File name:

BraveBrowserSetup-BRV029.exe

Full analysis: https://app.any.run/tasks/73aac948-f54e-4fd3-ba3d-057b1d9c9749
Verdict: Malicious activity
Analysis date: August 17, 2024, 19:12:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

027E0CB45754189548920741A4439EB0

SHA1:

0193579D9AD35A0E77C983BF7662D100E808FDB4

SHA256:

1B63ED77143582C274CA36270089AF7240D567A9C27D50851574238EBDB8E088

SSDEEP:

49152:htxEYmDHDZP813SUyrdnodvFvnaM1l0vO9SrNCkqjCPpIqzorwSqhh81dORbIzQi:h8YsHZQ3QrdodvFvJ1uW9oB+q0rpYb5A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • BraveUpdate.exe (PID: 6360)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • BraveUpdateSetup.exe (PID: 6624)
      • BraveUpdate.exe (PID: 6744)
      • BraveBrowserSetup-BRV029.exe (PID: 6488)

    • Reads security settings of Internet Explorer

      • BraveUpdate.exe (PID: 6528)
      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 6360)

    • Executable content was dropped or overwritten

      • BraveUpdateSetup.exe (PID: 6624)
      • BraveUpdate.exe (PID: 6744)
      • BraveBrowserSetup-BRV029.exe (PID: 6488)

    • Starts itself from another location

      • BraveUpdate.exe (PID: 6744)

    • Disables SEHOP

      • BraveUpdate.exe (PID: 6744)

    • Creates/Modifies COM task schedule object

      • BraveUpdate.exe (PID: 7044)
      • BraveUpdateComRegisterShell64.exe (PID: 7152)
      • BraveUpdateComRegisterShell64.exe (PID: 7120)
      • BraveUpdateComRegisterShell64.exe (PID: 7084)

    • Reads the date of Windows installation

      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 6528)

    • Executes as Windows Service

      • BraveUpdate.exe (PID: 6292)

  • INFO

    • Checks supported languages

      • BraveBrowserSetup-BRV029.exe (PID: 6488)
      • BraveUpdateSetup.exe (PID: 6624)
      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 7000)
      • BraveUpdateComRegisterShell64.exe (PID: 7120)
      • BraveUpdateComRegisterShell64.exe (PID: 7152)
      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 7044)
      • BraveUpdateComRegisterShell64.exe (PID: 7084)
      • BraveUpdate.exe (PID: 6360)
      • BraveUpdate.exe (PID: 6292)
      • BraveUpdate.exe (PID: 6528)

    • Process checks computer location settings

      • BraveUpdate.exe (PID: 6528)
      • BraveUpdate.exe (PID: 6744)

    • Reads the computer name

      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 7044)
      • BraveUpdateComRegisterShell64.exe (PID: 7084)
      • BraveUpdate.exe (PID: 7000)
      • BraveUpdateComRegisterShell64.exe (PID: 7120)
      • BraveUpdateComRegisterShell64.exe (PID: 7152)
      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6360)
      • BraveUpdate.exe (PID: 6292)
      • BraveUpdate.exe (PID: 6528)

    • Creates files in the program directory

      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 6292)

    • Checks proxy server information

      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6360)

    • Reads the machine GUID from the registry

      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6292)

    • Reads the software policy settings

      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6292)

    • Create files in a temporary directory

      • BraveBrowserSetup-BRV029.exe (PID: 6488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:14 06:30:17+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.4
CodeSize: 105984
InitializedDataSize: 1149952
UninitializedDataSize: -
EntryPoint: 0x6f17
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.361.151
ProductVersionNumber: 1.3.361.151
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: BraveSoftware Inc.
FileDescription: BraveSoftware Update Setup
FileVersion: 1.3.361.151
InternalName: BraveSoftware Update Setup
OriginalFileName: BraveUpdateSetup.exe
ProductName: BraveSoftware Update
ProductVersion: 1.3.361.151
LanguageId: en
PrivateBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
12
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start bravebrowsersetup-brv029.exe braveupdate.exe no specs braveupdatesetup.exe braveupdate.exe braveupdate.exe no specs braveupdate.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdate.exe braveupdate.exe no specs braveupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
6264"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5OTA2ODdGNi1CNTQyLTRDQjgtODMwMi0xNDBBQTNFMzU0NzN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MzNFOTlCMDktRjc5My00MjBGLThEMTUtM0Q2OEIyMEI0RkRDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI0IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE1MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjk3Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6292"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svcC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
services.exe
User:
SYSTEM
Company:
BraveSoftware Inc.
Integrity Level:
SYSTEM
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6360"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{990687F6-B542-4CB8-8302-140AA3E35473}"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6488"C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe" C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe
explorer.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
MEDIUM
Description:
BraveSoftware Update Setup
Version:
1.3.361.151
Modules
Images
c:\users\admin\desktop\bravebrowsersetup-brv029.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6528C:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"C:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdate.exe—BraveBrowserSetup-BRV029.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
MEDIUM
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\users\admin\appdata\local\temp\gum64b1.tmp\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6624"C:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateSetup.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateSetup.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update Setup
Version:
1.3.361.151
Modules
Images
c:\users\admin\appdata\local\temp\gum64b1.tmp\braveupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6744C:\WINDOWS\SystemTemp\GUM6B59.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installelevatedC:\Windows\SystemTemp\GUM6B59.tmp\BraveUpdate.exe
BraveUpdateSetup.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\windows\systemtemp\gum6b59.tmp\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7000"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvcC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7044"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserverC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7084"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe" C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\1.3.361.151\braveupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
17 839
Read events
13 659
Write events
4 115
Delete events
65

Modification events

(PID) Process:(6488) BraveBrowserSetup-BRV029.exeKey:HKEY_CURRENT_USER\SOFTWARE\BraveSoftware\Promo
Operation:writeName:StubInstallerPath
Value:
C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:path
Value:
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:UninstallCmdLine
Value:
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:pv
Value:
1.3.361.151
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:name
Value:
Brave Update
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\ClientState\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:pv
Value:
1.3.361.151
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:brave_task_name_c
Value:
BraveSoftwareUpdateTaskMachineCore{5287C494-8F7A-4058-BEEE-D18B1178B0F7}
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:brave_task_name_ua
Value:
BraveSoftwareUpdateTaskMachineUA{9B755D61-FCF2-4BA1-A818-AED50BE27279}
(PID) Process:(7000) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:delete valueName:uid
Value:
Executable files
216
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateBroker.exeexecutable
MD5:CF292A100BE1AAA41C322AC61D82B6BF
SHA256:A63630FBED9C9163FD0A25228A6E02899387C2AFD18901A52E30927317183057
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveCrashHandler.exeexecutable
MD5:81ADB79FCB7B0ABA09205C39D127ECE1
SHA256:75CE17927E955E86CBC628E4E8C72386B1B22A106CA3573E97FAFB0D774D19B6
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateOnDemand.exeexecutable
MD5:7F6200A8583D02A2D8D0C814F992A6D8
SHA256:85C92E1F393137FED880E28353B0CEF03D92140EB87BC128FA5E15520A56F742
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\psmachine.dllexecutable
MD5:C5827FB8D1D300AA27F17DD59112B526
SHA256:4531C5123AB858BFD02A69FD460CF146AE3135663EABCD35C9EADDA94BE5D7DC
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateCore.exeexecutable
MD5:E7C0BC4A9E531E115EF94315A22EA400
SHA256:5846B62D4E224DDD4554486D869C32F0EC120244A1289B6257A9D280FF8B6E1E
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateComRegisterShell64.exeexecutable
MD5:E220FC6D2C1960901E7298A87EFC7948
SHA256:A68F4CBC4DD1208791DF3025E32F24DE53B4E21202F7A3828347F3CFD7AEBA6C
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\psuser.dllexecutable
MD5:803F7C8B41E1B3CEBC9DE886989211D9
SHA256:EAE29F79607978DBBFA7F4A3D21041EBE27446D3E2574795945105967AD84BA9
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\goopdateres_am.dllexecutable
MD5:FD9DDF42CCF28658A86CC9AA5E55ADAB
SHA256:A1DC5A45468DE4FB398494554ADF08BCB6A6FADDE16358EA5A8FBB5195FF7CE2
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\psuser_64.dllexecutable
MD5:0D2979C9EEC96087D984EC94ADBF8249
SHA256:A71E69FEB607DFE1112B43E4F81D04BF96E0E72567CDD50DB672DCE40953BAC1
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\goopdateres_ar.dllexecutable
MD5:85AE6D08531E7A1469929EE4AC5E9975
SHA256:96BA105021E158715EAFCF828BDD15FC08E63623D24BB7E6C5C659DE3E809983
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
3.161.82.75:443
https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/127.1.68.141/x64/brave_installer-x64.exe
unknown
—
—
unknown
—
—
POST
200
13.32.121.6:443
https://updates.bravesoftware.com/service/update2
unknown
xml
250 b
unknown
—
—
GET
200
3.161.82.36:443
https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/127.1.68.141/x64/brave_installer-x64.exe
unknown
executable
117 Mb
unknown
—
—
POST
200
13.32.121.47:443
https://updates.bravesoftware.com/service/update2?cup2key=2:2XyXZqOTz-ZTDPshpMv9aI3P9DyX_S-VaERLnMR_DsM&cup2hreq=aecd10ca0613383a88bd142c7732e88023eb1b066f6919d98b620cc021ad0e84
unknown
xml
6.59 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4084
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6264
BraveUpdate.exe
13.32.121.47:443
updates.bravesoftware.com
AMAZON-02
US
unknown
6292
BraveUpdate.exe
13.32.121.47:443
updates.bravesoftware.com
AMAZON-02
US
unknown
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6792
svchost.exe
3.161.82.36:443
updates-cdn.bravesoftware.com
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.46
whitelisted
updates.bravesoftware.com
  • 13.32.121.47
  • 13.32.121.70
  • 13.32.121.124
  • 13.32.121.6
shared
dl.brave.com
  • —
whitelisted
updates-cdn.bravesoftware.com
  • 3.161.82.36
  • 3.161.82.8
  • 3.161.82.23
  • 3.161.82.75
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BraveBrowserSetup-BRV029.exe