Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
ninite.exe
Resource
win11-20260911-en
Behavioral task
behavioral2
Sample
ninite.exe
Resource
win11ltsc2024-20260911-en
General
- Target ninite.exe
- Size 423KB
- Sample261024-le6d3ays5p
- SHA256 419e079167012a6474a8231f585fb2f2e3820e8ae335f65e190c416621fe7286
- MD5 ff808fc75480bbca7931cd33b6ea986f
- SHA1 d0b7b2269cf8a62cc089155f8cf9b7ef2d4f053e
- SHA512 05ed5600bbcbd6d60c2d0c4737ef77c21025243dbcf0e9e7ef3a392d53ac8dc7133f15fbc4cd4f1b0e1a956c565ffcefe6eab69a4b277cdaaef64758a19224e5
- SSDEEP 6144:kKWNxA/glpCWJ9CC0ol022SLwFrwTnnYCb9x49q1JNhCZsi7ksvmacDMNiMwtS:kVNx1loVy022SL+G9xxJa6i7BvmZDDMP
- TLSH T16094AE11FA40E436D26709316B5ED7694D7DBCB16F6146CBB3C01AEEA9306C0AB24F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\156.1.98.60\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe - Downloads MZ/PE file 4 IoCs
flow pid Process 15 2820 ninite.exe 20 2820 ninite.exe 24 2820 ninite.exe 29 2820 ninite.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.datatransfer\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fr.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\ar_MASCULINE.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\ta_NEUTER.pak setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.internal.ed\ASSEMBLY_EXCEPTION msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\lib\psfont.properties.ja msiexec.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\mr_NEUTER.pak setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.base\zlib.md msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.sctp\ASSEMBLY_EXCEPTION msiexec.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\ca_NEUTER.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\pt-BR_NEUTER.pak setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.net\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_am.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\fa_FEMININE.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\mn_FEMININE.pak setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.prefs\LICENSE msiexec.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\resources\brave_extension\_locales\en_GB\messages.json setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.xml\ASSEMBLY_EXCEPTION msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.internal.ed\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_tr.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\kn_MASCULINE.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\lt_NEUTER.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\sv.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\resources\brave_extension\_locales\sr\messages.json setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\jps.exe msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.attach\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.jshell\LICENSE msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fi.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\icudtl.dat setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\bn_MASCULINE.pak setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\zip.dll msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fa.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\11f68bde-b7ff-4605-9f6f-20ad20264b24.tmp setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\rmiregistry.exe msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.transaction.xa\LICENSE msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\jdeprscan.exe msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.scripting\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.management.jfr\LICENSE msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.xml.dom\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\hi_MASCULINE.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\resources\brave_extension\_locales\ko\messages.json setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.dynalink\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.security.jgss\LICENSE msiexec.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\brave_resources.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\cs_MASCULINE.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_nl.dll BraveUpdate.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\prefs.dll msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\include\win32\bridge\AccessBridgeCallbacks.h msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.security.jgss\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.crypto.mscapi\LICENSE msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\lib\tzdb.dat msiexec.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\uk_NEUTER.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\zh-CN_FEMININE.pak setup.exe File opened for modification C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\2940_13437307783728612.pma setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\attach.dll msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\brave_installer.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\nb_MASCULINE.pak setup.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\bin\kinit.exe msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.httpserver\ADDITIONAL_LICENSE_INFO msiexec.exe File created C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\jdk.net\ASSEMBLY_EXCEPTION msiexec.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ar.dll BraveUpdate.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_bn.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_fil.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_hu.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_it.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ta.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\brave_installer.exe.{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveCrashHandler.exe BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\psuser_arm64.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ms.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ur.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateSetup.exe BraveBrowserStandaloneSetup.exe File opened for modification C:\Windows\Installer\e5c5423.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6124.tmp msiexec.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_cs.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_de.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_hr.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_id.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_kn.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ml.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_pl.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_pt-BR.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdate.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_da.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_fr.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sl.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_tr.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_vi.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_zh-CN.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateComRegisterShell64.exe BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateCore.exe BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_es.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_te.dll BraveBrowserStandaloneSetup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata setup.exe File created C:\Windows\SystemTemp\~DF00B5845AC5EC0E8A.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{43C4DD34-D4BD-4A01-B688-3D8EAAABD8BC} msiexec.exe File created C:\Windows\Installer\e5c5427.msi msiexec.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\psmachine.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_es-419.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sw.dll BraveBrowserStandaloneSetup.exe File opened for modification C:\Windows\SystemTemp\chromium_installer.log setup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateBroker.exe BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\psmachine_arm64.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ar.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_bg.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ca.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_en-GB.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_lv.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_nl.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_gu.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ro.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ru.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sk.dll BraveBrowserStandaloneSetup.exe File opened for modification C:\Windows\SystemTemp\chromium_installer.log setup.exe File opened for modification C:\Windows\Installer\MSI5CFC.tmp msiexec.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdate.exe BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\BraveCrashHandler64.exe BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_et.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_no.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_pt-PT.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sr.dll BraveBrowserStandaloneSetup.exe File created C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_th.dll BraveBrowserStandaloneSetup.exe - Executes dropped EXE 23 IoCs
pid Process 2668 BraveBrowserStandaloneSetup.exe 3956 BraveUpdate.exe 5128 BraveUpdate.exe 2808 BraveUpdate.exe 3636 BraveUpdateComRegisterShell64.exe 5836 BraveUpdate.exe 5524 BraveUpdate.exe 2476 BraveUpdate.exe 3612 BraveUpdateComRegisterShell64.exe 3048 BraveUpdateComRegisterShell64.exe 5136 BraveUpdate.exe 1900 BraveUpdate.exe 4072 BraveUpdate.exe 4332 brave_installer.exe 2940 setup.exe 5752 setup.exe 3556 elevation_service.exe 1360 setup.exe 2976 setup.exe 2236 BraveUpdate.exe 2740 target.exe 4188 target.exe 4560 python-3.15.1-amd64.exe - Loads dropped DLL 21 IoCs
pid Process 2820 ninite.exe 3956 BraveUpdate.exe 5128 BraveUpdate.exe 2808 BraveUpdate.exe 5836 BraveUpdate.exe 3636 BraveUpdateComRegisterShell64.exe 5524 BraveUpdate.exe 2476 BraveUpdate.exe 2808 BraveUpdate.exe 3612 BraveUpdateComRegisterShell64.exe 2808 BraveUpdate.exe 3048 BraveUpdateComRegisterShell64.exe 2808 BraveUpdate.exe 5136 BraveUpdate.exe 1900 BraveUpdate.exe 4072 BraveUpdate.exe 4072 BraveUpdate.exe 1900 BraveUpdate.exe 2236 BraveUpdate.exe 1860 MsiExec.exe 4188 target.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BraveUpdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ninite.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ninite.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BraveUpdate.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language target.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language target.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ninite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveBrowserStandaloneSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language python-3.15.1-amd64.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5136 BraveUpdate.exe 2236 BraveUpdate.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\ProgID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods\ = "6" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DC05A14-B931-4463-AD7A-72624BF389B1}\InProcServer32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine.1.0\CLSID\ = "{598BBE98-5919-4392-B62A-50D7115F10A3}" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoCreateAsync.1.0\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods\ = "4" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\ProxyStubClsid32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\NumMethods\ = "24" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\.html setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine\CurVer BraveUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.xhtml\OpenWithProgids setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97} BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\NumMethods BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\Elevation BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachineFallback.1.0\ = "BraveUpdate Update3Web" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jar\Content Type = "application/java-archive" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563} BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470} BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598BBE98-5919-4392-B62A-50D7115F10A3}\LocalizedString = "@C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\goopdate.dll,-3000" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\NumMethods\ = "8" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\NumMethods\ = "5" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ = "ICredentialDialog" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43DD4C34DB4D10A46B88D3E8AABA8DCB\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB}\AppID = "{08F15E98-0442-45D3-82F1-F67495CC51EB}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\ = "IProgressWndEvents" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachine.1.0\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\ = "IApp" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher.1.0\ = "Google Update Process Launcher Class" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BravePDF\Application\AppUserModelId = "Brave" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassSvc\CurVer BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\NumMethods\ = "23" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine.1.0\ = "Google Update Broker Class Factory" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids\BraveFile setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\ProxyStubClsid32\ = "{9DC05A14-B931-4463-AD7A-72624BF389B1}" BraveUpdateComRegisterShell64.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2820 ninite.exe 2820 ninite.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 3956 BraveUpdate.exe 2236 BraveUpdate.exe 2236 BraveUpdate.exe 4140 msiexec.exe 4140 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTcbPrivilege 2820 ninite.exe Token: SeCreateTokenPrivilege 2820 ninite.exe Token: SeAssignPrimaryTokenPrivilege 2820 ninite.exe Token: SeLoadDriverPrivilege 2820 ninite.exe Token: SeBackupPrivilege 2820 ninite.exe Token: SeRestorePrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeTakeOwnershipPrivilege 2820 ninite.exe Token: SeLockMemoryPrivilege 2820 ninite.exe Token: SeIncreaseQuotaPrivilege 2820 ninite.exe Token: SeMachineAccountPrivilege 2820 ninite.exe Token: SeTcbPrivilege 2820 ninite.exe Token: SeSecurityPrivilege 2820 ninite.exe Token: SeSystemProfilePrivilege 2820 ninite.exe Token: SeSystemtimePrivilege 2820 ninite.exe Token: SeProfSingleProcessPrivilege 2820 ninite.exe Token: SeIncBasePriorityPrivilege 2820 ninite.exe Token: SeCreatePagefilePrivilege 2820 ninite.exe Token: SeCreatePermanentPrivilege 2820 ninite.exe Token: SeShutdownPrivilege 2820 ninite.exe Token: SeAuditPrivilege 2820 ninite.exe Token: SeSystemEnvironmentPrivilege 2820 ninite.exe Token: SeChangeNotifyPrivilege 2820 ninite.exe Token: SeRemoteShutdownPrivilege 2820 ninite.exe Token: SeUndockPrivilege 2820 ninite.exe Token: SeSyncAgentPrivilege 2820 ninite.exe Token: SeEnableDelegationPrivilege 2820 ninite.exe Token: SeManageVolumePrivilege 2820 ninite.exe Token: SeImpersonatePrivilege 2820 ninite.exe Token: SeCreateGlobalPrivilege 2820 ninite.exe Token: 31 2820 ninite.exe Token: 32 2820 ninite.exe Token: 33 2820 ninite.exe Token: 34 2820 ninite.exe Token: 35 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeAssignPrimaryTokenPrivilege 2820 ninite.exe Token: SeTcbPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 3956 BraveUpdate.exe Token: SeDebugPrivilege 3956 BraveUpdate.exe Token: SeDebugPrivilege 3956 BraveUpdate.exe Token: SeDebugPrivilege 3956 BraveUpdate.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe Token: SeDebugPrivilege 2820 ninite.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5528 msiexec.exe 4140 msiexec.exe 1860 MsiExec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2668 2820 ninite.exe 91 PID 2668 wrote to memory of 3956 2668 BraveBrowserStandaloneSetup.exe 92 PID 3956 wrote to memory of 5128 3956 BraveUpdate.exe 93 PID 3956 wrote to memory of 2808 3956 BraveUpdate.exe 97 PID 2808 wrote to memory of 3636 2808 BraveUpdate.exe 98 PID 2808 wrote to memory of 3612 2808 BraveUpdate.exe 102 PID 2808 wrote to memory of 3048 2808 BraveUpdate.exe 103 PID 3956 wrote to memory of 5136 3956 BraveUpdate.exe 104 PID 3956 wrote to memory of 1900 3956 BraveUpdate.exe 105 PID 4072 wrote to memory of 4332 4072 BraveUpdate.exe 109 PID 4332 wrote to memory of 2940 4332 brave_installer.exe 110 PID 2940 wrote to memory of 5752 2940 setup.exe 111 PID 2940 wrote to memory of 1360 2940 setup.exe 114 PID 1360 wrote to memory of 2976 1360 setup.exe 115 PID 4072 wrote to memory of 2236 4072 BraveUpdate.exe 121 PID 2820 wrote to memory of 5528 2820 ninite.exe 122 PID 4140 wrote to memory of 1860 4140 msiexec.exe 124 PID 2820 wrote to memory of 2740 2820 ninite.exe 125 PID 2740 wrote to memory of 4188 2740 target.exe 126 PID 4188 wrote to memory of 4560 4188 target.exe 127 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ninite.exe"C:\Users\Admin\AppData\Local\Temp\ninite.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\330736~2\BraveBrowserStandaloneSetup.exe"C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\330736~2\BraveBrowserStandaloneSetup.exe" /silent /install2⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdate.exe /silent /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5128
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3636
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3612
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3048
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4QTJBQkE0RC02ODk0LTQ0OUUtQTI5Qi02MEFBMDZBOEQxMzR9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0ie0UyODUzN0U0LTNEODctNEIwOS1BQjdELTMxOTJCMUE0QjJEQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE0MzQiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5136
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&referral=none" /installsource offline /sessionid "{8A2ABA4D-6894-449E-A29B-60AA06A8D134}" /silent /offlinedir "{406F148C-04DC-41CF-A93A-6AFF05E99181}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1900
-
-
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\46A101~1\target.msi" /qn /norestart REBOOT=ReallySuppress ALLUSERS=12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5528
-
-
C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\521F4E~1\target.exe"C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\521F4E~1\target.exe" /quiet InstallAllUsers=1 PrependPath=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\Temp\{0C141F3B-A406-40F8-B2F0-F40A60A6D615}\.cr\target.exe"C:\Windows\Temp\{0C141F3B-A406-40F8-B2F0-F40A60A6D615}\.cr\target.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\521F4E~1\target.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet InstallAllUsers=1 PrependPath=13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\Temp\{0A342CF9-00AC-45CF-A6B9-86A25F128908}\.be\python-3.15.1-amd64.exe"C:\Windows\Temp\{0A342CF9-00AC-45CF-A6B9-86A25F128908}\.be\python-3.15.1-amd64.exe" -q -burn.elevated BurnPipe.{98699428-092D-4155-9CBD-A43518E87BDB} {F08FDEF2-A657-4947-9AA0-03EAF3022625} 41884⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4560
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5836
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5524
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2476
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\brave_installer.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\brave_installer.exe" --do-not-launch-chrome2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe" --mini-installer-path="C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\brave_installer.exe" --archive-resource-name="CHROME.PACKED.7Z" --archive-resource-type="B7" --do-not-launch-chrome3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=156.1.98.60 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff719c54f98,0x7ff719c54fa8,0x7ff719c54fb84⤵
- Drops file in Windows directory
- Executes dropped EXE
PID:5752
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=14⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=156.1.98.60 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff719c54f98,0x7ff719c54fa8,0x7ff719c54fb85⤵
- Executes dropped EXE
PID:2976
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4QTJBQkE0RC02ODk0LTQ0OUUtQTI5Qi02MEFBMDZBOEQxMzR9IiBpbnN0YWxsc291cmNlPSJvZmZsaW5lIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins5RDI5ODc2Ri0yOENDLTQ3MEUtQTU5RC1ENDJBNDhBNTNBMzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntBRkU2QTQ2Mi1DNTc0LTRCOEEtQUY0My00Q0M2MERGNDU2M0J9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNTYuMS45OC42MCIgYXA9InJlbGVhc2UiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHVwZGF0ZV9jaGVja190aW1lX21zPSIxIiB0b3RhbD0iMTY0OTg1NDI0IiBpbnN0YWxsX3RpbWVfbXM9IjQ5NzIzIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3556
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FB9E1EFAAC9D2350C6F4E10715B334A72⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4988
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5c5426.rbs
- Size 103KB
- SHA256 c7904370bc8866b5f1cbb3b67ec19424e2e8b0054d0e32b4af3404b6f5a392c3
- MD5 72a34bd5c458c3850f1f87aa58efaa24
- SHA1 18e0492da33198ca19fcaa528f93b10ef1bbcced
- SHA512 d9efa66414a7178b37fb9125bf2417a283d836402b47aa13a6560d41cbd49a6623c6aadaa0858580fa5b383f939a7c60cb4a9c23a73f0e9bd031723784684562
- SSDEEP 1536:I8+94RFvrUwJYNet00s9EBKE6QGzYr/9gWVoGs539Do1Ubp13hfxw8Fo1qPe63PA:I5ItXNiceOOdP2Hj
- TLSH T138A37AB8FCB5C9F6F5C32AE65BC8590897658E7DDB09001D3288836ECED25F68315E60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\BraveSoftware\Update\Install\{A265D73B-C3CF-45AD-8CCE-FF04477E587D}\CR_7FFB0.tmp\setup.exe
- Size 7.3MB
- SHA256 b4e65284792ccd0af986e5dbf1344c4f2afe5b19c332cab58471ce2f4552f0b6
- MD5 5e609befe96e3ec68f65b28e3e7e20d8
- SHA1 4348f72a95e8f6caa98f274e9ddb5c905f7c94f9
- SHA512 8cd3b34cce21ab91ff9e11a666ba2f1baf8db07c7e197fbacaaa2245959238a6af944fbf0f876a0bbe2cf671b3de6540a101eb81c9321b961b041164ea58279a
- SSDEEP 49152:AcSU6dIODT6whFAXZzctMLqv8tYPDFh/wc0Mgs5eNieCRt7Vj8FNJ3cvWNEvEsXA:TkdgyeCJVukvbXU/vtHOV+YEMR7O
- TLSH T107767D03F3A501E8D06ED9748F6E5132AA257C8A47B4A3EF1AD436E51A71ED47B3CB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\af.pak
- Size 721KB
- SHA256 8ca12c27695ce23a24516c6a5215c915daccebdecb91ad8d7d9bc2455e288dfd
- MD5 cb5a4f5288dc8b7863ae22d263cd308f
- SHA1 fc6d68cce58145d5976b67aa29c7cdc4d6fc09c7
- SHA512 6c22349b605e8533334a28e4cc988b6d0c16d7c31d46d8a9d42de0f37d88543049ffd741dc01f4d7fc7844e33dbbc751886212b68ab6f93c6065d663a0c2766f
- SSDEEP 12288:OmnGRYfxzr5iif90IognNxxV3lIVjJN89AH2JynRFDTe0zDfPHozvSH+2zr+U+6/:PEYpz9iif90IognNxxV3lIVjX89AH2Jq
- TLSH T19CF42C0BDB82233D09A02296BA0B45B7FF9DA16CC770B2B6DCAD91351562EFC117E1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\am.pak
- Size 1.1MB
- SHA256 cbf5eb089344c052b0c71d9156a0fca63d73af0b97e49288b418846112c3682c
- MD5 4fdcb36a9ebdd18d8e67a559f94121e6
- SHA1 c05d30f65ef6a40ec1b4fccdf9b0510ad731e03e
- SHA512 2f6fdaf6cc4e4b0e3b92123d9c7e1597780080e63a12fb23ab0ef42984e53d96a338b659a4b8bcc483d053fe75855942f7898cf1aeeb01e328ae4712a0792f4b
- SSDEEP 24576:8+T4L0HQmgfhTCVlpoGti/mPbAFtzx0qX0Y/dpda4BcE/vOskNjTx4iT9DPzRafu:zTkV1Bb0z
- TLSH T1BF45AC547EFAF7270F8E4A1994221E4F9598AD4652802C38C35AE3FC2B2DF1B4DDE215
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ar.pak
- Size 1.2MB
- SHA256 bb4283fe10e8398f4b30e0dcec22a72999a002071e0152add18e4da012e119a7
- MD5 bd32ff7b269373805873ecb58eb44b1b
- SHA1 288e42e156aab9986055203e479ee1c4076d0e85
- SHA512 731970d6f860ee61cff655a91bf9b7690bc30ae1940ea1f2b989673edaa826376e516c195fa373acdb31dfdb6705d9a78cc3c365002ee7944be33db28d956a43
- SSDEEP 12288:qblgrUiR9S+kIF6OKm1QWcZk23Vnz7O7kgNSvgK0EO9xe3VZzKUgEhTAON:QIZKQK3
- TLSH T192459AE21F2684720B56DF0ED1E3356CE8B2AD23DB4BFC3124935A2156D7913E64E638
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\az.pak
- Size 828KB
- SHA256 b334a1ac2c25d308d4ebc33a802100e078190b6055553bbfa68f79aa95b87c9b
- MD5 5b7114d8f484dbe2a37b74deeeae0b00
- SHA1 8af48eef4358cdbce651f03967d8d7c657d2cf72
- SHA512 951eb0cd1308def78594ab798a92c52e40686c518c097c69593dee8fb098befe6e70904812e623a05217730333451b0aba8ec26b8bbecbe554eb5b8f39dacdcf
- SSDEEP 6144:K2a3XdVm/uMLQe4WJD3DDt+Qc1smo6FQVVHTuJDky0ll63FFj8morCCm:WXSN4WJ7DDt+Qc1hG/TuJVm6VArM
- TLSH T1AF05F9852A4F5C1C47ED13CD08A3A77AE88E3BDE749221539585661C23DFF238FE4689
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\bg.pak
- Size 1.3MB
- SHA256 ca08c68ca91cb9f45bcfd9a5344ffc366c8458da72436abdf2cdc315bc00d9b5
- MD5 78e2b9a8193ac685dd86f8c2c803faa2
- SHA1 9504de232341f0ebdc15bca7568d99cab63af4a3
- SHA512 efc7a6fdd18ab58c9267ca52045c4ec7f96a4730f623ac8852f27635f98e8a7a001f2289ffbb57ae98c39c48a52a630db3120327324cfd52ea41cab2fab1ef8c
- SSDEEP 24576:hvwcOXL8yFWyT2LYB8h5rzQkECzU1Vb6MMJf/rA5VIKAUZVDSrY87Qu2V4C9jc0P:+cOXgyFWyT2LYB8hayU1Vb6MMJf/rA7T
- TLSH T1915535A15B9A68DF0101F41F98097E093CEB84FE3FE7879241652DBD39E10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\bn.pak
- Size 1.7MB
- SHA256 be0e441a139a34ee8815f22cf39549a9f51192f41b9b59886cc690d72c3fddb5
- MD5 17269f5f65ae440fd67cf8e98976be65
- SHA1 074726a174a63c730e7db194de99d45768fb8170
- SHA512 88b03b347977d2c094e95a1b61b6f86a1fe984ba93fff4effaaf0a4ad0f7bb06fb41ba2ea05600a2ea2617ff22372e46f1c1ecf58c55203903f14a5e610453b8
- SSDEEP 6144:w18gERabyK+K16aACUbKVkDlBbgX0MviW+4jS:w6lMlB1XZVeMkMg
- TLSH T14685FF209C6E81B2A8C5CDC9434C6370C123AE979B61F74DDC17A25938ADC7C8DADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\bs.pak
- Size 805KB
- SHA256 ba43b92b8f6bea4754bae08bab188a1e1048bf1e9e8052d7024411452d8b5188
- MD5 ea7d58e0edc2c1ced9a13726865d3689
- SHA1 fd9ce6c3f23f76a33c51b78330138977568b7e95
- SHA512 61dfdaf5322ec5ab8000e8f107dc26bd72358dd513db2341a88a612b1278da3d50e385751f5e2b9a87d84ddb96dd295d4a2cc643d0b619d2e4356ea63801fc0c
- SSDEEP 6144:S70m2T8yCjF7KOD+OPNzUrUJ3uA+HwQzY9sYdcvcK6bsjgVHh8mEhO71O0P+lQ7y:y4CJ7hN9NgQMgr8N0P+lQapLL/d32Q
- TLSH T188051979BEB367190C975385EFAB8751BDFD088CE545D7B7685FB22A0042F0C22B9608
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ca.pak
- Size 828KB
- SHA256 9a049bf540275dea85b4a6548e1f897ef1bc59729510be83d5d8995d940b1c9a
- MD5 a1401760cb27e528fd129114adbd934c
- SHA1 8737856abda30dfa880d73a18921288b9007705b
- SHA512 5d954d6684c3aaccb2fb7b3e3164091c2811e3383522f0bdd637efc3b363e43d9a3c3cfbb7b6e0b75eefad51689040d228edb1d85a68205fb678c7ff5ef25afb
- SSDEEP 24576:ahW2hd0AHyLyEjDJMKdiyzFG2htKnINCHCuiB9:ac0HyLyEjDJMKdiyzFG2htKnINCHCuij
- TLSH T12B05F9238BC93B7644D3330AFB43C257A4DCA9847A06D255F4AF2A1622CCEDCC677695
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\cs.pak
- Size 841KB
- SHA256 1c69dad39bc94d64dde5ba1a1007a3b063eafb8d6eb9433bb994b1da3138866d
- MD5 deae6c25d71b92770c08719795a2d3d6
- SHA1 af17444476b76b80d484e0260f07040c5599a492
- SHA512 184d85a365662bc442cca749af767053ad7de457c00e7c78dd1fa176d5044b51ddb1adde16f6f7e707042dc7fc99f546e05090db85a18f936f132da8e75424a2
- SSDEEP 6144:GaS92ZZwvTtCxAvQTtau+ATQguAeHyJy8WZ8Uq8QNswSPFGshUj3sIR:GafZwRCxAv+XkSJpWZ8UFPFGshU
- TLSH T1E1054B1EDEA36535584002487BBB4124BD9E83140B6EE6B77C8FAC912275F7E8EF0D58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\da.pak
- Size 761KB
- SHA256 099a68ff7be6d27e108635bbf03c17fc9864e87b81a8e97f3aac9687462bf9b6
- MD5 49849dbafd8a3b4dccd64398b44fc68f
- SHA1 28418633250465a45475cf69a89768c098c559a2
- SHA512 c79b5761c6cbad1fc9fbf85dd59777c4755c7622757f2c987a7f9141f789b849300b4d92b29a0cb7fef37f7c94ddbc2bd19f3ec8d4b5f7334eb4b71d30bfd60c
- SSDEEP 6144:cIUToEP11utKwQpsKzVEySrCMnJn/OnJnnn2nCnd6LjEN9jnMw45JwCVyzS8eS/d:c2OXoKppzL9N8xi++sCn
- TLSH T1D2F44B4B8C9E733ED9A90629F2038EB7DB9D443CC684575F64D8A03A09C7D7096BE1C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\de.pak
- Size 836KB
- SHA256 2412dee81fb469f246a018c320bdb3c07e6b2a70cfedb19b0290f35b0453f605
- MD5 31d30727490722ae5dcf5a6851995f10
- SHA1 60fcdf25c5c0e4acbbcf5a503020ec1a631cdd24
- SHA512 51842a9ae9453ddcbe56fcf17089e922cff51941ed72d3675ed8eed579bff5e5fba1768bb34c19944720323172c9eb8a93aadd42a50faed1755968dff52a75fe
- SSDEEP 12288:yvvuGlTCXrlMMXYWkJc98qDdiszhQvjdCH4IJTfi:yuGRCXrlMMXYWkJc9/RiszGvhCRJTfi
- TLSH T1F5050813ADDB626EC64233657702CDB77B1DE36FC345326684EDE02B614B9B282BC425
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\el.pak
- Size 1.4MB
- SHA256 19e26022e89b6cbdd43024ac393af84bd73c09968c27c5329493d292317a616b
- MD5 fa8d51dd7aff371bfc626f28bcce1be0
- SHA1 50e66d55aa1381380116a1fc84ea965f899ab316
- SHA512 259a520bbdd4dc47bc31a6cc5d008aed38caff33311b06d196efbf34cafcb8c7a5cba53661118fa3334d2bcd3b08e9f86fabbe32b1bff20f12626962c3733c15
- SSDEEP 24576:yNg05hs9Q9TtGw0p8l4H3t7nAmwhEZgq+e2uSQ8dgLH0F1v3GvgotQs9CUKHjxHI:yNg05hs9Q9TtGw0p8l4H3t7nAmwhIgq5
- TLSH T17E65EFEFB4582DED8046950785D8B07C37C66D6CE749CBE86229CB60BDF80719A22D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\en-GB.pak
- Size 668KB
- SHA256 71851ac2953d09d3dde9d9bcc5cc670d86d25cb48a17a4b75af8e9c7f0638cf5
- MD5 68323746a904f444dc4ed93eefbcab04
- SHA1 9746caea3a8018863d3d6ecd3a8349c6f1d7c753
- SHA512 69303cf87be33fd75b2af742d7749d198f7294ec9449e9056089c10273888dd7641eac6e9684f60d190b22e728e2b554d8d727dc1c30d54653a2d2beb5b0b316
- SSDEEP 6144:2rnCTMxWlC6U6EYLJOE0J8ZiMf9OW843faYVIYNlo1NzY3EzDJjfKufCF:kxWlCfbMgW8456Y360
- TLSH T1A2E43D1FE746133505931152BB0BA6A2FF2AD06CA36113653CBD901C3376F6AD23B6E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\en-US.pak
- Size 674KB
- SHA256 2f8ade0d185d011afbabb4d862282dcfabaf9ca24d11d896e4bb1cf36bade459
- MD5 d74bebf405e8d1fe3a982b6acac40efd
- SHA1 9c253ed9467105e5e78970d0df612a8d425e4e5e
- SHA512 e7e3e833fb2b6ddea12558b603a5094bb9968c469ae340d1e510f07dfd7bac65c01878d43681941c30abecbd1aecd021773da5abfa511f5e87b280d9dd1de15d
- SSDEEP 6144:0wFEWvf7lmsl+Tag2UO9nVvkwWmMf9UWDCofaYeI5B5H67wi5/OUTyjijjiL0f8H:pEWUy/7MSWDCu2woOUgv
- TLSH T184E43B1FE746123505A31262BF0B95B2FF2AC06CA36153653CBD901C3376F6A927B6E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\es-419.pak
- Size 816KB
- SHA256 ea9856b2c46c04b383f33e8a7fe3a8bd2eade248ef077a1093fb10e0a40535ff
- MD5 e7854d194760c5cabe1f52a8b43d84f6
- SHA1 a7f0c0b076bf84688238a31193032a05d7937e45
- SHA512 87bcd1be864cf4edaba209ce4690fd1c67fd84625c0fb632fbebd3cadfb971956ed2011d8e1240de2d099ae876e2bb183223888b4afc1d84ade9db4ffccd88a8
- SSDEEP 12288:pkL3k9CmkZsAOjhiRgm2jhEj12OwYsRw1t:S3gkbOjhiRgm2jhaYOwYsRA
- TLSH T1D9050822AEC91F6314E35349B343D753E4D89544B408C29BE8EFA66622C8F8CC977ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\es.pak
- Size 812KB
- SHA256 475f16c034b8ef5796efef958fa1e911f744a90c93e1b9ad4083e513c58f2034
- MD5 894c91be4347ffa964eb517789b5db2f
- SHA1 7ceb9cd7e25555fc3effca3632c1562852f8eb39
- SHA512 b06ebe3f037b112412aa48107c19e2201831d2334ef9281a90fd9a04c2f2b687b48d82f0feaad5cfbd5359a5bb4507082766d51ce164a2012f672c846274fc6e
- SSDEEP 12288:yOFWqAGp2MVE3J2uumSJvE8jtMLp3Eo2MrxCO6DETSN2:dRVE3J2003jkp3Ei8O6DETF
- TLSH T1EF050722AACD1B7314935349F743C753E4D89449B408C29BE8EFA66622C8F8CC977ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\et.pak
- Size 740KB
- SHA256 d71afb04d05b4fa94203b094d1f9215710a817855391ca16b341dc446248bc55
- MD5 1961828c9ab5aebbfd1cde2994237e4a
- SHA1 4f7ed5e3c499fd3fbe367bda6e611cbefc755993
- SHA512 d8b0379d4788f686d6cb1d8d053d2a9ee91e02a03f0290952795ff966f261ad064331ca6bb285f01791fde0dcf19fc0270403cead04bc988798ce4648a537f98
- SSDEEP 6144:HKml/cfTb3VpTOv9ErP2H+ZEpyM0fYnFn+/Wg/B2YNilwNyHZ4SYpN1kknimTjHD:Hbl07b3Vd2WECYnFn+/Ao4YD3
- TLSH T1AFF43B42927A7727282412F9D7239963CCDFD3D970004D97789A6A0971EEFCC38B6B64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\fa.pak
- Size 1.2MB
- SHA256 a8197c64cc13c67e36b63cba1ae62e2b82b49178f315185bf428946c55ccd923
- MD5 4f117578ea082de43067f5c86c46b509
- SHA1 f3f4d1430fb549dc9756ba469c710a4b38f4fd38
- SHA512 c590cb0b5dc6ef4005de7e049117563ebbc56657c8f97dfbf0b19022becd55512c712e36e23a054e551adbd5021e7f1e9153c0ee4048e0144ca4b9e7faa05507
- SSDEEP 24576:GSBu48IpvHuDndP+sySvyYbEEMajquG62NZkjG5JFR6a3/+G5+XBwn55gnXXayet:GSBuVO
- TLSH T1A445E2956AAD9AB25746CA0341E33434C773EF12D348FE40BCA1076609A5F139B5FA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\fi.pak
- Size 757KB
- SHA256 c6f2bab6a8d79ffe9834bea22c56482edfd3065158232f93f37298c2677e11b5
- MD5 773dfada21799aadb92f0819c4ffb752
- SHA1 ac3dcf2f95890a3f5cf515ae7083d2e20dd75e9e
- SHA512 69ab9965b72e01ce8cdfb21278299c776544e9c5cdcbd6d12c5217549a1db9f4c64afad7a5631ac7c86d52c0194c3fe93869df6acaceaea19d0ea9535b809fd2
- SSDEEP 12288:r9Xm+sRGEbtIoGqVvO9hSNxbUUql7hcqBNX8WhsiOc9EoTkycrLLa1+Bd3ckNwvz:hW9Q/wa
- TLSH T1AFF45DA14616C23137C4828E69B1903AF1E9D39C8C248ED5F847EBD509DADC87DB277E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\fil.pak
- Size 844KB
- SHA256 f127b5c080a7861f0fd8036c41e0b10e44939b15c7d236d5d9ccd02f60e96471
- MD5 15d5bb571aca088053e07bb0bc763ae7
- SHA1 4b25ac750a03a5429f1feb550af96afda15c2d55
- SHA512 72947d74a6fd0a6b6bbb393637844301a69ee94afa647eb4ef481bb7eea015283bf10c0696dae5c75c22ebc116438b2ab189516c2667aa193943e4dc15822f30
- SSDEEP 6144:G/GjQW57dEhrikmmIDQcLA5CIqO61iepIasRlpYuA8Yx9EqrmUrRyRxVj6sur5Dm:GQLdervxYq
- TLSH T17005E71667402354DBC312E55262782FAAE964B83F826D6E4FFF32973BA3CD5D230581
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\fr.pak
- Size 878KB
- SHA256 05a4a36a23f0dc415eb76048aa7efe3746bb0278ae8aaea13fb2df9e69efb1aa
- MD5 541956e41622691622a9d9ec3eccd10e
- SHA1 8ba026eaee9efb9373a11e9f1b8a7ff2a14dab8d
- SHA512 db6aaab333ac80a039858fe784d078b3b23734562f8b17bb47d112a27dc41dfd95d31fdac4d933f806a381c7d2fbce39019bb6a9e8a0a2023ad01b74a0a4fbb3
- SSDEEP 12288:dbKF/0k+ZLX0U+43WHbaUv+ThgVh8tvH/kbtCGiiYnYeegzjwowDBj9iltDA3xmz:tn+VpLrso13BY
- TLSH T12915E86FAEC431C719C203A3FB13D6A7D9388248F215D344D89F5295129ACECD3AB5E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\gu.pak
- Size 1.6MB
- SHA256 57ecd768981003b58f365c4eafaacfa4dd0f2d76e041eb1b22d895278fe39f42
- MD5 44acdce255262efc97a1cb3ec1363faa
- SHA1 4955440064ab50df5fb65032c1ed1be9903bf4bd
- SHA512 8306722cdb3b3cf60a2db3af3d18f02c862b854113d6f04b046542156913c3b52e47b867dc573295ac85c7d6f485a254ddfccd394173a5b441e4146bd6f31ca1
- SSDEEP 6144:ZOFAjeNa8iMeINMAbQsxjqRB6tsue5l864BjZ6ybRsLxkjK:ZOFAx8iaNMAksxjEB6tsue5lue
- TLSH T1ED8518D0D7B9F07119CA9F7E819E512086699343D57E230051CEEE898801DDE3EFEA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\he.pak
- Size 1.0MB
- SHA256 0a9a812d1c2f063a224f849561b3d2135527f8787f0fa48839b6137dcbeb73e1
- MD5 4d36b882fef31eadb93ac4279c001cbc
- SHA1 22305a27de6eebc4a16d4fc544db4f00f210d9c5
- SHA512 a555a35fa47afa4d74308072d8e40ab135ec340b8fd64a68036e4b8142c7a834a459ed014a34b5c10e1a454df07226148538f412b9f2d0b78a964d1026c345b1
- SSDEEP 12288:F7oVSOoJOhn6XI9AaQsXBGu5rSSomJOxy2Nax6i1u7X9IeQCajn6D6Z9nfL5fumV:F7Eoir
- TLSH T19335CCC4A2D5422551316AC39FA5FA285FF3CAF53CA23516CB08526CAC778F4BE530B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\hi.pak
- Size 1.7MB
- SHA256 08aee56bf7e87b027c28616380facbe27454a4fc1e724b5a9b62ea06856983e7
- MD5 0ed0a35b09aaae2070aeac21d50b7781
- SHA1 ebda167010adc591f62a1cf87c304452f7e169f2
- SHA512 0d695debfbd0108dc3781e98f12bc43e6601bc86447ad3f9aa9c43ecbfac2e34f98047d25577df869c21e746cf62d58cf9b3842d6904182e32f37233bf686ca8
- SSDEEP 3072:8p0/bJSTUFV9J5Ychju6ksBhnWN/tK2Bq2exQOAGsn0NUSr951QQMWJD9MwcGyLH:WZ0V9nM925/LqZXQnnZjj0
- TLSH T12B85E20CEBBEF3B55DEC3C9A32890D37C59C3674A3E5526348D5B3DB9444CB8146A2A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\hr.pak
- Size 815KB
- SHA256 adc20d84a2a0d2f52fd07f4a779e513cf6291ecb964b1ec7c40568024c5f5f67
- MD5 656c9c9b27c9863a1bb30d206fe1d8ca
- SHA1 6d814f9b0a0ed3084e1df26a762879480468e3b7
- SHA512 3d89291b2a2dcd571028019de89264e73dd20498671c2d654621768d20f769c909e6c262f1d3b4c5b93ddb07821859b0624ffd2fb91427745cbfeec516ed64c4
- SSDEEP 6144:VV2ik4k3d6MopZLMRWW9NfYZo7JyOd+DkXE029RltB1dtXz+3jZOd:V3Od6eOsnyRtV+gd
- TLSH T1C905297DBEF357090897628AEFAB43457DFD089CE52587B7684FB22E0003E4D66B8149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\hu.pak
- Size 875KB
- SHA256 0baadb56ee8bbb349d4d7fc16793f48aaebdc5dab4cede003b0e68b6d6a94eed
- MD5 6890f3b77bdbd21fa9882c4ae3cd27c0
- SHA1 960c51fe83ae2a4bfbde2618a734960042ab6317
- SHA512 9fa966f41f65fc1b3996e1536bb516e7cbd6a4fe9ec83df2daa9e6aed62001fa024fd2feeba024680616bb93efcb72783f079b4045cddd23568c760dd4b94e59
- SSDEEP 6144:5ztOSm+45b7+3JUoZutehBPHERjt9CpNuoxyXlH2EcaldHslgHhKp7uI8598eZ9s:5QSmb7+5d4zFg8598D0jH7U5
- TLSH T19B156BB787779055BC68078778663B15596E88179B2B22FB2CC3946D3490FCD0CA3CAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\id.pak
- Size 736KB
- SHA256 b19c10275e3505f73072b81774f19ab25b5274089735bdc893b05dc1b9e842dd
- MD5 3640907bd0abc7e624d1e81d080affd5
- SHA1 f53d64ce608d95bed6d34d4706b4680fdae8a5e0
- SHA512 800c3e5855ec801df3c40f28035acc43c8c3cd07aa83333c3c4d25b06cdbd09d454ba737bc400c9c948fb679d1e67577c2e903751b4526efd965cb5544e9dacb
- SSDEEP 6144:+u7nx4RuoCu1OMzWtoVPgLimf4ETFjlFCm4oYbOV6PNL4hBXbGnvq6yH3v/lihjB:KIobWtd24TFjlFCmViPNJ43VQ
- TLSH T139F4F8531ECA351C194503D9E2CFA91E3CDE233BAF05676E8E348F7015A6F682726B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\it.pak
- Size 805KB
- SHA256 f831127119b8dbe82ff11443c7b5280b72b708cee9dd4352fb00395119ae5bda
- MD5 7fd503a6dbc38e9d4b706d5e4331c9b4
- SHA1 43712b403cc5dd8c843106ee3414ecbb87db84fc
- SHA512 eefb81f08a6381ad6218a35bbf78b6259c4bda700d7278c02a1288d3e4d7d9df8a4cc6e330edeaa8fed8e107ed2c1dc3bc116b17682f729d45b2ad4dc56d9549
- SSDEEP 6144:ZePb8zixe6D8nYUxIk+DguRjidFpkkBnTDSOmCfEs51ctz05ahCZjWP9crGqpzSO:S5Y6IYUx5NsU85r44TC3Zl24wSTxQ0h
- TLSH T158051A3A99C7252119971359D612F085FBBEECCCFB41722CD99B131C22CEE84E1BDA46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ja.pak
- Size 973KB
- SHA256 51dcee6c33f09edc6bc173ba798fd45c0f7a62103991e51d4bdcbf513c08aadd
- MD5 19c6e17b87bb3322c8fd289c51396471
- SHA1 1209b951eb8d081f173d9a2c231981ade67b4566
- SHA512 53f5af6a6bb8970e41c7cc73999d33bfc71091d69be74d3bbd42076a3976fecaa784018b0f32d5e8ddfcf1aff75ce6f8b6a8727bbf5d61f5e49b1e7b6746a9ca
- SSDEEP 6144:aKwocuWZjvFQW8zqEe7pbiXd94Gkw7yrO6b9XCoE/+YVFgPjEXvZjHoy:ad3njvF22uXd+w7QOmCoE/+sd/
- TLSH T1BB254F7CE3C668369D2152A22C4E36D5750AAC9BFCA23B36403DD075BD70BCEE415AB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ka.pak
- Size 1.8MB
- SHA256 108b24da2fa660324f42dd3b01819d7d64de60268b3eafc3440f28e4fe3fb1bd
- MD5 ae8c88551fd7e562c4953d9f1e1ea592
- SHA1 19fe16e61576959cc8a8d98d4c34ab0a5af5a3e9
- SHA512 45a0dab76a4ca8af5b1d70b4cb95df6e77e5d4f5123173aa8bfa150c3c14722006abebe99df4354ca5de9c083fde5139543f49e55a6ca64c96b14108dfb68351
- SSDEEP 3072:kNnsvM9PZBLvmV764cBrFNaGJOXuorYDkgPzmRFIG1yZGtlNmUnXQ+jNwWc+9OK0:kNbZBqqBrHaT9UDkgY4ONmlOQ+HjC
- TLSH T1C3856E5139FF37709C5E21154672B78ABBA48C8FF0C8843FD111F1A27952A056BBE3A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\kk.pak
- Size 1.3MB
- SHA256 1c799ebd77cf958de618eaa9f9f0033a44da7eb7828029648928a523ed5756fd
- MD5 70b86a3e506faa344a051006f50c7d18
- SHA1 7f1c5c0fb16858b6e759a90af91203c8f54ed00a
- SHA512 566ca4d798a5f13670dcb113a60abc635c7bf166c5167a8deb5a51e7e4be41bb5e75ac1ccc5688295891f3ceb3e99c406c917e27485d8057970c0967ddecaa62
- SSDEEP 12288:WfZPMAMiMEHaxKJYcV88JlADdLvmZXD8g5rLwTyeIjbP7lyCNPUghRz4mVUTNXgz:O1BArZC
- TLSH T1E455BC91664BACEFA311E6836D547A196CD514BCBFE733522052BD7E78FA2B0463C302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\km.pak
- Size 1.8MB
- SHA256 7c7de22af0b1f83f1246d5b2dfc0fd5f05552d74e1cdb449ffd6f3bde09bf30e
- MD5 8b04979665457e1835429c0635a42e1c
- SHA1 874d8b16fba19139beb71ee184c7bcdcdc2b3e7b
- SHA512 b29aa2bff82ee62983cef9721583fff4c5e1aa264ca28ae8fc09703c7cee2738c2bdd23bd6869367630a16c5fee80fe0af2f24b510d6f53b61049b709139a2db
- SSDEEP 12288:Pl/zDu3I1PztXRhMKArn5+MdkmumEW6+BgeYWi8MzH6WqFIHE0+pARbrjKQ0hQqh:PFeslb6
- TLSH T124950410AD95FD75002E33C3219B6F4949EC9E738D5864CA285D7EDDEFEAF12A24208D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\kn.pak
- Size 1.9MB
- SHA256 4d5ad12288499906ccf131c479e3566609f1916267e665525e2c643a04ed51bb
- MD5 aa9dfd5574f9b57e436d7cce0c4bbb78
- SHA1 657466bbb0816416ea706bcd8109bba43cd36f24
- SHA512 41bca387e7f79f993186bb6a0a143b2b4894c01150c265e95f728f3b2465874494035ba1ebf5be09e03922e2b599eff61dff54f6f86d43ce8ecd4b2f70cc0929
- SSDEEP 12288:U0aEwdbKFw+ih1lNMXU9Me+egkhZx75QZg4uKNOkNOgQlFZ:jaE+K6m6
- TLSH T11995DE18ADBA7D301BD5006B24EC643EDFF56BE29CA907C2F4DDD7802C66C6A90865DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ko.pak
- Size 827KB
- SHA256 16fd3ae33f030d9685e93a07a17c192ee741b73e96bc0d6c28a3e5c6a754c3f9
- MD5 d9b5ca80b18e9955cd5f6d8e72060854
- SHA1 514c80d8f585801b13f296e2ba1092b3d9054b42
- SHA512 9a92b7339d633252929b04cd9c4f22e48c0529e454e5a6a5dc3560c93d37248621782f559c46f7fd340f8310a3b24de79db2f0c6fc4155dab46352372a6643c3
- SSDEEP 12288:fb4DzALBfFverhKWlhKZku3IxI5spcBOPgJwhEBEpwqryI0cNjtkMC2M+SqGCFh3:OiNFvblI+hcnd7VR
- TLSH T14B05D8F23CDF23D815938D82AEE5FA1983C2D977B7530294EC44CE449E149D74886ABE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\lo.pak
- Size 1.5MB
- SHA256 1b81a08b141a19bee92cb35c1440b7df86a0c0a39fd06714a4a80cc9c7394e9e
- MD5 8f5fac71c91f7e31862e26621f567ee1
- SHA1 b3e68986fcbf4b31acdc28d47a9465787db385a1
- SHA512 d2feffaea6a35d13660f8938a7ea515779811df5bb6600f66337af21dfdab1fb8a9934064951119415189b40f1e0204b21e8a87d6e27fb17487e4e365b3fd9c3
- SSDEEP 12288:2lzAEtiEizH35p/M03miLkNiD4OYzkDpqM8IU5I/AiiuttSHYWYaHWjYWknFH3S:CMIiEizX
- TLSH T1BC750010A9AFA3F0A2F403537953A2F653B59E34F067B8A03A6E4D785DD1D30EC47668
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\lt.pak
- Size 872KB
- SHA256 78398a7cf28e8a91e1d104c8fa8bf56ddfc5caa9103e90423f79aa978d92543a
- MD5 79da1de7652a90e94953c10cb6d4d9c6
- SHA1 84071e2c9b5af9616a5b38504b4171425d70ab4c
- SHA512 9276452483c45b8039d87bacf8724eca2441665552dbb7bd53f7fb3c6d26852285334b75755092a8456fbd34fbec1e0683799c147ee37c93915922742254ab64
- SSDEEP 12288:5ph6s2jlr6pvoeCbWbyCjAUdL8UM7P6SXwj+9mcb+5q:N6s4d6GkPGHj
- TLSH T140151B006AA3AEFB5A4013CD45B58BB4DABD51009B177D60E86EC75BC43BF9636B0E34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\lv.pak
- Size 861KB
- SHA256 3fd43b69b553b2b451807de14c7e9f1114a072027e35f6c4bbda20b864b361f8
- MD5 1e8f37b5eb1a232322964268c17f1fcb
- SHA1 d54baae6d7cb39ced4725ee765d45da517d301df
- SHA512 b9861fd79b5fc4c42f12f407319b1eeb523ed46401dc85cc86d537f95eedca7a67060957cc535590395df983fc813c6ae0a2f5b9d2e698ba5766011ce48770ab
- SSDEEP 12288:dE1U7rqzSpWiSYGMCiqE6dVqCcFTK43fxn6RJQBz:qG6ziWiSYXCiqE6dVqlFTK43fx6RJQBz
- TLSH T1AB154B548EC78FB54E514DCA6327D123A9CCD700EE07E222ED7D9B35660FD2822B59E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\mk.pak
- Size 1.3MB
- SHA256 5bb2125b7492a0b175a6febd86ecc609a735466f8620e73d8a30d695ad8e1229
- MD5 b92057fe3b15bd146f138bd1dcc3f1e2
- SHA1 81ff3433649c1b21c21d4bb589eb4737a74d699a
- SHA512 60986b36a6d3289a0ea1ab89779a637090d7762ddc54b8960d9e24c69573f0a8d3f15a5a2476e5ed02808927760239f9d3d1da48cfc33b264386c3f1a2cedf2d
- SSDEEP 12288:KZgflUDco2SME0q+SMU2ryhNNKcGAq035RoGaMy7BSJDnTcU4mCxlVR3DPRwpQTt:Ye9dCs
- TLSH T1ED5557A15B9E74DB0501F41FD809BE0A3C9B44FE3FAB875211611DBD39E10B886BA35E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ml.pak
- Size 1.9MB
- SHA256 385be976b6f6315fe30af236eb37eb802dc5dcd138678fa2451c92cc02b1ea6a
- MD5 9c717655c5c4d326bc32470c74257ce7
- SHA1 7bb1f675f50fc58b09ea2759b15cc3ab7e366870
- SHA512 d0e56cb077db7f1f84219433e8cbd6c0dbebbb40c2845b5d33c1c45a91c8bae072b735e2051611386df39273b74e1395e08ebf0470e76d8ecdebbf13cc52ab73
- SSDEEP 49152:CjCnWPxYLXFKjXy/MN5cppOk9VRa0rqS8KYuqrfMAW6:Ai87
- TLSH T16F959C57A436CD3B0FD102167B4E2FABCD5F9FA140AF268B5869B2628C59F7D0C99031
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\mn.pak
- Size 1.2MB
- SHA256 96d6db0471e84937f74ee3d14c38355ad5384e69f1a21bd47cb3208378d8e45f
- MD5 fa09f921f5b77f1f7529047327798565
- SHA1 65bb73567f940d2ab4a36b4fc580f390fb895769
- SHA512 25a24fab8aaeb1d1f9113a488c08f0ca2e171f32bce8d81d9ac87f6f175d4165e15c790cb00724e68164e8df8d8b92cff826b11dd127c31d20dc8f3e122b0ad1
- SSDEEP 12288:WUD6oc4M0MnwbbMZCYPWWbSpV3HnJbtCT5IDpQVYniDo4ahN2RnuuqRR8FdAYCdY:9667T9gJpLh
- TLSH T14245DE90559B14EF5082F283E8457304BDDA29B87EB6570324A17D3E3BF35A7872C26B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\mr.pak
- Size 1.6MB
- SHA256 87744d5b433cbc3998a34e205b10659399514229e40fac921b54db207a7ce85c
- MD5 8b0133c9d43f7544d7b7007f7fdc6740
- SHA1 d78f4d35f1c737351a8986ff87ae7a33321426e6
- SHA512 662c193c4d3b443d25a8c87c21b82db71452016f98d6f4bba0aedb4b9f15831a3a6fdde8d7fe21b6d1a06140ec1d68c25c425cc4d1a822fe74d8e4622ca43c60
- SSDEEP 6144:M4XnCdZp0xJMIMnAbWyUWUO2sB5JJRj78mJrjVP:MOCdoxJMOBrTj78y
- TLSH T14F75D14DF77AF3685DACBD8E36550D3BD8FD21B1C3F9925608E2B3A74884CB001596A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ms.pak
- Size 768KB
- SHA256 d19461233c13fb8a87512e380540cd158ef791c64007dff338dffe1f0d8a1de7
- MD5 793d7b7db70df20bf48c586aee9f7488
- SHA1 48b38b17dae0183e6e478932e75cf5521fad06e9
- SHA512 10d7be6c92d4f1c230449738d46dbe6500bdc4fa8d4f75996d97a5592594f9f33604055839c6f298611d862665ba2f942db35edebbab6be29a5611e0f1b746bb
- SSDEEP 6144:HFJUEEB5/eF8u90mxanLrxSeL5HuqwDSxs5bVZ/57WAdpQgbi9j4x9zzhKlVYj/s:H7UXB1e8f5Lr5HuqwDX7rZdGwROF
- TLSH T175F4C6074EDE3128085443D9D2DBA92B3CDD3332B701AB6B4DA04FB0166EFA53766B59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\my.pak
- Size 1.9MB
- SHA256 c97d5acc478e72b3c9a4d755962db394375521a17cb56f01ae7bdef895b6d626
- MD5 dd6bf0ef37e4a6734d2ed40457142369
- SHA1 439d355ffa8aac275438ed866219535f2242e8da
- SHA512 be537033dd235967287ac59c19eda04e028f4d00ada00597b3ce4271f34bf47fec6dfb542bcb27f31bd9a3957aedab73b5d984a20056bfdbad71e2aa65a1cfab
- SSDEEP 6144:ZH9M3G4e12LEfI1Ww5VEolpum3tL9i7w7K4CNfEsSmj0tQrk/RjFcLZws3CTM9oM:ZH9MW45mI1W91JH
- TLSH T10C95955109ADA40AB4CCD92B1B9E9F757CEF41151A108CC17BB208EA4D1FBA5E361F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\nb.pak
- Size 730KB
- SHA256 4b5a88e27eb6698314b436898c23d95fb5bd595e3e850b4eaa3a2593f378963e
- MD5 94ce60c2fb4ebe734a37343546177f27
- SHA1 e03434dd3f19d592d93400ccd506d4303f4475a2
- SHA512 a91d465b4e8c41dddb33ac17318666604f21227d196e09b0463f16c5e44c2cb133a87f2f2d032123ce7b5da59bd73e8c3a2f723946f189d7fb3db5d2024cb3a8
- SSDEEP 12288:xXaQAL/Op7vIehr70XI3tsQtFniB991C9:mJ2r70XUtBhZ
- TLSH T100F40883DE47B739F6900398F41A86579BBE942CCA980A9B54DCE12E0DC7DF452BE1C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\nl.pak
- Size 767KB
- SHA256 6f0bee2f64dda16390828ee06ed224914e5c55f79a31d5f85182afe4f918045c
- MD5 ad66a02c0dbd9a63c5dba3c1112b2973
- SHA1 af9c672f9ccc34bfc5a8a2b0a4274cd5d9a9c295
- SHA512 770b7d1f5163f1bcaaa6b5baeb82d0624f744082ae1dd5602058e2fed96d0d379c1dd3b976351176dc571aee08ce99bd585d03b09aae994af5c4111d3d014058
- SSDEEP 6144:OCh19Vk/AiasISMge3Zju8mgycWVv3gbFPHvElfo+mbDHQRBu5f7pGeVsPYsKGjn:LFk/hFIb3Zju8mgycW93gelAJFGPGM
- TLSH T19DF4E9079C8F253D58C06349FA0A8BBBBF5EC22CC66CE6AD94EDE1341443F6841BD599
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\pl.pak
- Size 843KB
- SHA256 e58fb50282b8ee3264bed2ab3c45aab82673e24782584d7b68af2255a3f1c260
- MD5 63ec68ea329efe1d6f617ad96f6e07c1
- SHA1 b354e0502459e9df41a7749072617174097249f6
- SHA512 bfccad48e3210ba1e4e31d8ef236d1a50555463032d393b3ca39ee32603c6565ed83c3d227b7dbbea302bcc4369b4046afa3b4c1508671feb4d6fe85bad0c227
- SSDEEP 12288:8uTIO7pIwE1WaFD+afQfuzSJQjB4b/xPTe3mcU0VcMnmd1Qh/PFRa/uziOlPhqRG:QO7pUD0OVcMa1QhpBkw
- TLSH T14A057E0D4AE29A5E8DB008E5F2E75B7CACEDC808E104D35FE41F5026719B99FC9BD588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\pt-BR.pak
- Size 798KB
- SHA256 ad232f128cc5fa00fa40842904ad084cc2a20d82a73b5a3e7dbe14ce32e3a448
- MD5 eab2c27edc34fe5eca08159d9c1c6ab3
- SHA1 0d396256dfaaa5933929d9d6c74401d01cd8f6ad
- SHA512 22c72fea787b4467c90c2d1806314fcf390cd61c65f577f1ec2a881e3e5a08cc59cd8abbdcc3d8309238e2f6b185d02f23c130690629d56d2781f43de019768e
- SSDEEP 6144:CtM8+bYvgy8CMlApRov7yANBXBLNZaSsV+XhU4iMB+WhKYLIr5awbjjfz9X7qXe7:s+7KpuqSKJzYqae
- TLSH T1AD0508295ECB133604225341BB4BEB13E6CC1645FE0ACA87DCEF5B46A3C9E40D937A65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\pt-PT.pak
- Size 804KB
- SHA256 e579057e9caa69997223fa370dabaac41b1902f86a4d75454245708fe36ce659
- MD5 749bb973518075f080e34fbce1c339d4
- SHA1 71dc8ac716b01e6005d2588bb38637a6cb52c2b2
- SHA512 d53e535b1cddfdecd6c41944f68c49a7a0cab1fbacdf22f1872a4b484be802648a9cc44f3db9683e3659389b6b186ede88855eb0a3ea8c59618abb920ff1aaa6
- SSDEEP 6144:oSAM4wVIp1PNdXLuaHjSieJVJJxhy/fvm1KKflJqe9U3LsKakanj8JRjOXXf:oSQbdzrH1gvqe9+W
- TLSH T14105E6285ECB133105121381BB4BEB03EAC85655F90ACA87C9EF1B4672CDF94D677B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ro.pak
- Size 832KB
- SHA256 ba65b9bd1ed873931898648b79f5bc19fac9e0291e5791e0332fbd6a31a73a19
- MD5 715c8af0ad9942dcbba39f64f4fc0acc
- SHA1 6b2becf2dc1d989f3717847fbd9fcc459c50fe01
- SHA512 f5a95f4ec77f62691297ade05de1ed2785f0f10bbeb26042c790ec1ddb5720520472f759ea10f1dc7ef8af925dd42e61c61a281c429730bfc7b2c0c416f28126
- SSDEEP 12288:k3NiaBlApWLeuTsWK5TP0VK1ns8pL07b7Oa:CK18
- TLSH T1A9052B2396C51AA32D5102A2B72725E3E9CE105CFA40D2CDA5DEC97910C9DDB853EECF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ru.pak
- Size 1.3MB
- SHA256 3fb62477aa4a48c2aec96fddab81f09ea5e9e22a7fde2cd3b2f58adde04c8eca
- MD5 9139bb6904d91248d9474ab70f66ac70
- SHA1 cb2a3ad3b029c82f7e6bab42490ab80262b073e4
- SHA512 61cc5b8717da358d552474ca82aaba5b1555693d63f40786630355d1616a65e78ef161f6c4d859f6ed534f95e08e103df4b9d2d40737afe5fcf50e156acdbc10
- SSDEEP 12288:MnN1UtXGXM6v4p84Y+D0KRPJ9GEgo6CrcFvK55eswkZn1uPxhrCv1rwX3BYHaO3U:M8WX26YBiSS
- TLSH T14C557760669A64EE1101F01BDD04BE0D7CEB45FE7FAAA36219A43D7F35F2024C63D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\si.pak
- Size 1.6MB
- SHA256 4700f8ed641de78559714041eabe1c4174c45d1d5da4b0b8630e41da7f804500
- MD5 e8b4b996dfa21ee2b96c612d62089449
- SHA1 800cae4353911afd19e7d5f7bf1107a801d20ad9
- SHA512 c80651c98049a5041361920bd45df1721255ddc5ec1a0570a2995127ec8e8ff7de66021e0bc52392f1454f10b3598b736a534d7e6434e3dd6df33170ad11f955
- SSDEEP 12288:ptFOscHTGCq/UnpflIhxrrMTZy7cLNTJzlvTxS8UCi55PP0FNIwCLu2Lww5QQfcY:vFBp
- TLSH T1657518BDFC3ED9687DA1E010142042CFA68C796A918B8232F42F97DDBA13D7505D89B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sk.pak
- Size 853KB
- SHA256 5083e7b982a4b9dbdcb3bf02a576fbd08b437e5ebfbe8343bf836813cbe14f44
- MD5 bcce3b3928e9bece9d1f215df38713f3
- SHA1 f50eeb56664d688f7496062962601a5b3db6b375
- SHA512 830c58ffa918c44811071e20761b7bd9321f0da895350efd43eb0bfb5a6eae1e43a7f92cba1c286799bcbe1f8485d8d1d0c3cd6b4bdb046dd279fdcaf9388293
- SSDEEP 12288:CMSCTRc+H517HYxivnW8pnOmxXNmQpAPCq3jSQ+oe:CMSsH5lYwX004e
- TLSH T120054C3FCBE7182E8ED90148EBE77110FDEE4650868DB1A5980F364724E2EED8A74D54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sl.pak
- Size 810KB
- SHA256 d608c9c7e474db8bc3ede2476d2c5651227c63b1fc04dd81e89f0a4db4810943
- MD5 d9265ac77a51d00d7688eca75b9ac043
- SHA1 4bc017325733f3f3e34de4f320b5200a44629e3a
- SHA512 548391fe54e39d337a75960430993bb8121d5f6611bf3bf28e809c142e9a444add6257dd0c6eafb3b9d54cac0a5d357111fe252ea4488bd0568784c0d658f431
- SSDEEP 12288:w1ThId4W+w8TSKc0CtnvMTi/fzdflGDyL:QE0wrKcdtnUTi/fzdflzL
- TLSH T134051A39AEA75E0F0CA662CEFEA306107EDC054CD252D6A1FC4F336A5411E3827BD599
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sq.pak
- Size 825KB
- SHA256 746755a3cefce4012fbeb44ef7e0de6ebb342d572cbe1b3abd4555555598b0cd
- MD5 b6d62e3c51e2aca13086e015a5ebe1dc
- SHA1 2de6c3408dafd26de8e06c1fd68cb2a7283f002b
- SHA512 a8244ee027c10dc2d45e30401a43189ff9c0bd229450b4b777f41b3b63e9619724a7cf493b9bcb0d26b7dee998a7086d9669f88f9247e9c5509581a22ee0b8de
- SSDEEP 24576:9hAOfRftE5g26mFzAIkUx1lxZUj4oLGB39p4+c51g/KJFNK9lysazOn7+QXb/yZC:9iOfRftE5g26yzAIkUx1lxZUj4oLGB39
- TLSH T1F105E82699B9D7B6C4172229B742460D1FFD516E71E3DC2DA89AF6270873B7D023CC0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sr-Latn.pak
- Size 792KB
- SHA256 7df3a1ca879c4f5550f2d2a9c794e7a5eac4f5b6b74f2a5390255464b93a4f4a
- MD5 e9dedfdfc80050554b42e6bec9321fd5
- SHA1 186b53c37866a81f3fd26e351a7db3a9914f14f1
- SHA512 d8fcb6d6c0d054e41637dfdb1e5ce47b17a02f4914fbf3e8ce617b5da7a1e9928f7874c2e4d0f9d1eaa809cb5f71fe08c2af1d7a4b9b874263103626b8341b9d
- SSDEEP 12288:t8pzccWuXtNlJgq2/2MgENmjuUnUM+iStEOfmut:xuXtNlJ32/2MgENmjv2EOfm2
- TLSH T14B052B79BEE7364A08A31346EFAB8391FDFD4C8CD595D7B27C5F621A0142F0825B8648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sr.pak
- Size 1.1MB
- SHA256 355431101e757af475663bcbaab09bfc271314573221abb2ab44cb7ee2219146
- MD5 6a86db9d596e14692700a2c5a1daa5a1
- SHA1 c7210a498a448b5122f52b8417e9616ffe953cbe
- SHA512 fac6d803a85ca62f7ff09041ab35ab21f668f6dc9b6c8772a747e470b2b8e7db03af35bae71e5b502454a372a76447af9bbc55f73624fa39bc9e04c01e65bdca
- SSDEEP 12288:s7w3EutH5IinS5g1cIndLECJi4QJeiQE39KJxR37SJdF/k/ATXik:srsHq3ASzik
- TLSH T1B135CCA15B9E64DB0501F41BD809BE493DEF41FE3FAB535211602DBD34E10B887BA29E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sv.pak
- Size 744KB
- SHA256 86f2aba955b7208779cd039b638af19d56a6dd4d0ecfff337c435598d74e0ef0
- MD5 199b219842e8f730a81f76e1b036598b
- SHA1 0b58d314e2674ca500a8581a6b3d26f9e6723c5f
- SHA512 93872fa22159ae32573b90cc2c31464d7bde024be8e1f65e8ad592d5566277e512a60b3dbe5bd511c7537dd6594bc84fdcd1bd4ca0a90901133a53eccc44aeda
- SSDEEP 6144:xHDhelRGohdT3eAQMVSx41D5Xi/aUR7WSslG20FV5RtGd5s146QSO9gtuIxm2b6W:Zsqohdz3QM5VS/FK41V
- TLSH T144F409078E11F535FA72130DF60A125B0AEDD15CD3E2958A78DA883DAE8BD6805FF247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\sw.pak
- Size 781KB
- SHA256 f8cae7ba61d075497c4197ebdc1d56604d1ac49a90e5e02b5cb9bfcfe169de71
- MD5 f7f6c40985f0b098d0e09526b663e12a
- SHA1 f3aa3ed64d804306b668fb67264a98c5603d8c9e
- SHA512 5e6c6692f574f98bde38de6b3cded2875751ff70e968e207867dade7aec1e59b20bf8cfa89291e227987ee74973d6b88e9d2751291be6ad2e7bbece2dfb8d5a3
- SSDEEP 12288:znB1JL59cnbEjB89m4E32Od9NGI3UAjJV5WmeE9U6tnCo5TDogieN9bubFBMEWqF:1nLaFrihrEVrJ
- TLSH T1C605D7628C72D1295623118503DAFF331BECED5C593B6D935A47BF0B218FC8816ABE49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ta.pak
- Size 1.9MB
- SHA256 f5ad91ee78d99096b4203b57a13dcffaff9ed4c0fa8f1b629b0b32c65c7d73ea
- MD5 3113f60d0a4c00e0e3eee6d78adc4012
- SHA1 eb2a0ceb8b8fc437cf122a28519ef66f1838c6da
- SHA512 f70c8c41c2036c3747a590cba351d8bf9f5b147fdfdd588a0145e24d308f603b60c349fe3468687bb76298726e45d668eac41fb74ea9e94fe5cb6fd97ea553f8
- SSDEEP 6144:RXINkyTQqUNkmBIG95nKtRZGaCMw880x657Nsjz2CoU6:R4NkAQDjIGHXr
- TLSH T1E5950BCE923EEE890F93288F0319436912986155C47BE3A67C766E1198ECC5DDF3427E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\te.pak
- Size 1.8MB
- SHA256 a16bc4f809d7989e6ac12edfae8ae7f264bd22a2792e1cae089175798a95eb02
- MD5 21041183a7bad5764c23c81a22436ee9
- SHA1 7b25df037711975173d1ab2c628847e4e5fb9d03
- SHA512 baa457a31bb32866fc53ed5d081632d4cf0f83f68c176928f2b567745139cee6b0ddf433586d8ea58f42b79268389aba4c51d32dcbaacc3a30fc745c26f01ee3
- SSDEEP 12288:RYD68GBHEI0k6UzqgcRpia+reAt602P7HFWM/L9/Nv6r0NS2N3p1F6shtutNj6mn:RYO8GBHVaji
- TLSH T1139591023A6BD310DAE60277352CF66C49781B4261D6732C1EAFA357EB87D7E0843676
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\th.pak
- Size 1.5MB
- SHA256 3366f346e3f52e289a70f2f36f17511ce7980650dce846ce7e4c95a88e01998f
- MD5 98f26cc3d99c4e2a59080b6d276077d7
- SHA1 274636e5c68492b6962e03246b6e1932210976dd
- SHA512 133a6b88f224d3c29294726f4a3b62d3ca1b3998dde106dedc7a47654f41557eb96c4d7000a937f176ba417e1c11dfdcbae410ead48fef796999a1972dacbe2e
- SSDEEP 12288:4D2bWNJXUQYAHz8n+AaoGCbskJUszws5eXxpbDruR/xKH3LIHElyChxKYML8aFrM:Ka/DQ
- TLSH T1B6756CB33647DDD479441B5B262A7389666DAE693F73F8E00089215A73F071A8432EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\tr.pak
- Size 801KB
- SHA256 2f9cb40038e5006618dfe497741c24a373ba5c0d4e7ae680c1cd9552423a48b5
- MD5 74d32f31b9beb20d7c7849b0fca69f1b
- SHA1 e24bb556261870ea248494ad0ed337e69097c6fe
- SHA512 cb53706ffc19ff6be940e47f773c5bdf51371145b051bb98588393efb84865f035e4d39a4215fe43ece008ab80c4b525b122e3ab52bc02f2634b348024027132
- SSDEEP 12288:O5gOOWJWiqYQpg7OHl6sgwhqlyYFkEU56rHfJkkHfVbN+:O5gOO8ix6r/5+
- TLSH T103050A417CEF282C8F79178FC5EA0626F8DF0766B331F5469A1A96267745B5302F260C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\uk.pak
- Size 1.3MB
- SHA256 13c1be2398b360b0cbf0531a7ca05393645a021f5cec8cbeba9467611a16aaf9
- MD5 4063856edeb93af4bd20526424d2c750
- SHA1 94b9b8e8d8b2d26e94dfcf63afbbc928b86d54ec
- SHA512 4689096d2f2358a190bdbbbb358ffe41f58a79fac28a10872df977e9942798b07a784018e0cc0bf2539d8b7b1805642b8024e8059eb527ebe20b7f54973682d2
- SSDEEP 12288:CsFX2fv3uGfmq5t3ZIG3wqzwk8C//aWRgUDp+lc4nDE9UhduQ0g3Xv6lHUmMYsMN:RFX2fGEgELy0Omz
- TLSH T1A1559AA19A9D54EF0105F05BE84C7A0D7DAB41FE7FA6871625A53DBF38F2024863C31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\ur.pak
- Size 1.1MB
- SHA256 3baf3dece1784bf24d85e68a7e40665d2ebe202b858dce13e2bab919afea1351
- MD5 91a39d64e11df9998a4af04f7958be72
- SHA1 c502e44a024bf643ac236652a6e01e73c9edbf36
- SHA512 f5f80f3273d01fae476c13852345dc008f8ebd0780ec08b3d50dd8d420782eadbad048596b6c4f63a25b5d7734e7a596479a3b1b050c4cd10c10318636008308
- SSDEEP 12288:hCA16TTFEwY8PPPKIGWktdwCS7e3y8eKgoglryVhVHQYrpMIco/9NjjFpXPbQTXw:TVl4zt2
- TLSH T16C3530D2A6B952B34A21891790D33C34CB735F13D34AF385E86242C94E9A5139F7DE3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\uz.pak
- Size 778KB
- SHA256 55823bef46b9c0f65e1bd3e52bcd9fd1dae2cc1ecf71451ed3f3bef8da52f8c8
- MD5 71e6c88d057b96cde1fc07641a9a4d68
- SHA1 b6a4109af8b0a578468eda57fecb755eb42f7092
- SHA512 f4aa5fac7c4e2803642296989fe7e4ade724be64a320b0e6f520f56167fda6833d52d1e03790419bb4bae1e694edf376238b0c58861a2ff19732febeed7880ea
- SSDEEP 6144:2LqerlQ87yPBwmaiAa8e6vngNQwnZIWrpnE2jzHvWYVp/KB89r3EBIT/r8lf2HF2:2Lni87yPqiU0vrTo6Cn8bfVdpFWlR
- TLSH T1BD050A8AF8B34D65575233C5436B9F361CEF41707E92EC26DE683B391502F829B72A24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\vi.pak
- Size 948KB
- SHA256 ac4de46524f2d3ea98a0c58dc9f86939780beed9b3443fc07ad6def2c0839b7a
- MD5 fccc3645a5b8c1a6ad7744c2309b434e
- SHA1 dbf3302f77af9571815242eae170e2140820799d
- SHA512 a095cf3543c3c73235b4e28666baf7453846bc4114825f9c43cd0e85dd9928e67da0d1b64986b170c87e34b2efa597efeb89aa5485ad8611fdc32ff5b9aa0864
- SSDEEP 24576:YbBz+ckKYlMzCRZ9kYDP6/i0Nd7rYuMXneL/F44pxILO8:f5e/iWd7ro
- TLSH T10D25841216D1303280AD163EC5CE540D6FCEE42FF7818FE56FE5297866225A46F31BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\zh-CN.pak
- Size 676KB
- SHA256 e604a67f7453e694affca4284effd33b3309fc9e8f840692b8e53d018d6b0635
- MD5 cf90d5432eb19cddfb3702c17ee86dca
- SHA1 b2a8e877df7007c526a84ce370584b13440201c0
- SHA512 c312a1c64a9d8b22ebfe056a8106f023b865018179ef3eb65aac2fd12be017d31b86057c0c808268018a690f1d00c7dcdefe5e26fd33bcedb3244037ac1b65e9
- SSDEEP 12288:pUJco4H1+uANGwmbRnMoQfjAIeC82avZsRVy5tRCACU:pQA1+uPbRnMoQfjAIT82avZsRVctRCFU
- TLSH T168E47DA805EBBEFC004210942727617D7C84B61BF6279F655EE358DC1AA1FAE0737A07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\156.1.98.60\Locales\zh-TW.pak
- Size 670KB
- SHA256 450b28c8f24c8e44c5c609cbeaa0db888b278528e17fb8c62dc8bec02c22ed12
- MD5 8c02e95b989be65beb13b6d720a8be10
- SHA1 7aefe21790d4e94df838a3688fdecb7b2f37c73c
- SHA512 bbbd6a537a158e2a6094ceea13b3c3c57d250e83a4bd4cf4998f88a5c2a64a4a359c842c944c7c37bbcc30d6e87b9ac183242608ffbd743c75e5bfbf10381027
- SSDEEP 6144:eZLW/UOkH50osGs2tctfzk5EjNvqKOTvubKKmMgzMDADCQT7gQ33n+Z+T1/7t9Ru:lbgsGTmtGK2kKKmPzQ5e/7t9RIdpSq
- TLSH T17BE46CB90DFB8BFD0901A884B7CB522B7CCE382DCD776B36FC8A28941E65E951971045
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
- Size 4.2MB
- SHA256 70372e06eef532c7e89f13e17569d8f5793f13671b8607a242292f68d0a1cd25
- MD5 e56a441f2af464f88303439affca46b8
- SHA1 6903de5949ad810d06bf201f79ef3cf53846b9d4
- SHA512 b55f6d34895672fd75e1c976a6ba215f4dc25d1c68116cf1a09f04551b90ad3f07670e97c74029b46bd404c1f277cf3d6a19f8fb5145f65ee53306f68042802e
- SSDEEP 49152:OS3zdNrCH31BKNEpWXsj711v6wPvvEVIrpRqcAsGCrcoAB0VZJE3ljZQlCp5YoTm:VdNrY7KUvEVINUsM/DmoF6Y4
- TLSH T11F267C13F29911E8D01DC17A875B9233EA71BC554B31A6DF0A9077122FB6EE06B7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Application\chrome_proxy.exe
- Size 2.4MB
- SHA256 ab81d21ca59ae31fad514e67ec1d8363e2441b4c893963c8e8663f3ed59d6229
- MD5 f6db298fd4f9647efdcf8d565edf4392
- SHA1 cff40bd4f9d9fba4f6e2ee12dd2118ee4a2be770
- SHA512 b0e6edbfba8f589b012e4b88388636950f5be45bd0c6e3c45774dadf672bacdfc571defbe1806c9ce24a88103ca2d2502928bc3f1ad2e89edd6e6a223887c101
- SSDEEP 49152:wqw+gyn2je7ogx0EYITIU85C6/x+oaF4s6iIN:uAz1KAd4+p6iw
- TLSH T118C57C17F29901E8D05EC178875A9632FA61BC450B35B6DF0A90B7122FBBEE45B7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\Locales\am_FEMININE.pak
- Size 18B
- SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
- MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
- SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
- SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
- MD5 SHA1 SHA512
- Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\resources\brave_extension\_locales\en_US\messages.json
- Size 9KB
- SHA256 d1c6f805d1e5501e39e20bbb84fc5311cbf93279488fc9f3c490cbe4752c5733
- MD5 be4d3ff630ba68c0c1ef6332335aa4fb
- SHA1 eee39c1e1fd075bdbaf15e00dba66b68fcd03789
- SHA512 50ae00273c44a86ecc6a40b3010d92bd860061d89072e72c95ea2171ef2c0cb7d31b711639c3a5e9d9274159150488ec7dc1869db3c2efac50ee115b0ec3d5bc
- SSDEEP 192:RUt3IkuwVCnSuvPlxuTQFDi41vjZpNns6:syjDNs6
- TLSH T1BB127D00DD703DBB02DA05263C7B7084B73407AA52257D2CEADA919D1B8E9FBD4BB385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BraveSoftware\Brave-Browser\Temp\source2940_252362878\Chrome-bin\156.1.98.60\resources\brave_extension\_locales\hr\messages.json
- Size 9KB
- SHA256 bf4799a7899490a023cb617dba40e32f16748cb8c9dffc26e299e327a76375fb
- MD5 1474ff39e9945abe656a53682451ab9e
- SHA1 273aa3ffc2d2cc935ab697d546eefd04af1b3fea
- SHA512 87ea9bb41f8e81662ad1a4edc72e0ca9eb70fa325d0b02f2875971d2e4683698b155a9def0aa4e20a61ed7754701d81e7211eb1be7b19c786dbae790e305088a
- SSDEEP 192:3rI3vzVln999BSAsqT345Dz08KObrqy0eNB0C6U:gQHKenr6U
- TLSH T1FE126D00DE707D7B019A051A3C6B7184E77807AE52257D2CEADE919D0B4EEEBD0BB385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.instrument\ADDITIONAL_LICENSE_INFO
- Size 49B
- SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
- MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
- SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
- SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
- MD5 SHA1 SHA512
- Path C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.instrument\ASSEMBLY_EXCEPTION
- Size 44B
- SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
- MD5 7caf4cdbb99569deb047c20f1aad47c4
- SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
- SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
- MD5 SHA1 SHA512
- Path C:\Program Files\Eclipse Adoptium\jdk-25.0.4.101-hotspot\legal\java.instrument\LICENSE
- Size 33B
- SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
- MD5 16989bab922811e28b64ac30449a5d05
- SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
- SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\33073687-cf8d-11f1-be31-6ab3bf6be046\Ninite.dll
- Size 2.0MB
- SHA256 3bcc290f655cf97a3e617b5c89fc3a33eab53ce2856b99f91ee84c1eaa9c2b88
- MD5 1279bfb2c0abedc694b73fe2ff4f3a1c
- SHA1 1405c1c309c979754d1a18757b8d0dbc01bc8bba
- SHA512 b83ca5a9b974eccfcdb297a28f30d59dfdbd41cf111d7d241895fdc8fd82308c4916fbbfeb05a4cace6f6e8243cf85520f3d31b05f1cf8e87ec748dd803b59cb
- SSDEEP 49152:G83n0VEY6WVK269c0XqvZK3BMQ34Gkd8tcUAAv8jWGvrloP:G83nWVK269cEqhA6Q3OWN
- TLSH T11DA56C23B7A4C439E07E0270752D93582DB5FDB10A71819F63D43B9EB9B4AC0A619F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\521f4ea4-cf8d-11f1-be31-6ab3bf6be046\target.exe
- Size 43.4MB
- SHA256 8b23839c6b2f3076fdff44c78d219a5393c7205f666cd95bd0c9a562bf8ea5db
- MD5 4f780f50bba12830ed4c51aef75d85a9
- SHA1 a683a410abade611c9de57140967d7e74a4349bd
- SHA512 9cf5909afe27b307e189e06beb36c3c599c66134c3b0bb86b0db3515035d173dac219a60ac0ac73a4b3f6a291179e0a1048a3311517f530b3cfce1005027a102
- SSDEEP 786432:7ZfjlMPjgYV9PCE5ncs57g2BHG4Oky8EmYKTJUyYCgBQbV2uHV7Tr:lZMPcYVUE535McOkQK1UyYCgSEOV7
- TLSH T1A0A73333B0744315F2A52073A624F534297C9E2A0359C81EC6D4BDAE3FB55A6D7B33A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\521f4ea6-cf8d-11f1-be31-6ab3bf6be046\target.exe
- Size 1.6MB
- SHA256 fd99e86f57d8f429ef5ed045bf98315af962e2309b0f1ba87a147a44c71647d0
- MD5 aaa9c585d2b81045725bd3186f027ac8
- SHA1 8f5d1e2d17f8cff50574b965dc709b24d3a438ae
- SHA512 1fc7519fde5d29a45cb0082ee310802e40d74507c25b90ed82c2f954fce962b4afeb1821ac497542fca453a5b5ef5c11e4e75d70026924c5a78ce0f76c9c20d5
- SSDEEP 49152:8A/nagaZbJkbxURSqKMHFFQxycXCh2b8LEBK:8A/agahJkeRSqFOycyh2b8LEBK
- TLSH T1887533A09B740494E3F3CA30EC93E05EEE363915A726D9BE5194E9B49B77D01840E36F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\582f2b76-cf8d-11f1-be31-6ab3bf6be046\target.exe
- Size 1.9MB
- SHA256 c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3
- MD5 3fb552bbea367207655a6868622a6da9
- SHA1 a454fa6f044b8dd3a338652fe53cea28500a0c04
- SHA512 1e914dc40a12368d5e272ee78b092ef4f0786408af40b1eba78ffaef243220affdde000799853e5a056a33b6dade647339a15ddac859ce72c001e817c29337c1
- SSDEEP 49152:z4ijEfHi9iisLxe0ciIxoFujij8vZ6HE9+0z5kmU:z49vi97sle/aFGuNkU0z5bU
- TLSH T116952364A380D26BD1061974C8E9A36262D6FD36551142EF73A0BF7EBD787C3BE42312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveCrashHandler.exe
- Size 270KB
- SHA256 3963ad3e863a0ca7893bf5a942ef5f1a66aac4b3e12801d03eb8727723163fc0
- MD5 f04f4347450a26bbcd9f425acb666342
- SHA1 34d9f9cc9b6649137388c788a18d2902c39e3f13
- SHA512 9f3aed83e49619302f08e9cb01e5b0d8cf1d4f944705e34b122b295a9e2f6c0232ba091b72d203d04822a85662154a3db4300a61049a8b44f9b4865c757c59b2
- SSDEEP 6144:kJd4maD39rUMyjJr+64hQqNSEzVcdfYiGdMksDRYYYYYOYJI07YYlYYYZr79Itw5:e4l9rNyjbxqNSEzOaMksDRYYYYYOYJI5
- TLSH T1E844AE02B5D18432E9B315364EB89B356EBEB8304962DE9F23944D1EEF316C0D629763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveCrashHandler64.exe
- Size 355KB
- SHA256 f95270db85a886d170c18445f35e954fc806145a743d40dade33c7fe71f54774
- MD5 dea5ec20810614f596c67327d7484a69
- SHA1 8f66d7fd28fc9eeb243cea2215dcb83cb2b20353
- SHA512 a91359bd0cd7e8dfc65acfe7083c8ddad5f8efe259c3dc10659e71d687fd6a34f55a9ad2dd55d3961b4b7933753864e01dcb3ff7fadc4d0ec54da5b7a685c966
- SSDEEP 6144:9HlSHL0sLeljMiBwkyPnYeP1jJLSGtouZFvisVItjQauHzx+G:9F6Y5ryfPP1jx5FFvisVI5JuTx+G
- TLSH T1BD746C15F3E404F8F5A78174C992CA1AE7B27C5607B0D78F23A486963F336619D2EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveCrashHandlerArm64.exe
- Size 353KB
- SHA256 bc35f72d6d5b6da079c8f2a1b7336a2d378163942c3937d788415af7b35ae58f
- MD5 3e5ca31e6a0d5d8a78400ff16c6d3e96
- SHA1 030fc6fe59dc15fba2b7b532540c3575ed502cc6
- SHA512 c9809fe8f8cd5cd49d9cc8e17a4d8ebf80334fcff4664e7cb6211f6a844fc1fdb4642080a322c47afea6c99db0444cd730b6658d22237a40ee6091dd5514bc87
- SSDEEP 6144:Juqb6JOVxnqOtBIjEYIkEBPZkwca2zJ/LmwpNtkOKRSX3It1nvx+z:3VscDpihz4JSHIDvx+z
- TLSH T198743A51DA8C68D4E2D2867CDBB94B50312FBE784474C5CE3156020CEEAEAC5CEB56E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdate.exe
- Size 163KB
- SHA256 fc45c383a25ebaa676c70e0def336d5c3acf4ed249dcdc8c805dd45d864288a3
- MD5 1162ca7b2466c2a3fb96d9d779597444
- SHA1 a5f60282071fd7703e7efe35e90254ece1d91be8
- SHA512 fb6ad2b8930be06871e489f9277d6d19405c484441b164bfd2c919264c5a8d5385976d402c86e2601f445662b87191487989a96a31bf4b77751cf9ad5e6a9005
- SSDEEP 3072:8NDG1a24GHOaGCbtrrE0Za9/U7hxTKbfXkdu13jB+MC2R8Fl2Z/GU7ysb5vvIfFP:shaGGhZa9YTcqwB+3pxd
- TLSH T192F3E60373F4006CF8F36A3129B56725A97EBCB2D962CABE1780059D2F316918D51B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateComRegisterShell64.exe
- Size 170KB
- SHA256 f147ea8989cc7d74e7fc5e64f2c82d31f079aa970a310ec6eafff05a69495389
- MD5 190efe4c934d115608de97c3afc5fd1e
- SHA1 a26bbf4f1dcde8d2506cc819d6d78c42251e8e90
- SHA512 32f6a11243a98b06e9b91e4fb5ca014d866af17d9a1480a9fe03fae58b25fb32c9a03979f9a1367281da876143e0690d5c78eb74e0cd01813e60d2610318ae9b
- SSDEEP 3072:durxDqvsKxxDo4WVSWW/VaO7QAiOWdj/81fVwvgB+ckg:dMlKxxc4oIt97QAY+qoB+Y
- TLSH T15E045C1B73E430F9E1B78135C8924A16E7B2B8720B50A79F13A4477A1F33691DD2EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateComRegisterShellArm64.exe
- Size 154KB
- SHA256 b3e6e5b6a47480d776bf5728ba4f3c19f1a894ed04c9f259aa98d42307943ee9
- MD5 519d4da13ea8cca06786503a147775a3
- SHA1 5365dee82df45b9233ebbd937da7b8fe88302d5d
- SHA512 94a47b6d25b764be08da7070e73dd2bbc82eef5ab9bf7cba375b1fd44cf5596dba2b88a536c9efb98379dfcb5371f509bd828d479f020383e4e08b7daec326ee
- SSDEEP 3072:koGPa6NpZk+tkJCbjOAY8nMl/Eed9G0bZQUpojb90CB+c+W:kpPlpZk+yKyVFtQIolHB+o
- TLSH T196F3185376CD38C9E2C3DB38DD564950272BFA788430CB8A3296020EEF6E6C5DEB5552
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\BraveUpdateCore.exe
- Size 195KB
- SHA256 650f8998f4608676dfed9e0004419545c7770c5c1efac1dd9c077f54b60f6b68
- MD5 74cc4f52be6c31a13174ccafde935c18
- SHA1 7259e8d1e1c1e858c6d6e54ee24758e37d680154
- SHA512 dc14f5d317cbaa6782578f355ad2201b7f160812a9587e882e8e522123cc9e5d00f9e63cdf7bcd4b84f2d9239ce4662c3d3a80bd9acde31e0ebb8283a707e4ad
- SSDEEP 6144:KzXt4nqREgRKE2kKh+0nc0yPYzweIITx+10:UXt4nqREgRKE2kKhjUYzhImx+10
- TLSH T134148D12B1E08072E97315321AF0AA705EBDFD704E62DA9F27940F6E5F716C0D626B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdate.dll
- Size 1.0MB
- SHA256 9132398643653e7415fc71dee2159d53c320171e71a15d5fc3347c81631cd665
- MD5 d615d32dd80582ed39923168a83f9dfd
- SHA1 a58b9b45edacc666d2dd18a84e8e4295c9672540
- SHA512 466e2aeb47812541d69c96847d2eefe91da1103d64bedf56e65f0faaf2e69e2a5014d0688bc4a4e38c4dbe901d25779112ab4a5ab6c8a7ef04c4d13d10e04e29
- SSDEEP 24576:i+uIhWp70UJ5KbPnoUznkDtjJ0sjSaHc3EqKLjhWuvZ3yKT7bfNgZGNY:Azp7jSbPoUzkDtjJrjS0rLjhWuvRyKTw
- TLSH T156359E1375D18035E5B3063099BDBB25AEFDBA310A32D64E13D82A5E6F72980D73A353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_am.dll
- Size 42KB
- SHA256 e2f7659c6a67ccaf8fac4738ffc06c2fc250baf694e46bc3dc070e08968c803b
- MD5 46862536ca6b27aeb732ebe953243988
- SHA1 adddb85364d4eebbec41764739ab76987643f3e6
- SHA512 905ee0556041226126c6a645acfebcb73218c865939be42a5e8edd91e9e8c61f54fbf1057e2aaa4e29c2258713fa86432c38bbdffc284c090568dc6998d3cf1e
- SSDEEP 384:Vek4k4+J2cNyEIYi2mL46rA+IVHEKYhPx:AkZJyYiDL9rA+GHcx
- TLSH T1AD13423946085C0EE727BA3175941A3E45276DCC6BE0F3861194A13C9D707236BAEFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ar.dll
- Size 41KB
- SHA256 49800e93fe2016dcca5ec63feae9f0c7ab00a49e7c50ab6657ac45ce1c1db999
- MD5 43bcf03ba6467d0ea7e348c0c29306aa
- SHA1 6e01dc8988566a066e942f0239501ea2cb42e20a
- SHA512 d07aa1f52c9e786ecda45a16ed3de6f414c6c87a3dfa09e417fb1b5e93ed67072868f11d637888da2e181b158ad748b2dda54ae2cc5ebbc267a79beacfd6a0d5
- SSDEEP 384:ckOtkCLu+JGFNyEIYi2mL46rA+IVHHeK6A:VOtkCLdnYiDL9rA+GcA
- TLSH T1A01331720948DD3CE7137630D19ACE3F916711D29CC4736A62A4A93186B0722AB5FEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_bg.dll
- Size 44KB
- SHA256 46c772a86eb91ce7d9a0a5be4b2d7b1264ea32c4abd93a566ebd4603e4929e70
- MD5 39fbe27b79c33e1d775ea92ed7902fdd
- SHA1 69f879819999ac6c3084f21e757aa364a8c41ded
- SHA512 eea44d7d11a248bee7aff1746852f76ae957c9979d155677ed3cf3f379f9bab63d38c8d1bc79fcc1bcaa645d8b0c8fb9eca0302e23894132e4598e07cc7c35fc
- SSDEEP 384:xrndckbeGZBOcwNyEIYi2mL46rA+IVHYQkLp:pnV7DlYiDL9rA+GO
- TLSH T12213CB3BA5788908F755B2301A9549FE2177779067E4B3C2528F7874A038332672EE8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_bn.dll
- Size 44KB
- SHA256 9c50e17bbec3961b75f05543a6475ffb6ebd09331054142eccd4346eb34fa5d6
- MD5 f3a11a683c8a0bf3a23951bb188f6e5a
- SHA1 350af0e6a0337f4ff5a1545f1b37abfa7f5ce26d
- SHA512 13462d44e93c544b954bc818cb0719e4ab6bb2633175993113939aa924005a725820f408a146384810daf2f96df96be2ed926533ef4b90897c582460d7d4c7c6
- SSDEEP 384:p6IvUx7tYF7qKF0FrHF6zjbmBwRNyEIYi2mL46rA+IVHZISHX:AIrlF0FrF3BwOYiDL9rA+GT
- TLSH T1CE13EA3996087C1AE3ADB53036D55D3F09E7388027ECF39421D4A53889B03B65E5EE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ca.dll
- Size 44KB
- SHA256 8af00a84ba54bc957f2bc31e95f82baeaa019c4b65dd3c71484a9eec4fd1cb2b
- MD5 4f40721e5e816a69d141a8bd3f978486
- SHA1 56f01b7e22e34bebca5d7aec6df47ff85bdca0fd
- SHA512 32b37515be44595e8744c986ca4d3ab9dc8c3bc8ddafabfa5a73c868b8b25bcd035e46d5c75aeffd8c106c2d1b69fcf1f35e8106f4fe49346cd446a9f1d3d99c
- SSDEEP 384:/XUs2ArzVuRm4bPTNyEIYi2mL46rA+IVHJu3GS+:cs2ArBupwYiDL9rA+GfX
- TLSH T1E413CA319BE94A48F7B33B703974193D4A6B7995A8F4F34D1240A5388870B01DEADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_cs.dll
- Size 43KB
- SHA256 6179cbbac503cfaddeb31b397ed578494048f3ad506ef19ceff4bbdefe72ed96
- MD5 e498a77a3773f67704a184b16f97a8d2
- SHA1 37734db1f7cab9cbf53605f05e66b0edf5c099f6
- SHA512 0a4a5c72aacafc05682b9e630c5c7e9376d214a1273911bc4d21fef1d5c615b62ce314ac8c86d4c5c814c18807a9e68b76daf75747be26da51c972d7971f2048
- SSDEEP 384:Fd0BWpaJkhYwA+f5NyEIYi2mL46rA+IVHAwQn38:X/mYiDL9rA+GNA8
- TLSH T14213ED7155E80948F7B77F3028B00A7E097B78D1A9F0F34E524061799970781EAAEF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_da.dll
- Size 43KB
- SHA256 b1c7e46ce77712c983dc95b4bc9584339f9800dd42439bb9a2c65c362737a6be
- MD5 4b22419097e5d593ba22c22c0d33b9d5
- SHA1 a59ca225754ff42105371b7130d560dab02f3344
- SHA512 ed3869da1dcd674dbb0c0dd92a1b5a5c9b82b7899b74468096cbed8de9cb01bc6aa4799b7a76bee35ce917131bc8cd4134244e6a70ed648a90159a0792f4c84f
- SSDEEP 384:mKZfNnwtpTqPXNyEIYi2mL46rA+IVHpwZYS:1Lnw/+8YiDL9rA+GtS
- TLSH T14E13647157E84A1CF7B33B3068B4492E4967BCC1A9F4F35D224460788971385A6BEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_de.dll
- Size 45KB
- SHA256 327f214e93a271e61cd2305777fd3d62e46cfbd9de6a7307ee19150cfc1f951a
- MD5 83f69d6b5594f7f077b1d02682381b91
- SHA1 c3bcc7ba028295c2866c18d4b3437e1794fb666a
- SHA512 e053c8cbc23fdcd127cd3fb3ed43409ced5d888968af94f6956d9f7cd52a99fea8c4e929575b72a4ce2eb9192fd627a825b4a0715eaefa8e1ce56036affe1381
- SSDEEP 384:harQUM8QtPM0Me6INK/A3NyEIYi2mL46rA+IVHl5S:ArgjMePsAcYiDL9rA+Gm
- TLSH T18D23417147E4890CF3B23B306DB45A6E5A63BCD5A9F0F75D224060788970741AAADF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_el.dll
- Size 44KB
- SHA256 92d005cd89c81240e7594417b2ebc0f222c073f474da7cefc1c24f0771805550
- MD5 1e143139fb028d02ef81520f35a4592b
- SHA1 b48de2359174fc528f66a0ee36e5fe6b1fc86b1d
- SHA512 2ab80aebddf588a450af88c94c71a6fc9a43e3e117680ed10bede3dd1702a799541649fb8ace42465e9c3358ee0cb37b003ad06c0e2785c1c39e505562a6bf27
- SSDEEP 384:HLNE5eILkSIrGCSqlIxRFiAhAc8zBtfsBsTbmNyEIYi2mL46rA+IVHkXK7:rm5lLO+R52/TYiDL9rA+Gh
- TLSH T10E23BA7E09AB5A19DB66B9F11462492E4A6BF0C108D0FB6631E07074DA7C7029ECFD1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_en-GB.dll
- Size 42KB
- SHA256 2d9da581eff69e9d1d812f088d296be7fc6efdf7b74d1430b68923baaa7b0c5c
- MD5 98421e5f5b78bd3547098cf77e83e541
- SHA1 ba45118fcad5f038e9fa6f6351a1e2d6f6ac4540
- SHA512 21cd27c81176c8da3c29b5c24fc24fe56e7174d718428652c6dbc697a0dbef9e501ff63ce8f9a8c44ad7324241ecb9bd7ed393d07142c2658a6550faf08c544d
- SSDEEP 384:89Q8Uagyh6Qu7NyEIYi2mL46rA+IVHB4n6:CUagyhiIYiDL9rA+GQ6
- TLSH T1821395B257E44918F7B73B3069B4193E09777C81A9F0F35D2280A0399970741AABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_en.dll
- Size 42KB
- SHA256 3a3400cc45f1fbb873c9af751d7be30ef4273c7a074e88eb3f3267acd364cf15
- MD5 e338150dd7867384023382c63d88cf07
- SHA1 3782c860724a562e2dcc4f73d1c510623782b2f4
- SHA512 f5581902096457ce6ba8181d4d5cb7de241d3e629ca595e29c6d5fea142b68b9f886d2a98f9583923ce3d9df31afd602c709efb812f6a92797a01f2b9fffbcfd
- SSDEEP 384:3FciagyMk9RsNyEIYi2mL46rA+IVH233NavYr:qiagyM4ZYiDL9rA+GiGy
- TLSH T1981395B157E44918F7B73B3069B4197E0A777C81A9F0F35D2280A0399970741AABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_es-419.dll
- Size 43KB
- SHA256 c6982e48654c89d5168a17c344742062a2b4120bfde30bf307029c9e74b21a46
- MD5 6bcda85b27c3e09bbc12d5747c1719a5
- SHA1 73031062360161afeb78ff14e8f1dfc41fcb2cb6
- SHA512 aebf605fb3d70dd589dbf7b25458cf330d9a2071faf5cc2b0b4f229739a204a5c5ad5eb861095416bfabd1f3067eee274baff337c66dc0c546904fba3e47f351
- SSDEEP 384:3uo5Wffs4qNyEIYi2mL46rA+IVH8eJUozrT:TWffs4XYiDL9rA+G8qH
- TLSH T18913857046E85A49F7B33B3468B41A3D4D7BBC9198F4B34D1250A1398970B41AABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_es.dll
- Size 45KB
- SHA256 2fbba4fc7d228268864187ecb7d0e2b422666b4bfdd1362aea250080f9a67069
- MD5 256c09e4226ee618e01aba82d6970806
- SHA1 0dbf1152b9cf4ecaace1c52e07237aeb3650d9ff
- SHA512 a3af43167a37641afd185e60f6572bedd080e50df34423b5896b667cfe257ceffab72773eaddcf23003ff112a2cdec816aefc76c95b98bb66dae2534f3dd007b
- SSDEEP 192:3WTrdvandNmpcagbPQ2e8RSNyEIYiYF80dmL4pUQo78WzP7pDA+8QCFVHT/aMIoQ:3upadNzf1RSNyEIYi2mL46rA+IVHTpbQ
- TLSH T11D23957156E85A4AF7B33B30A874193D4E3B7CD198B8B34D124061798970B41AEADF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_et.dll
- Size 42KB
- SHA256 ebcdb76b3b262bc50ec9d57664d5434d9fee4d1489948407a8ea00dcfc5a5dd7
- MD5 92f0929a7db8dab2730c3a47e6ad0a4c
- SHA1 5784d736820c28951a3e547dff61b4811d8a3a23
- SHA512 9f3b7338bed7c2432e470022142b8db0ed4417cbc7583d5c525bb0f0259133eb0e3503c224aede7185841a008418010acb8fca6737966a71fcfb2b36262a2739
- SSDEEP 384:3upT7bDFbDZETJ9TSQlNyEIYi2mL46rA+IVHlQkpHW:+396nHaYiDL9rA+GSkp2
- TLSH T1E91388B156E48918E7F77E3068B40A2E59637DD2ADF0F34D1240A0389970741EABDF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_fa.dll
- Size 42KB
- SHA256 918d8958af126e611160178ff3629bee14aeeb9ae3f8be699f40799cc00cdb22
- MD5 72d22ff7cc30ef70c69dd60eb2627b00
- SHA1 765ef9e885267a34f0a2c555d6a99b5711fbfb4a
- SHA512 4040679e9b98facdea445981940d315f71a40530931812958beb011d1001a05c4d861f18394b68969245479fb5c975bd967d313cf43dc89ec51fbb3a78b0cf08
- SSDEEP 384:BMJZMK9Y5qNyEIYi2mL46rA+IVHSvry2e:iABXYiDL9rA+Gke
- TLSH T1601321368996CC38E7233A30D54BCD3F216361D864C1B77216D4643C96B03A9AB9FD6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_fi.dll
- Size 43KB
- SHA256 2ac1a4655a90a14bbeb38f3f6a0cc7c548b97e6da8095ee8d99e927e6070812f
- MD5 de675546caad9750e6950563d6264e33
- SHA1 6f82b32c2d8bfd8657b5a0930ecb0d49350b281c
- SHA512 1adf64440e4a70c4af785270a46a8381d460caef3ca991c233ad76dfbddbf2d4d345d7a28c7fbaa90c575bbe8c572faf0fd3369b452b1d65ed1157a8e01e793f
- SSDEEP 384:l7ePEzPhXY7RzYd99hKh1GAhNyEIYi2mL46rA+IVHVIjhX8vQerP:9ePEVmKgeYiDL9rA+GGjhMvVP
- TLSH T1AA13977142E88928E7B77F3029B44A2D46237DD269F4F34E1A40613C8971341AA7DF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_fil.dll
- Size 44KB
- SHA256 ac54bc8902d555c4d2a52bcc4f76dc747a2026fac2b244bc523889f8d9d63b3e
- MD5 1b9653af5c90c68b3d8d1d117f152414
- SHA1 6e5028d1d1da33d06b6188c059d6cc8e745817e2
- SHA512 a5180338bba6d4d3c9ac8c0a894bb982b09d6ce755e6224e12649a8c9fd62b4fab25c42ef69e9276f2d8f6ee3b59074ad10ca325db92053773a499c0960b8254
- SSDEEP 384:55UjdaUNPw+B3RVaw7yaNyEIYi2mL46rA+IVHscik:KaU9w+B3RVawWHYiDL9rA+Gyk
- TLSH T1B513B97156A8491CFBF73B3069A41A6D0677FC82A9F4F745224051399831381AFADF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_fr.dll
- Size 44KB
- SHA256 9e98b56d419a5ff65e8a9211ecfc050f6f364de1a4bd2298a73b9869c236e258
- MD5 5c50512848e1a659eb2f845ce01e22fd
- SHA1 b9af4c28197524e5c8fa59a266dca5d70ddfe10a
- SHA512 333a766c1948a1ba87d13219c3f68f13e2d640aa315ed7a84ebfe8b35ce33b9e29e3102175f6cd1cfd04e77e815ce55920ad495b236491984e94227a685880f0
- SSDEEP 384:egK98EoycpW4xFNyEIYi2mL46rA+IVHFyAH:fKaycN6YiDL9rA+G9
- TLSH T13323887157E44919F7B73B30A8B8492E0E277CDA99B0F35D1240A07D9930B419AADF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_gu.dll
- Size 44KB
- SHA256 4cf64a129f68cfb8ab45673ba69cf7fc1204370ab4d16ccae68009719cdf555e
- MD5 5ece7b1f8a10f5be4bc42ad8a4e64624
- SHA1 8ef8ef3c0ab1bc81758d4607667c368728620295
- SHA512 94b8f56b6d59d8b442989c49fdcd2a8155ced949fee7b3be5956f80019a0246b389d6dabad85cf981033fe76eccf6ea24494c85700ce09169cffc75097d06f65
- SSDEEP 384:zS53UbeAV4DnYCRfwmkIJNyEIYi2mL46rA+IVHg2y14V1:2JUbe7hb2YiDL9rA+GZU4V1
- TLSH T1DE230E391A4B4C8FE32AB530A5A4593E532718C0D7E0F343519862799EF13137A6EFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_hi.dll
- Size 43KB
- SHA256 8f1fddf64837e4ab81556b9100270152392d8872c07368cbafaf898d7acf070f
- MD5 c9a464b403625a639018bba572dec01a
- SHA1 f1a2fc0c475e9a74b533602a8c15e85f42cc3744
- SHA512 6a8f650d14ae2bbfd98ea3b33248d6526df3368c144636738550f594457e917ba27eaed017f94ec795ab2f52988b4186a557e9e5933aa361efb838acbcb2e12e
- SSDEEP 768:Bxx6AN6AQqjexbyqKXhHqCuYiDL9rA+GgnASN:BxxXY77A2
- TLSH T164136F3204404E2CE35D7E34F4640ABF5DEB609569CD3381A6C471B9D8F533A568EEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_hr.dll
- Size 43KB
- SHA256 a95e5d65d7e3c19a98156fddfbec8002195c5d3a1531fee1be5107737f0bde93
- MD5 83eb11120d84be4ff4af1f3842fd880f
- SHA1 fc0850430f8b1604794ee8977521bbf38fb8b4af
- SHA512 d65476c5526236b04c4130f7da77268bb4a3349c638835d3b929fbd991a12c4fb1445520044654524d57d368bfa3859b64f532bd867f99485cd366715a117073
- SSDEEP 384:zsaqdOXz19szMH5KBL/tNyEIYi2mL46rA+IVHlx9t6J9Bo:gaZ5oL/yYiDL9rA+GX9tco
- TLSH T19213DE3196E41919F7F77F3064B41B3E097B78E1A9F0B34E128065788A707419AADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_hu.dll
- Size 43KB
- SHA256 2d6cfa2394904a13b9d3396af945da430bd6efd25aee7df9d82f9054a30a9bab
- MD5 cba9ca9e10bb7c694c8029ce3048f8d4
- SHA1 2be3d377ee52bcebc046e2148faffc3236de2559
- SHA512 3ca12f28734d91e5ee37ede62fb52cb5f49b9d70355234e6a394bd66365581c35b5485691bc1a6d294f2a9cd7d4afed93b87e4ad28e4129b020ff8cbeccf68a0
- SSDEEP 768:+y7U7RPX1C2TycfBwGFTbeSDY6931lBVZpjqAy3FGVsYYiDL9rA+GG2Dy:+y7U791C2TzpwGFTbZY6d1lBVZ5qAy34
- TLSH T18C13DC3152E84949F7B37F313DB04A6E0A2778A069F8F34E5180A1BC9931741EA6DF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_id.dll
- Size 42KB
- SHA256 c6f7c0b5883f54aa6219ba3dcf138fb733fe3e52f7473f6773e47427a31a8a56
- MD5 353e8d13538ba049b8a258df5c30489c
- SHA1 aff02e15c406b2173739c6e403103b3faab6dba0
- SHA512 fbbedf04336f2b47c514d52575998a434caba3b993bb5e3f8d37df60c292e0d0f3a0cb6b130fe163dd381117f7e0818bede777f6f605aca0f8c3cea11798fa59
- SSDEEP 384:u4DaL3THRNkAHqQ3lFRf2I9ByrUDNyEIYi2mL46rA+IVHlinfy2V:PihR5gYiDL9rA+GUdV
- TLSH T1D713CBB142D8590CFBB73B3029B41A6D0A67BC82ADF0B34D624465389D717819E6EF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_is.dll
- Size 42KB
- SHA256 d46ca1ec84b58ae466bd48640cff5b8b963dacd035e23ff22ecdfbe91ed274e0
- MD5 da64c7a328c380f190bfc51946f954c1
- SHA1 83fc916f27296e9b88c5fd780b31d0585348d5cf
- SHA512 b5560ac7d3875610cfabde0b1bee1244fd8852a59edeeb1c967a7adf9248cde674386dc0d91bada5e361f86f646873a611b166b36dc7508c1fe23cae8df31e99
- SSDEEP 384:DaciZsioif2lIBuAjYkUVQFoMUefV3sNyEIYi2mL46rA+IVHJvH:ZiqibAIErkUVQF5UefV3ZYiDL9rA+G1
- TLSH T1CB13EC759398490CF7B77B3018F45A2E0A2BBDD29CF4F7491185A5388931382AA6DF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_it.dll
- Size 44KB
- SHA256 70dc992f6427e9c816edcebf0c6e897b18577ef42a0f712eff4a33f237c3b137
- MD5 9bc8e804034a99f3943a6c6e070f2225
- SHA1 d0b8be0bcf7dde3e7d3eacda1dd54a256ef89c73
- SHA512 2ffbc970cfc3abb34a5a9fc104f2ffc409fd69251e1ae770df71af47d4ade2fbeb237edad68bf6b0a7dda58c3bc11e502b3f21803c467cdc921b721442bb33a6
- SSDEEP 384:M8+DIN+shh3dTNyEIYi2mL46rA+IVHjD2Uyr5cI4:lKIN+q3dwYiDL9rA+GjDJ+u
- TLSH T10523637156E85A18F7F33B3068785A2E097B7D81A8B4F35D1281A07C99307119AADF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_iw.dll
- Size 40KB
- SHA256 c35efa99a02f31b6233b409844bb66e768813ff3d669e479c11c51791e738c44
- MD5 2fd70513f1ce4bf5e04d20045ed8cd06
- SHA1 8d612083e32227eb468d1113ad5e89419c6ed6ac
- SHA512 3b0bcbf7cb17e857f28ee16198de460b441f6b60cdac72587386fe1c3c8157af4cdea6925fd49e50a0f60c794b801aa26b0ed49f4cebbde017fbcf40f490e20a
- SSDEEP 384:pixv7hdVexaDywGfJssENyEIYi2mL46rA+IVHPJPDXx:c9NM1BYiDL9rA+GxDB
- TLSH T1631350714A50CDDCEB12FE32A24E0D3E5663E6C055E473532098A470AAB9392DB5EF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ja.dll
- Size 39KB
- SHA256 c41892511fcc4e7dbd7feb5c3a2f62e6446aec6dec66cb89d971ee4e817e44e1
- MD5 2777ebdb2749b787c126db01a47c96af
- SHA1 c955f0cef2005341f4c9e2a37d5082879b6dded2
- SHA512 ea8774bac30c5bb62c2dcf6d9f367f518461028e54ba34e89b09c6f0c2d1c4a46fd7a8d356dc763d420535db5f5195fdb157aaa477c0fbbaaf1f90251b8de2c1
- SSDEEP 192:scmE5rkl4EAnej0FgW5E9jbtsNyEIYiYF80dmL4pUQo78WzP7pDA+8QCFVHQSF3U:rb3EHj0FgWTNyEIYi2mL46rA+IVHQM3U
- TLSH T10A03B7B166504C0DFBB37A7010946E3E1A6BB4D155D1BB812180F03ADA70746AB6FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_kn.dll
- Size 44KB
- SHA256 31d8be4835ef78324b55e2754ff0de66203b71e4dce890d2559f611b8dae29cd
- MD5 0a7f1f9d4a4ab4f6ee3ad6c1fabf196b
- SHA1 3b002a52f98a8612f9be0e8cb0db7709efff0577
- SHA512 c7aedf0b3c70f078fa315a23825efc6877b2fb17238925afb41294d64b2af0f105d1d2f3a754331ab4bf53224ab0297dd12fc7a46f6b95d2a9df5ae9bb8f3902
- SSDEEP 384:5cTaUIRBSJNyEIYi2mL46rA+IVHV1ABd1:5qaU8k2YiDL9rA+GyH
- TLSH T1B4233079827A8C0AE7D1BAFB7096193D911359C353E0F3823184503C9A707765AAEFDE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ko.dll
- Size 39KB
- SHA256 37d6b57bd6faec1b0309580636fa209484df24fd1ec9c88e766167ab5eaa478e
- MD5 514d5154111905493c60e23711e1a61a
- SHA1 02c6da11c2b3f45108d342dfc3649c637ed03962
- SHA512 2136b0e56e7c6f45cd491560659a9cc06bd558d74932071f6db2cbcd438bf79b9542ef6f5fa6a45ad870b6ebd32fd240e86e748b9ba2d44c92b97608f4eeafea
- SSDEEP 384:MZ+/Td4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOgNyEIYi2mL46rA+IVHxR4+:w+/WmAf/jvVYiDL9rA+Go+
- TLSH T14A0394328594DC1DDB227A3165D54F7E627720C059E2B382A2C4F178EA71381AB2EFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_lt.dll
- Size 42KB
- SHA256 6c875faf2b3512ec40eaa1fb5d4a6cedf9ced9667ce51d53ed8b611fa7fd5517
- MD5 cb917d7a0d8b20cfdac7fcb7289373eb
- SHA1 19dc7a5c3d6cfb12094cabfd39d6f52ea088f4b3
- SHA512 23e9d169e76b8d1e96b43cdd6607eb937aff4e5ac0f5a3b4974ccd5b76946d8a8beca289cd72c000bc3148017ce3674d8c94907c508152486ed8b4eddf6f799c
- SSDEEP 384:otA3nc9eHz0CwTmDq092XVrNyEIYi2mL46rA+IVHYQD5:UOckHz05TmDq09hYiDL9rA+G7F
- TLSH T1A913DB7192E8494DF3F33E3051B44E3E4A7BB8D169F0B34A11946179C9707819AAEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_lv.dll
- Size 43KB
- SHA256 1cace30b99709c9bbc9a9b54d8f1cb7417f11288ba612a0225404a1c15004b14
- MD5 9a5a0af6717f5f936853004da2d1bab8
- SHA1 b600d4987c83cb03172412305b73dcf0996a60dc
- SHA512 e2c2b1a644d4f7504f92a91edb8bc12e50b88a4d7bb8b13a01a12e90d1f7dc70ed4196f5d8f5afbac2a03da0044233fbbd18b9c0cd3609c620f4e83b9706b070
- SSDEEP 384:pQ6ZyAxOeK6eSNyEIYi2mL46rA+IVH2sn666b:C4uPYiDL9rA+GjnOb
- TLSH T11313967192E8591CF3B37E3025B04A2E1A7B78916DF0F34E1140A1798A71741EABDF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ml.dll
- Size 46KB
- SHA256 07adb80bfe507e0f6ba5f541e224f0e934d0108094ca6f64f37b25a899aa1fca
- MD5 bec3f3bf852006e10998b7571bc63f32
- SHA1 aa1c45dfee5a87eebd003715612b7929a5c95e02
- SHA512 be462910b529a3d87248f0cabe28c39b7e4687919a370451b7e4dd202a917f11a7fb406a5500d24d0581c90af5fb65cad6b341868612fdd3a0d2ea6d41486e43
- SSDEEP 384:/8dIB7FZygp8/JLMsNyEIYi2mL46rA+IVHSgfLzR:wcWJLMZYiDL9rA+Gj
- TLSH T1A72342361504ED4BFBADB57039850A2F519B2E8E87E4F390119060B97D3A3036E6DFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_mr.dll
- Size 44KB
- SHA256 63dde7bad2506450ba9455ce223f3a64a25edfb214caef095664a9566565872f
- MD5 5eab26b8c529f323c0f84e6492c4421d
- SHA1 93d65488f6c7c5cbf56a33b135eac4a6c1d6eb98
- SHA512 6914622f0438b18a89986ab174941b16205f85f33c3b8abb74f3f832c91a06f180854d7004039fef947348ca43da922b0c07f3774652be9650e1d952b947a573
- SSDEEP 384:S/zdo/7JK7bABkQNyEIYi2mL46rA+IVHTAnqe1t:Uho/7JK7b5FYiDL9rA+GKqm
- TLSH T18D130D3941485D1AE32DBA70B4A41A3F0DD7288467ECB3811AC4B27CDDB43375A5EE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ms.dll
- Size 42KB
- SHA256 7c47709a33cb6d125634d9c8220a02eb45f96151d4219eca3eadd6dc6a89957d
- MD5 c0eac592f8ab42a99120af82dd7cabc9
- SHA1 633077a8550fe2703c9102c4d527f9930260d466
- SHA512 d23153c9fd4b5ec264e1e36ae8cefb8da321db669fbdcdf420fb9816c36b0355d627e5d6e2f30225a58716ef13aec31d5ae9c85c46bfff8d45a75368b3b40cf8
- SSDEEP 384:S6eOSeyrQLtUv6oNpaMkYjZZ/fbMgTRlREukNyEIYi2mL46rA+IVHNU7o5R:d8Zf3TF1YiDL9rA+Gq7U
- TLSH T103139AB152D8994CFBB77B3029B41A6D0A67BD82A9F0B35D524060388D707C19E6EF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_nl.dll
- Size 44KB
- SHA256 0f0f5e154c1688cbd77e5ea6d3d653f8e744498188b595e87466700d0ce4a4a2
- MD5 be431eccc948a67b03b973c400c36859
- SHA1 127c080447f1b542a9e1b736904d2d5e996234c8
- SHA512 8a0e18f741827806d4b7494034a74e740b3219151492abe0aa900ae1836f6a6d0bc3db754631a8111b24be20d7461e642b18de7ddcb933ed32bb64b211f2f14c
- SSDEEP 384:bI6Xd/T3kQNyEIYi2mL46rA+IVHRlSOfbb:E6tgFYiDL9rA+GKib
- TLSH T1BB13737252E8891CF7B73B3069B8592D4A777CC1A9F0F39D124061788970741AABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_no.dll
- Size 43KB
- SHA256 103654f6f1484ca7464dcbeddf35a1ecbbba4994ed3a36b9feced962ba0ac349
- MD5 c6cf9b8bafc0a28108bdf0636db8d04d
- SHA1 9429a869243097510364b8908411edcbf73ef2be
- SHA512 f521f72fcb1db98648a700ef5b11a4376df26dfde4a117bb58163ba7d34d8730df947986cac438de2b55c8187957f673cac69a85863b90b45eb61990e7b7cd8a
- SSDEEP 384:Wy5JZSiyCSiytNRAYiTvaK3Q9NyEIYi2mL46rA+IVHYIsv:wNCYGiK3QCYiDL9rA+GI
- TLSH T10613547197E4891DF7B23B3078B80A2D49677CD1A9B0F34D124460798971386E6BEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_pl.dll
- Size 43KB
- SHA256 cde72886e5c8a8b969b54b338d795464849891607167f69b22d7a103cb4c3195
- MD5 fb60e5fb65c6fbf5cbb82169f961d5cd
- SHA1 4e7eb47de00fbbdb60f64e8bb6bf4c3e1add409d
- SHA512 27361f9ea3b2b2fc53193662fbe3e4fce8f259ed6a452682cd4609e1098e4ced680810e9d69f80356198eea85b289ecb507348452cecde47cde5cf763bfd1949
- SSDEEP 384:t5c7n7KZHCCA7U8Gp6ZNyEIYi2mL46rA+IVHW53OB:U/y3AIyGYiDL9rA+Gc3K
- TLSH T10713FD3196F40948E7F77F3065B41A7E4A7B7C91A9F0B38A224061398570781AA6DF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_pt-BR.dll
- Size 43KB
- SHA256 afbad1d7ecbe27d079b0dc6186fc2117b15579fc62ba6d701cee69ef89cbfe7a
- MD5 b319fd51df69f628ced490d820e7a4a4
- SHA1 3f0bb4331ec68e828e6e9a0a7576a83de40b5efa
- SHA512 52c0046fecaadc85e2132a4aee37bc3bca6264415aa4816d798807cebdb232859f44af545035ea6aa221500bbf4ae37a32072ac944d0735391b0684de7cfc4d9
- SSDEEP 384:tEYxmgZcOZX8jNyEIYi2mL46rA+IVHwepZ8:yegAYiDL9rA+G7X8
- TLSH T1AB13977286F84A18F7B37B312874193E8977799168F4B389124060399970B41DABEF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_pt-PT.dll
- Size 43KB
- SHA256 e46ec30789af20a190ee9b2b80037d9516c17024a08fdf1235c83986fed692b2
- MD5 59d400e2a32b270cd269dd50af854c7a
- SHA1 51e56f77595508a26027bc17127dfea7f9851370
- SHA512 6d6399a2990d9af79bcd51bca639d036e12f543ff52a320aa0e321c4f3209df7c573fc3b807affef1d163eee3dba0933755402b96976ac271327fdd4c8a74797
- SSDEEP 384:+1pqzstnEx6ewBHjNyEIYi2mL46rA+IVHEh7xbrl7M:dIEx/UHAYiDL9rA+GunM
- TLSH T1E513887197F84A18F7B73B312874193E49777891A8F4B3491240A0399970B41EABDF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ro.dll
- Size 43KB
- SHA256 1bddd53a6e82377809fc53d1cfbc34db4c78fce3ba02bd4bcdb93d3ea188adbb
- MD5 1692a9fe1556b4c39046f2d6f9e79df0
- SHA1 2fe942e92756bce0e0815f4f96117556cf74fee7
- SHA512 a3665921bd849ab357c4f6f05e0494dfd6ff3313e51e250d2fef183d9ddd1c97db40e5ba8be0bf092d4dc62aef9250a2d1cd2da6d5d1c59a8cd307a0856b93a7
- SSDEEP 768:/k0CRNNDM7qm0GdVqT541naEpaYiDL9rA+G8:/kudVqlcah7F
- TLSH T11E13DB7153E80A18F7B33B3068741A3D1D7739A299F5F34E1144607C8A71B81AAADF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ru.dll
- Size 42KB
- SHA256 1fc32a049892dc1f0355ee36998307dff9c772faeb765af4c3fb6c59664c187d
- MD5 49268ad316bf399e494d4a367e0c9efd
- SHA1 59cfada1c935374ad3d82a4a8427a25c12566cf5
- SHA512 28ba78c4dc9095a7c58eb1878eeb2181e198cdbd76ac1ffca9b8840f26ec43f4dcb0e22f7bab4bd634337d50cc519332d7518a4357be009c809eed05f3467ad8
- SSDEEP 384:v6S5FA47AvHlho4d2ZNyEIYi2mL46rA+IVHeh5LUX:vV4vHUGYiDL9rA+GG6
- TLSH T14613FD7BA6688908E715B2741A514DFF2167739027D5B3C2618FBC74A074332772EE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sk.dll
- Size 43KB
- SHA256 f5ae209d26c4d050fba759163fdb34fe9d4768d28be3bd061839e561dcf92283
- MD5 078d32a65492723668ef3ae270e96a43
- SHA1 8a57e00d5b2aaf2859e772808fcf94a85c1b7fb0
- SHA512 12fcbdf92ae62c506962f8e4be74c2cd6b3f3eec6768da15a214a0815403b0eba8b12a9381c09083fe270ebf7230d217f23acd4efbe4aeab9ab9a28ebae37906
- SSDEEP 384:MuI8uhJPiR6gLT6NyEIYi2mL46rA+IVH4ytaA+:3O8RjnYiDL9rA+Gdu
- TLSH T1E7130F7252EC095AF7B77F3064B0493E0A7B38E1A9F4F34E5140A27489707819A6DF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sl.dll
- Size 43KB
- SHA256 928851cfd63d07890dc71415681426a41d98bc9ad217bba0c8a0f75435d87e64
- MD5 41a75297220e8f53eadc4322f600830a
- SHA1 301193225b836fa49eb7c53deebf74e21cf17340
- SHA512 e3521c25e5377d9ee613b98f320be8121efd02597ed88d6499d0a5ae830619b0b6044759f8363a49d17db35d92a50869784a2fda2d54dcb15760290793f6a4d4
- SSDEEP 384:DkgTcshVyigOHHTpWBdH1i2IXousPeNyEIYi2mL46rA+IVH3NdirFr:IDhOHHy1YZsLYiDL9rA+GGpr
- TLSH T18A139A7152F8090DF7B73B3054B40A7D0A7B79E5A9F4F30D118061B88971782AAADF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sr.dll
- Size 43KB
- SHA256 90900c70013e91ab82a5a15dc94b7d32918e306274f4ab4955a54f5ba3ca998a
- MD5 5bacc58c8844e2151bae06229f8dae36
- SHA1 69ebd55c6c1ffadc49a714876acdc2c0e45a3b7a
- SHA512 e4e83cb3908ad01eed42034e7dc2bb035478b235966b7384fd2feacb337883074227fc4fbe5ea3b09c9f6bf08e6cfd24f7d0b872578735dc42dc0b1fc9456fa6
- SSDEEP 384:pp4aOxCx7UjYN3tGZNyEIYi2mL46rA+IVHDdYC6q4/3:D40Uj+dGGYiDL9rA+GBp0
- TLSH T18313993FA5B88908F751B6301AA48AFE256B779067E47386518F7C749034732371EE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sv.dll
- Size 43KB
- SHA256 f33ad18ac47147279d380489c7b462e1c996a6b47a02ca95cbc9302be279f406
- MD5 70e09de59d2902e0541aeff9ba1d4fa5
- SHA1 ade2b827acda616aa8940d9cc6dfa2f86a7df537
- SHA512 ca1fd4b656d4eb4ed6e4c5a8abea4743a46ccbbbb9466cb75792c4d45d5bafff9165bd4bd8cba78655a51ccdbd991bfe11d5b43a1124ce825fdd65c8622b9278
- SSDEEP 384:/K0xC7Ec3EeNyEIYi2mL46rA+IVH09qEI:C0xCYc3ETYiDL9rA+GNj
- TLSH T14013737157E8491CF7B33B3068B44A2E0967BCC159F4F3592240A5BC8970746A6BEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_sw.dll
- Size 44KB
- SHA256 22055dfdfc1d802522e8f95801e334cc9e1c5fc3017513c88169aca9b295d334
- MD5 dbab545d001af49401e6e00a925442d5
- SHA1 4286164685aab5b65c4f63c677a79a6d6b581d94
- SHA512 ffa620f2c673ab767c0eee0a130ba2ec0108b4ea6861dc36b3a690388a15674fa34c4ae02fc1ad9c764a5253c5484feeff36ec8cb2ffe44ea0133d3b07419daa
- SSDEEP 384:spUgicgiY7upr4M5dNyEIYi2mL46rA+IVH/r/k7:AUQ07Gr4M5iYiDL9rA+GDi
- TLSH T1C423B938555C5D0AF7F7BE3179946A2D062379A26BF4F381108460388D307A39ABDF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_ta.dll
- Size 45KB
- SHA256 8831fd69edd5818493171107944d69dc2512767f250094a239559760e886b8ac
- MD5 3bd09a243fd0f5bfe0e11c9a10bacd49
- SHA1 de2a621441de65440184ee0c9e8aa0ddb9ed37cd
- SHA512 6252b25ba5e96d0ff8db512dc003c20824f1b07497c73cbc972b0e7bf646f2f9ef5b71af6005086b307fa1ec94ffe5d1c6bf7ac6b15efb4441744b268dcb73c2
- SSDEEP 384:LuNwMY51ZLm+4HwTNyEIYi2mL46rA+IVHWW7sxI:iNHY51ZLm+4HwwYiDL9rA+GWI
- TLSH T1E623323D0A1BBC0AEB25B93179A8593E05172C8097E1F3B01199A43CDEF8F12666DF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_te.dll
- Size 44KB
- SHA256 47e435a76a6ebc0e4a0d05d735f6796bf5bb2dc399bfc723b0aaf7cf8f1ed63e
- MD5 3cce97eb9fa0882bbc95409d441a4163
- SHA1 5f3ac591c9f9bbfb7be3d5eafead9ec42d56b4ff
- SHA512 7237cb521c2069c806f0782de7efb81f5031ff7aeaa8dac2c5b419e11cf2be1a3d177d7630b9eab0e77130076cf6429e578a8e2d94b3aad8a428ec185eb9a555
- SSDEEP 384:bbnig45Z4aJ8LDlNyEIYi2mL46rA+IVH59ius:XniN5ya+LDaYiDL9rA+Gts
- TLSH T13A231C3909084C0AE3DDBAB074985A3D186759C16FE0F36290C5A038DE717376A9DEEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_th.dll
- Size 42KB
- SHA256 dd91daa472bbff5dd4364698e5ad4810d1f20dc38e46c497838c6be6038baf10
- MD5 19fd2bf23d7e1fbb5fc961a40d59cd16
- SHA1 a6440995a95cd63f5ed3411545e87d2a37ed22cd
- SHA512 526c23b91fc12832c1c85e902af0e80615f2671d3b5e71ee43316069520c291da05e318f52c2ec98028d65d0e3734a3b9490d165ffb8e8af7c10a2155c388e65
- SSDEEP 384:kq4lrGsMKNMfetNoNyEIYi2mL46rA+IVH2vri:j4lrGszNMfetNtYiDL9rA+GWi
- TLSH T1DD130B7182B15E0AC71BB5B0E1D40E3F3C2B6591D8D6B391909AE934D630362A7FEC5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM1AC9.tmp\goopdateres_tr.dll
- Size 43KB
- SHA256 b9f9b72473a7a0d9b0d6b546b0931e486a53e0cdea074a8120740fcd1c4c1e01
- MD5 17d1267fc9657e7049aa6951eb107ea3
- SHA1 3f266eec7dfdddf1252ece3654be250765f6846b
- SHA512 00f6bfe05c186c6f6772bc87360e23baa3df21bafb51067a379919ccbbaec894a142f056e7ee9e2e706a95345155aa00bb0b55e3c87fb415d8aa40f2dd2935fb
- SSDEEP 768:k1p9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSXHYiDL9rA+GvH:k1ZhdmvMFGkSxLQKH7KH
- TLSH T1D513DB3143D84E0AF7F33B3428B4593E0AA779E5B9F0B34E2191A13999703815A5DF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{0A342CF9-00AC-45CF-A6B9-86A25F128908}\.ba\SideBar.png
- Size 50KB
- SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
- MD5 888eb713a0095756252058c9727e088a
- SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
- SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
- SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
- TLSH T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{0A342CF9-00AC-45CF-A6B9-86A25F128908}\.be\python-3.15.1-amd64.exe
- Size 881KB
- SHA256 2bfca3d4c84ee41663e8d51ec2bec99742211ebc38c34bc4efda5bb3aac5772e
- MD5 abf1b29ac805f21dd802362627693c0a
- SHA1 f24114ef1918283de562349012e52ade6863b751
- SHA512 45f4c40419cacc5727723f26e913b2e74e80302961a9ba1f150c3f04ad76888ce062b070f89f0699b3f828f8812ec96188c7c6c8ecafcdd309d2f4f0562368b7
- SSDEEP 24576:33WnIZuMCxezot7SGqYDVWJQGrKtMOgPAwd:3LZ5zot7S8DVWJQGrROkjd
- TLSH T1B215AF32A5A04072E7F10173BA24E6307E7CAF282751C8AEE7D4BE1D7D74491A7B7252
- MD5 SHA1 SHA512 SSDEEP TLSH