File name:

BraveBrowserSetup-BRV029.exe

Full analysis: https://app.any.run/tasks/73aac948-f54e-4fd3-ba3d-057b1d9c9749
Verdict: Malicious activity
Analysis date: August 17, 2024, 19:12:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

027E0CB45754189548920741A4439EB0

SHA1:

0193579D9AD35A0E77C983BF7662D100E808FDB4

SHA256:

1B63ED77143582C274CA36270089AF7240D567A9C27D50851574238EBDB8E088

SSDEEP:

49152:htxEYmDHDZP813SUyrdnodvFvnaM1l0vO9SrNCkqjCPpIqzorwSqhh81dORbIzQi:h8YsHZQ3QrdodvFvJ1uW9oB+q0rpYb5A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • BraveUpdate.exe (PID: 6360)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BraveBrowserSetup-BRV029.exe (PID: 6488)
      • BraveUpdate.exe (PID: 6744)
      • BraveUpdateSetup.exe (PID: 6624)

    • Drops the executable file immediately after the start

      • BraveBrowserSetup-BRV029.exe (PID: 6488)
      • BraveUpdate.exe (PID: 6744)
      • BraveUpdateSetup.exe (PID: 6624)

    • Disables SEHOP

      • BraveUpdate.exe (PID: 6744)

    • Starts itself from another location

      • BraveUpdate.exe (PID: 6744)

    • Reads the date of Windows installation

      • BraveUpdate.exe (PID: 6528)
      • BraveUpdate.exe (PID: 6744)

    • Reads security settings of Internet Explorer

      • BraveUpdate.exe (PID: 6528)
      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 6360)

    • Creates/Modifies COM task schedule object

      • BraveUpdate.exe (PID: 7044)
      • BraveUpdateComRegisterShell64.exe (PID: 7084)
      • BraveUpdateComRegisterShell64.exe (PID: 7120)
      • BraveUpdateComRegisterShell64.exe (PID: 7152)

    • Executes as Windows Service

      • BraveUpdate.exe (PID: 6292)

  • INFO

    • Create files in a temporary directory

      • BraveBrowserSetup-BRV029.exe (PID: 6488)

    • Checks supported languages

      • BraveUpdate.exe (PID: 6528)
      • BraveBrowserSetup-BRV029.exe (PID: 6488)
      • BraveUpdate.exe (PID: 7000)
      • BraveUpdateSetup.exe (PID: 6624)
      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 7044)
      • BraveUpdateComRegisterShell64.exe (PID: 7084)
      • BraveUpdateComRegisterShell64.exe (PID: 7120)
      • BraveUpdateComRegisterShell64.exe (PID: 7152)
      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6360)
      • BraveUpdate.exe (PID: 6292)

    • Reads the computer name

      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 6528)
      • BraveUpdate.exe (PID: 7000)
      • BraveUpdate.exe (PID: 7044)
      • BraveUpdateComRegisterShell64.exe (PID: 7120)
      • BraveUpdateComRegisterShell64.exe (PID: 7152)
      • BraveUpdateComRegisterShell64.exe (PID: 7084)
      • BraveUpdate.exe (PID: 6360)
      • BraveUpdate.exe (PID: 6292)
      • BraveUpdate.exe (PID: 6264)

    • Creates files in the program directory

      • BraveUpdate.exe (PID: 6744)
      • BraveUpdate.exe (PID: 6292)

    • Process checks computer location settings

      • BraveUpdate.exe (PID: 6528)
      • BraveUpdate.exe (PID: 6744)

    • Checks proxy server information

      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6360)

    • Reads the software policy settings

      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6292)

    • Reads the machine GUID from the registry

      • BraveUpdate.exe (PID: 6264)
      • BraveUpdate.exe (PID: 6292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:14 06:30:17+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.4
CodeSize: 105984
InitializedDataSize: 1149952
UninitializedDataSize: -
EntryPoint: 0x6f17
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.361.151
ProductVersionNumber: 1.3.361.151
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: BraveSoftware Inc.
FileDescription: BraveSoftware Update Setup
FileVersion: 1.3.361.151
InternalName: BraveSoftware Update Setup
OriginalFileName: BraveUpdateSetup.exe
ProductName: BraveSoftware Update
ProductVersion: 1.3.361.151
LanguageId: en
PrivateBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
12
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start bravebrowsersetup-brv029.exe braveupdate.exe no specs braveupdatesetup.exe braveupdate.exe braveupdate.exe no specs braveupdate.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdate.exe braveupdate.exe no specs braveupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
6264"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5OTA2ODdGNi1CNTQyLTRDQjgtODMwMi0xNDBBQTNFMzU0NzN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MzNFOTlCMDktRjc5My00MjBGLThEMTUtM0Q2OEIyMEI0RkRDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI0IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE1MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjk3Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6292"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svcC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
services.exe
User:
SYSTEM
Company:
BraveSoftware Inc.
Integrity Level:
SYSTEM
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6360"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{990687F6-B542-4CB8-8302-140AA3E35473}"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6488"C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe" C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe
explorer.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
MEDIUM
Description:
BraveSoftware Update Setup
Version:
1.3.361.151
Modules
Images
c:\users\admin\desktop\bravebrowsersetup-brv029.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6528C:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"C:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdate.exe—BraveBrowserSetup-BRV029.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
MEDIUM
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\users\admin\appdata\local\temp\gum64b1.tmp\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6624"C:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateSetup.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateSetup.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update Setup
Version:
1.3.361.151
Modules
Images
c:\users\admin\appdata\local\temp\gum64b1.tmp\braveupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6744C:\WINDOWS\SystemTemp\GUM6B59.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installelevatedC:\Windows\SystemTemp\GUM6B59.tmp\BraveUpdate.exe
BraveUpdateSetup.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Version:
1.3.361.151
Modules
Images
c:\windows\systemtemp\gum6b59.tmp\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7000"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvcC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7044"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserverC:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7084"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe" C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\1.3.361.151\braveupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
17 839
Read events
13 659
Write events
4 115
Delete events
65

Modification events

(PID) Process:(6488) BraveBrowserSetup-BRV029.exeKey:HKEY_CURRENT_USER\SOFTWARE\BraveSoftware\Promo
Operation:writeName:StubInstallerPath
Value:
C:\Users\admin\Desktop\BraveBrowserSetup-BRV029.exe
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:path
Value:
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:UninstallCmdLine
Value:
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:pv
Value:
1.3.361.151
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:name
Value:
Brave Update
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update\ClientState\{B131C935-9BE6-41DA-9599-1F776BEB8019}
Operation:writeName:pv
Value:
1.3.361.151
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:brave_task_name_c
Value:
BraveSoftwareUpdateTaskMachineCore{5287C494-8F7A-4058-BEEE-D18B1178B0F7}
(PID) Process:(6744) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:writeName:brave_task_name_ua
Value:
BraveSoftwareUpdateTaskMachineUA{9B755D61-FCF2-4BA1-A818-AED50BE27279}
(PID) Process:(7000) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BraveSoftware\Update
Operation:delete valueName:uid
Value:
Executable files
216
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\psmachine.dllexecutable
MD5:C5827FB8D1D300AA27F17DD59112B526
SHA256:4531C5123AB858BFD02A69FD460CF146AE3135663EABCD35C9EADDA94BE5D7DC
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateBroker.exeexecutable
MD5:CF292A100BE1AAA41C322AC61D82B6BF
SHA256:A63630FBED9C9163FD0A25228A6E02899387C2AFD18901A52E30927317183057
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdate.exeexecutable
MD5:C3F94FFB3CC284CEDD759ACC3AEFBDFC
SHA256:F93308DD11366055F1379C19230A7BD89D795D3810ED3B10017F3CA49D0749EF
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateOnDemand.exeexecutable
MD5:7F6200A8583D02A2D8D0C814F992A6D8
SHA256:85C92E1F393137FED880E28353B0CEF03D92140EB87BC128FA5E15520A56F742
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveCrashHandler.exeexecutable
MD5:81ADB79FCB7B0ABA09205C39D127ECE1
SHA256:75CE17927E955E86CBC628E4E8C72386B1B22A106CA3573E97FAFB0D774D19B6
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\goopdate.dllexecutable
MD5:9C52E4366ACE494E672E9720735CED38
SHA256:BE42E01984B9DC67FF12832DEEE68F0418F9B9AC6B6FA69747460888D2410911
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\goopdateres_bg.dllexecutable
MD5:D5D81895E5DF72FDF7742BAAD25E9F05
SHA256:628B1D8E204975BA68F81F9153E31D7E61710CA282BAC79649BC78B0687E6F85
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateCore.exeexecutable
MD5:E7C0BC4A9E531E115EF94315A22EA400
SHA256:5846B62D4E224DDD4554486D869C32F0EC120244A1289B6257A9D280FF8B6E1E
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\psuser_arm64.dllexecutable
MD5:0657BC0B4FEBCF996509B64F3C1BEA5F
SHA256:99391CBF8AFB415C4DE85DAAC91A6BF8B0190E69408707E2DC7F573ED62BEA47
6488BraveBrowserSetup-BRV029.exeC:\Users\admin\AppData\Local\Temp\GUM64B1.tmp\BraveUpdateComRegisterShellArm64.exeexecutable
MD5:C46A4A1C72BE52750F2BF796108D0CDE
SHA256:B7E9AB8956E5F2BC59AB7A6FF4D7B5F35B2A1C0813BD6E19B23BE45DD0938634
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
3.161.82.75:443
https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/127.1.68.141/x64/brave_installer-x64.exe
unknown
—
—
—
—
—
POST
200
13.32.121.6:443
https://updates.bravesoftware.com/service/update2
unknown
xml
250 b
—
—
—
GET
200
3.161.82.36:443
https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/127.1.68.141/x64/brave_installer-x64.exe
unknown
executable
117 Mb
—
—
—
POST
200
13.32.121.47:443
https://updates.bravesoftware.com/service/update2?cup2key=2:2XyXZqOTz-ZTDPshpMv9aI3P9DyX_S-VaERLnMR_DsM&cup2hreq=aecd10ca0613383a88bd142c7732e88023eb1b066f6919d98b620cc021ad0e84
unknown
xml
6.59 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4084
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6264
BraveUpdate.exe
13.32.121.47:443
updates.bravesoftware.com
AMAZON-02
US
unknown
6292
BraveUpdate.exe
13.32.121.47:443
updates.bravesoftware.com
AMAZON-02
US
unknown
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6792
svchost.exe
3.161.82.36:443
updates-cdn.bravesoftware.com
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.46
whitelisted
updates.bravesoftware.com
  • 13.32.121.47
  • 13.32.121.70
  • 13.32.121.124
  • 13.32.121.6
shared
dl.brave.com
  • —
whitelisted
updates-cdn.bravesoftware.com
  • 3.161.82.36
  • 3.161.82.8
  • 3.161.82.23
  • 3.161.82.75
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BraveBrowserSetup-BRV029.exe