File name:

BraveBrowserSetup-BRV029.exe

Full analysis: https://app.any.run/tasks/642fa32c-fff7-4947-a01e-a2348c807262
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 16, 2024, 14:55:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

027E0CB45754189548920741A4439EB0

SHA1:

0193579D9AD35A0E77C983BF7662D100E808FDB4

SHA256:

1B63ED77143582C274CA36270089AF7240D567A9C27D50851574238EBDB8E088

SSDEEP:

49152:htxEYmDHDZP813SUyrdnodvFvnaM1l0vO9SrNCkqjCPpIqzorwSqhh81dORbIzQi:h8YsHZQ3QrdodvFvJ1uW9oB+q0rpYb5A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • BraveUpdate.exe (PID: 7140)

    • Actions looks like stealing of personal data

      • setup.exe (PID: 2204)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • BraveBrowserSetup-BRV029.exe (PID: 6496)
      • BraveUpdateSetup.exe (PID: 6600)
      • BraveUpdate.exe (PID: 6780)
      • brave_installer-x64.exe (PID: 6140)

    • Reads the date of Windows installation

      • BraveUpdate.exe (PID: 6516)
      • BraveUpdate.exe (PID: 6780)

    • Executable content was dropped or overwritten

      • BraveBrowserSetup-BRV029.exe (PID: 6496)
      • BraveUpdate.exe (PID: 6780)
      • BraveUpdateSetup.exe (PID: 6600)
      • brave_installer-x64.exe (PID: 6140)

    • Starts itself from another location

      • BraveUpdate.exe (PID: 6780)

    • Reads security settings of Internet Explorer

      • BraveUpdate.exe (PID: 6516)
      • BraveUpdate.exe (PID: 6780)
      • BraveUpdate.exe (PID: 7140)

    • Disables SEHOP

      • BraveUpdate.exe (PID: 6780)

    • Creates/Modifies COM task schedule object

      • BraveUpdateComRegisterShell64.exe (PID: 6936)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdateComRegisterShell64.exe (PID: 7012)
      • BraveUpdateComRegisterShell64.exe (PID: 6972)

    • Executes as Windows Service

      • BraveUpdate.exe (PID: 4064)

    • Application launched itself

      • setup.exe (PID: 2204)

  • INFO

    • Reads the computer name

      • BraveUpdate.exe (PID: 6516)
      • BraveUpdate.exe (PID: 6780)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdateComRegisterShell64.exe (PID: 6972)
      • BraveUpdate.exe (PID: 6860)
      • BraveUpdateComRegisterShell64.exe (PID: 7012)
      • BraveUpdateComRegisterShell64.exe (PID: 6936)
      • BraveUpdate.exe (PID: 7056)
      • BraveUpdate.exe (PID: 7140)
      • brave_installer-x64.exe (PID: 6140)
      • BraveUpdate.exe (PID: 4064)
      • setup.exe (PID: 2204)

    • Create files in a temporary directory

      • BraveBrowserSetup-BRV029.exe (PID: 6496)

    • Checks supported languages

      • BraveBrowserSetup-BRV029.exe (PID: 6496)
      • BraveUpdateSetup.exe (PID: 6600)
      • BraveUpdate.exe (PID: 6516)
      • BraveUpdate.exe (PID: 6780)
      • BraveUpdate.exe (PID: 6860)
      • BraveUpdateComRegisterShell64.exe (PID: 6936)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdateComRegisterShell64.exe (PID: 6972)
      • BraveUpdateComRegisterShell64.exe (PID: 7012)
      • BraveUpdate.exe (PID: 7056)
      • BraveUpdate.exe (PID: 7140)
      • BraveUpdate.exe (PID: 4064)
      • brave_installer-x64.exe (PID: 6140)
      • setup.exe (PID: 2204)
      • setup.exe (PID: 6468)

    • Process checks computer location settings

      • BraveUpdate.exe (PID: 6516)
      • BraveUpdate.exe (PID: 6780)

    • Creates files in the program directory

      • BraveUpdate.exe (PID: 6780)
      • BraveUpdate.exe (PID: 4064)
      • brave_installer-x64.exe (PID: 6140)
      • setup.exe (PID: 2204)

    • Checks proxy server information

      • BraveUpdate.exe (PID: 7056)
      • BraveUpdate.exe (PID: 7140)

    • Reads the machine GUID from the registry

      • BraveUpdate.exe (PID: 7056)
      • BraveUpdate.exe (PID: 4064)

    • Reads the software policy settings

      • BraveUpdate.exe (PID: 4064)
      • BraveUpdate.exe (PID: 7056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:14 06:30:17+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.4
CodeSize: 105984
InitializedDataSize: 1149952
UninitializedDataSize: -
EntryPoint: 0x6f17
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.361.151
ProductVersionNumber: 1.3.361.151
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: BraveSoftware Inc.
FileDescription: BraveSoftware Update Setup
FileVersion: 1.3.361.151
InternalName: BraveSoftware Update Setup
OriginalFileName: BraveUpdateSetup.exe
ProductName: BraveSoftware Update
ProductVersion: 1.3.361.151
LanguageId: en
PrivateBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
15
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start bravebrowsersetup-brv029.exe braveupdate.exe no specs braveupdatesetup.exe braveupdate.exe braveupdate.exe no specs braveupdate.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdate.exe braveupdate.exe no specs braveupdate.exe brave_installer-x64.exe setup.exe setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2204"C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\CR_73F6F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\CR_73F6F.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\gui8A04.tmp" --brave-referral-code="BRV029"C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\CR_73F6F.tmp\setup.exe
brave_installer-x64.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
HIGH
Description:
Brave Installer
Version:
127.1.68.141
Modules
Images
c:\program files (x86)\bravesoftware\update\install\{838ed8a8-f1b2-48a9-9ae5-93d14b945a96}\cr_73f6f.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4064"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svcC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
services.exe
User:
SYSTEM
Company:
BraveSoftware Inc.
Integrity Level:
SYSTEM
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6140"C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\gui8A04.tmp"C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\brave_installer-x64.exe
BraveUpdate.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
HIGH
Description:
Brave Installer
Version:
127.1.68.141
Modules
Images
c:\program files (x86)\bravesoftware\update\install\{838ed8a8-f1b2-48a9-9ae5-93d14b945a96}\brave_installer-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shell32.dll
6468"C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\CR_73F6F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=127.1.68.141 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff767873a70,0x7ff767873a7c,0x7ff767873a88C:\Program Files (x86)\BraveSoftware\Update\Install\{838ED8A8-F1B2-48A9-9AE5-93D14B945A96}\CR_73F6F.tmp\setup.exe—setup.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
HIGH
Description:
Brave Installer
Version:
127.1.68.141
Modules
Images
c:\program files (x86)\bravesoftware\update\install\{838ed8a8-f1b2-48a9-9ae5-93d14b945a96}\cr_73f6f.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6496"C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe" C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe
explorer.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
MEDIUM
Description:
BraveSoftware Update Setup
Version:
1.3.361.151
Modules
Images
c:\users\admin\desktop\bravebrowsersetup-brv029.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6516C:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"C:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdate.exe—BraveBrowserSetup-BRV029.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
MEDIUM
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\users\admin\appdata\local\temp\gum59b4.tmp\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6600"C:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdateSetup.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdateSetup.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update Setup
Version:
1.3.361.151
Modules
Images
c:\users\admin\appdata\local\temp\gum59b4.tmp\braveupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6780C:\WINDOWS\SystemTemp\GUM6128.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installelevatedC:\Windows\SystemTemp\GUM6128.tmp\BraveUpdate.exe
BraveUpdateSetup.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\windows\systemtemp\gum6128.tmp\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6860"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvcC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6904"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserverC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
18 180
Read events
13 969
Write events
4 127
Delete events
84

Modification events

(PID) Process:(6496) BraveBrowserSetup-BRV029.exeKey:HKEY_CURRENT_USER\SOFTWARE\BraveSoftware\Promo
Operation:writeName:StubInstallerPath
Value:
C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe
(PID) Process:(6780) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:path
Value:
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
(PID) Process:(6780) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:UninstallCmdLine
Value:
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
(PID) Process:(6780) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:pv
Value:
1.3.361.151
(PID) Process:(6780) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:name
Value:
Brave Update
(PID) Process:(6780) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\ClientState\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:pv
Value:
1.3.361.151
(PID) Process:(6780) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(6860) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:delete valueName:uid
Value:
(PID) Process:(6860) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:delete valueName:old-uid
Value:
(PID) Process:(6860) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BraveUpdate.exe
Operation:writeName:AppID
Value:
{08F15E98-0442-45D3-82F1-F67495CC51EB}
Executable files
217
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdateBroker.exeexecutable
MD5:CF292A100BE1AAA41C322AC61D82B6BF
SHA256:A63630FBED9C9163FD0A25228A6E02899387C2AFD18901A52E30927317183057
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdateComRegisterShell64.exeexecutable
MD5:E220FC6D2C1960901E7298A87EFC7948
SHA256:A68F4CBC4DD1208791DF3025E32F24DE53B4E21202F7A3828347F3CFD7AEBA6C
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdateOnDemand.exeexecutable
MD5:7F6200A8583D02A2D8D0C814F992A6D8
SHA256:85C92E1F393137FED880E28353B0CEF03D92140EB87BC128FA5E15520A56F742
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveCrashHandler64.exeexecutable
MD5:4ADB838CB7A9E891860795E656735392
SHA256:8EE76A58C1A74D48B2AF1A9C309844FD65D21E8E68EA6AD05D7892D248404F97
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\psuser_64.dllexecutable
MD5:0D2979C9EEC96087D984EC94ADBF8249
SHA256:A71E69FEB607DFE1112B43E4F81D04BF96E0E72567CDD50DB672DCE40953BAC1
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\psmachine_64.dllexecutable
MD5:00B1085BA261490B1EB1EC3186C3766D
SHA256:E5CCD07897BAABA3EA11BB438DD6A8FCC1CB0F5AA2134B2CCF9D367788EF94EA
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveUpdateCore.exeexecutable
MD5:E7C0BC4A9E531E115EF94315A22EA400
SHA256:5846B62D4E224DDD4554486D869C32F0EC120244A1289B6257A9D280FF8B6E1E
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveCrashHandlerArm64.exeexecutable
MD5:D4FFAC11164BA5D97BB691A84E4C70F4
SHA256:83208AE11A322F542F06A4B8C31BBDF2FE702C507259C760D95683E44402A2BA
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\goopdate.dllexecutable
MD5:9C52E4366ACE494E672E9720735CED38
SHA256:BE42E01984B9DC67FF12832DEEE68F0418F9B9AC6B6FA69747460888D2410911
6496BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM59B4.tmp\BraveCrashHandler.exeexecutable
MD5:81ADB79FCB7B0ABA09205C39D127ECE1
SHA256:75CE17927E955E86CBC628E4E8C72386B1B22A106CA3573E97FAFB0D774D19B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
13.32.121.47:443
https://updates.bravesoftware.com/service/update2
unknown
xml
250 b
—
—
—
HEAD
200
3.161.82.23:443
https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/127.1.68.141/x64/brave_installer-x64.exe
unknown
—
—
—
—
—
GET
200
3.161.82.8:443
https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/127.1.68.141/x64/brave_installer-x64.exe
unknown
executable
117 Mb
—
—
—
POST
200
13.32.121.124:443
https://updates.bravesoftware.com/service/update2?cup2key=2:eyOWviuYWh7fh_0LSIWFDDs46Rm0eiyvI8TqN4JZteo&cup2hreq=59c55fd61b99d59fc8c7a030e60045ef8e248bc47abb242ef7453a0fe0d90a2e
unknown
xml
6.54 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5588
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1164
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5588
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7056
BraveUpdate.exe
13.32.121.47:443
updates.bravesoftware.com
AMAZON-02
US
unknown
4064
BraveUpdate.exe
13.32.121.47:443
updates.bravesoftware.com
AMAZON-02
US
unknown
4324
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7064
svchost.exe
3.161.82.23:443
updates-cdn.bravesoftware.com
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
whitelisted
updates.bravesoftware.com
  • 13.32.121.47
  • 13.32.121.70
  • 13.32.121.124
  • 13.32.121.6
shared
dl.brave.com
  • —
whitelisted
updates-cdn.bravesoftware.com
  • 3.161.82.23
  • 3.161.82.36
  • 3.161.82.75
  • 3.161.82.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BraveBrowserSetup-BRV029.exe