD5 4ec1eda0e8a06238ff5bf88569964d59
- SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
- SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
- Size 106KB
- SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
- MD5 751e7cc660220e7464935a9b90643274
- SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
- SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
- SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
- TLSH T131B3E73C9F70C4295EE7000B6C28B95846142BD59E87DDC4EEBF7A090272AF536A85F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
- Size 2KB
- SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
- MD5 5330ccc991b45c6f2777d23c7d8afe8d
- SHA1 d11187c035458fe1201608a91062962903de2e53
- SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
- TLSH T1A3414422581030617E7D49DCF59A3F0D29D9613A84C9F6D6DFE08936722E8E734A4896
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
- Size 66B
- SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
- MD5 5b7baf861a48c045d997992424b5877b
- SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
- SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
- TLSH T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
- Size 198B
- SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
- MD5 7bb2f4076e4f47781b77d811b21ef1ff
- SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
- SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
- TLSH T1B4D01250151A5B0D6FEA41D1DA8055241DA19DF474CFF8CC5555B032E68895729C0DD3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
- Size 3KB
- SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
- MD5 fbfc314bba2160b09a3376521c762772
- SHA1 3566357486c5d466958334e813c90c0a97bfc985
- SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
- TLSH T17161DD36C590A9932E5D0C41EEC55E700DD8157ECCA6F4D287B082F8F0AD8977D94BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\Trust Protection Lists\1.0.0.34\manifest.fingerprint
- Size 66B
- SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
- MD5 0f487a41f1bb9a49dfc5814815dc8b1e
- SHA1 39e5af8034fab47bdfbaa2a66455c74185756f0a
- SHA512 bbbd1619eead82c70cdc0f72867db2ffdd4a45cb908c81e852eec8c1293bcafb90c554bc3d51afab7fd7e478efc15aa9ad90fe1b56a01d0012ecee493184d36a
- TLSH T1B0A0024A47C1F51A80D137495D771D41C91755E1BEDF91481A929F2266379C0586C454
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TeamViewer\EdgeBrowserControl\Persistent\MainWindow_75AD616BF1F04DA9878FF44DD080A108\20260721T154510-a1853adf538a~fr\EBWebView\TrustTokenKeyCommitments\2026.8.3.1\keys.json
- Size 8KB
- SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
- MD5 ee666d1b2290efa6cdbc89ea3d317333
- SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
- SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
- SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
- TLSH T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8b8924b0-21c7-4710-b3ac-68769c1d5755.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
- Size 1KB
- SHA256 3b487eb8ef8d1e2cb0b55ee40212f00ef33480176f41d7160a8f5d431b8aa6d7
- MD5 4c3b9f9604028c2d783c1fea183b1ecf
- SHA1 1088e08d6cd2c5b63fb9e818ceeb026d725df285
- SHA512 5156272fc548ea1bfb81e7f2a4aa0d0e0c1d9ee381cd7ca74fb17f2d28844a7e4c84095d57fbc4af2dfbb23e60c52ce8b7bd2eddfd8572b471a3e84b0927b23e
- TLSH T18F2183800EF19229BAC2D31B84784E08C177BC577D686927B37E9C083B825E8DA8D91D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
- Size 1KB
- SHA256 347d739c72c8018f9f802abe0cc9fa462b65f8bdaa63e1caf6d47926b355e34e
- MD5 4c0e28a646abee79b9680b2cf354ddbf
- SHA1 ae9be49cde7a000aa1cfe51f7cfd4d919723640d
- SHA512 b3136bc3490792619effa70e6b1fd5f45acf77e897303ccfeb8d0317866b77cfee32024cc6ba94d1da83802797623d0dbaa53c573efc30593f2ac023b1dfa8f1
- TLSH T15F31C1940FF19168BAC2D35B85784E09C1A77C577C782917B37E98083A824ECDA8D949
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
- Size 6KB
- SHA256 29f96dbe80e25714169ff932eb43b086f8059adad563237832a7b1ca3f547cfd
- MD5 2202542dfbf4bf2bee75595135df27b4
- SHA1 aac759bc145f10c3ea04b03b1343b44008e53bf5
- SHA512 823293f68e882545fc18000c5ad13136fed96f28656d55c9063460b13791141e5ab5aa3d8720b54faf7c135cb3bb163c50c1a6c7f52d57271db577ead4a0f75c
- SSDEEP 96:KhPVxzciBPEfAaMCRPIkejJbCJidJ7qJqBJNeJr6JAlJK1JNUJm4zUJHSJLOJ2rd:szzTmfr+Mqc6OEaGEUQYywaee4yT
- TLSH T188D1C4954EFBC12CAEC5D11B45759A0CC0E628CF7AD82A63EB29D40A3D8DC9DF68D305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\f85739bd-b9c0-4c9d-9fff-beed1b577d49.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8863.tmp\TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\advanced_unicode.ini
- Size 1KB
- SHA256 ee116ba633bbfcc92e7d6473ad23586c83c2702d6f51074f72e9be9716c11d1f
- MD5 2656f63aa8791e4f4a666b400fd20c09
- SHA1 7869f2600bc58f30e27b15c21b48e0e259a188ea
- SHA512 ca4e7457f15949104100ba3da96cb80686091737dfde6b7b3e63d6c34fb3d990ae400659a780fecb168201cbea8c638fe71f15ee36c259e40c87d32de3a24a83
- TLSH T1D9215E133FF80114F5AAF648EEF59431AB397449982DC55E81D10A0F48F9AC0566BBDB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\linker.dll
- Size 56KB
- SHA256 7817f79bcdf54ef8617f15b5c0b9b92053549d5a51fa280722ee7179311b69a1
- MD5 b05a97bb3f532b7cf57b8eedf198d7af
- SHA1 83c13a90f4a3c1c62e132f5f3bc70c97c2ecfc80
- SHA512 40706c5fc72198148962d24046722fc5e488c0cc4b3374a9f4b652175919e97a8712e882940db8c26479619a26ec4e2d41744627a9ca52ec7cb1ce4f91d7ee8c
- SSDEEP 768:ZmTLl3rmEgLMP/rLqgidfwHJQDEExmE+Ji4RdVt//wf/YiWGoPxWEfQy:ZgLFm8OdfwpJS/fqt//wf/70Pxf
- TLSH T191437C12B150C877D81B427824998B169BBA7D111BF5C0833BAB934E9F713D1BB3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\start_unicode.ini
- Size 2KB
- SHA256 8f7c2db16d7783646dea9e5428b0d8221c7848833c96dd9e86028235c8b6491c
- MD5 c5ca6b85a663e043bc6f925ecfde656b
- SHA1 f2c69ff31d2521014ebd6fa7fd91cb9f8eabd026
- SHA512 fd3bedb8a187cba22c5acdc25d7dfc9c9242182eac987ea7590372970fe59ccd5198fcfdc6ff4c000885681b069418c351efccf3301ded43f5211ffce7273194
- TLSH T17F4181532BF91124F5FBBA19FAF584319B3A7946983DC40D82D0090E48F5E90866B7DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\start_unicode.ini
- Size 2KB
- SHA256 8e2be76abf30067e2892205290532554bec102f7bbb5a169f489036f239596c8
- MD5 c2a3136f485d1628ab1cb64e6b3e5586
- SHA1 386441342fb7d7028e958265888f73c5c2360d1e
- SHA512 02a9ddf6cc8f893db8ad005daea1e2450d8c44688afed30c68b69c392904fc4c2f3f421db0cbb20cf2a44fcf488864de65d64fc346e514329100f6c05ed42511
- TLSH T18241D6132BF90124F5FBBA19EBF544359B3A7946983CC40E91D0060E48F6E809A6B7DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\start_unicode.ini
- Size 2KB
- SHA256 c6ee7da824bd6002f57a83671a275d7755f820663bf9136dcfa39a8d8477713c
- MD5 c5c1606affa58bc4cfd8876aae3fad83
- SHA1 e5a96f582ad8e23e36d1ef0b91d54f076809d71a
- SHA512 e2c7c7d746e309ee1a792cedb62eed5569dbffd8ef4c6aa70c1a966368b8f20b8d1836505f9e9716334c99023e5eb80839f1b8e04419ae95aebaaf418904b2b3
- TLSH T15041C6132BFD0524F5FBBA59EBF540359B3A7946983CC40E91D0060E48F6E8099677DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa8A86.tmp\start_unicode.ini
- Size 2KB
- SHA256 7aaa9b5c2e3d1a6809ee8e9b41c599a501ae19328d24f331d5de18b01b5242de
- MD5 e3bfe03cc7600a61c794305109b2872b
- SHA1 46e00690b32e1f247b6a053eec87c159ccc3f98a
- SHA512 759d9ca1fafb24782d9ea380904e460d818f9af982bfdcf973ac3b0ac7bdad1acf502c89f6e6199a42fa6fd31f5ef89acaa1959e17fee7b36bc72734071dbbc8
- TLSH T1D141C6132BFD0524F5FBBA59EBF540319B3A7946983CC40E91D0060E48F6E8099677DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsbA60D.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsbA60D.tmp\UAC.dll
- Size 29KB
- SHA256 b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430
- MD5 488819f838abfcad73a2220c151292ee
- SHA1 4a0cbd69300694f6dc393436e56a49e27546d0fe
- SHA512 b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0
- SSDEEP 384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
- TLSH T156D28D6617E4492BD9231E3036E665325FBAB871097180EF1527D6C53AB0B83BE7C31B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsbA60D.tmp\nsArray.dll
- Size 18KB
- SHA256 8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4
- MD5 9761d708ea7c49662a21f6690d439e06
- SHA1 b2e757e7eee5c788f16d666fb6cf9d41caccb04b
- SHA512 25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652
- SSDEEP 384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
- TLSH T1BC827C638A682C05DE634F7071D8863AAE75BBA1DDE1C1C22309C1215B91781BBEC6FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsbA60D.tmp\nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir160_1247568804\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir160_240377330\bbc35826-f108-4cee-9a8e-bf30d79cbc52.tmp
- Size 153KB
- SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
- MD5 c4a20d073fe58488935da829aae6fa17
- SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
- SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
- SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
- TLSH T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
- Size 9KB
- SHA256 156662d73ea3574a58ef7fd41ed5997bf4d0a7373166adf279d92b8eccd8b639
- MD5 b037916560038e34cdff18458804ec24
- SHA1 fd8ce07940ae64ab0ea95121e38867dcae7a3d31
- SHA512 9faa7e5496e741f857f801f4848fb70b7680456aa4c38d6195e3549eb63dbb9e7c42269ca1459c7e7725d69aef9fa51c19284ae4703a438d4df9a5645c0a9979
- SSDEEP 96:7BJ8NV26nwLKXwC41tGJ0zz6OHgjk6w+/jk/iKWUJrukDouBJnIukgG:l+VmLhctRkarkKKd5Q4BIMG
- TLSH T19F12DF106BEA2556F2F69AB1E6F32711AF36F8129A049E1D408082090D63F05DDBEF77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\kdnic.PNF
- Size 9KB
- SHA256 1c415b1af3c2cfde091550d0a622d3f39a7c3f89f5bc42a8955f9db09faf3b1b
- MD5 47b78fb222c51a03d11d06f9c1bea62d
- SHA1 ba05fea2ed411a32082d295dddb67b53d3689d4c
- SHA512 9f2b668a96ced23b037ee10438463255bc6a545f2311f9b0f9d59f1632d0a04a0f64a76bbdaa2ca99a3fa86f774de800747b4bf8554e642641e8f1acb88cdfd1
- SSDEEP 96:Tss3ok0nM7sOglIIVsZRh1aqgId+i92azu07N1VV0dvzbgsVKR+p5M5+l59uQnrU:lgGnx3BRRjmdvQ83+4lxrmP1Eu
- TLSH T11F22F24577E88F09F1F65A345DF8A5E658667C92AC22C74F6160730E1C32F909BB0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\netrtl64.PNF
- Size 46KB
- SHA256 beac62dfab7b4700a3a5fcf8be9df756ca94ef2c8ef45e73bdf03b9aa4595a8f
- MD5 f874fb1924a42969de474e9652d02976
- SHA1 a9878ecb4c8ed16346d89f868966a872b48e5188
- SHA512 7e58be6d5cb2326747957ac499d0b0b2ffa90fa2f3364dc56206c485c2e544489465522f8a2d4047c2de4fe21b488d7a2fb7e45aed5dca418fe7b9d30cb47f58
- SSDEEP 768:VfjnI5+ZcHl97qFWtBP32IxBZ90K5i4y4TgTQoCUX4G/cFhnY9j86Z5+:VLIsZcHl4FWtBZHf5id4LUX4qO85+
- TLSH T15A237A5037DD5A1DF6F2A9749EF4A0AA8A15BC924D31CF4E2460734F0872EC58E61B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\MediaID.bin
- Size 528B
- SHA256 3dbf5f308ad23ead872df0a9ee60717ac015fe91c98ef953a636f2b2a43514b1
- MD5 05520a9b624b63cec10cc6e7b73aa8e8
- SHA1 8fbe8659f2ddb31b2e282cb32a68fc22bcb4aa49
- SHA512 a737ae31276c16b984130817137f16fdaecf21931bea173e449801080a8a2eb2c4b4af8012b17661ace6d43b1b15fcbe30ce626aad4ca59c57fcd8fa5a2630ef
- MD5 SHA1 SHA512