URL:

https://brave.com/download-beta/

Full analysis: https://app.any.run/tasks/662d333d-d45b-4773-a620-b4e0f2349c47
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 25, 2026, 21:16:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
qrcode
stealer
loader
crypto-regex
Indicators:
MD5:

8CA92929DEEE03EE9B461A2630A7F48F

SHA1:

80A6D138059C4486B4CF760ACAEEE5E7D80333BF

SHA256:

74314D982A86845A8C100B1E43F73BC1FB64BB193E26BF5D81DBABDAD8908C71

SSDEEP:

3:N8a1aKJH0j:2M+j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • setup.exe (PID: 8676)

    • Actions looks like stealing of personal data

      • brave.exe (PID: 4128)

    • Steals credentials from Web Browsers

      • brave.exe (PID: 4128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)
      • brave_installer-x64.exe (PID: 7976)
      • setup.exe (PID: 8676)

    • Disables SEHOP

      • BraveUpdate.exe (PID: 6904)

    • Starts itself from another location

      • BraveUpdate.exe (PID: 6904)

    • Creates/Modifies COM task schedule object

      • BraveUpdateComRegisterShell64.exe (PID: 7308)
      • BraveUpdate.exe (PID: 4708)
      • BraveUpdateComRegisterShell64.exe (PID: 1084)
      • BraveUpdateComRegisterShell64.exe (PID: 7544)

    • Executes as Windows Service

      • BraveUpdate.exe (PID: 6516)
      • elevation_service.exe (PID: 8780)
      • elevation_service.exe (PID: 2868)
      • elevation_service.exe (PID: 4756)
      • elevation_service.exe (PID: 1768)

    • Application launched itself

      • setup.exe (PID: 8676)
      • setup.exe (PID: 7916)
      • brave.exe (PID: 4128)
      • BraveUpdate.exe (PID: 6516)
      • chrmstp.exe (PID: 6020)
      • chrmstp.exe (PID: 8720)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 7944)
      • brave.exe (PID: 5440)

    • Searches for installed software

      • setup.exe (PID: 8676)
      • setup.exe (PID: 7916)
      • chrmstp.exe (PID: 6020)
      • chrmstp.exe (PID: 8720)

    • Possible stealing from browsers

      • brave.exe (PID: 4128)

    • Reads Mozilla Firefox installation path

      • brave.exe (PID: 4128)

    • Reads the date of Windows installation

      • chrmstp.exe (PID: 8720)

    • Potential Corporate Privacy Violation

      • brave.exe (PID: 7320)

    • Starts application with an unusual extension

      • brave.exe (PID: 4952)
      • brave.exe (PID: 2788)
      • brave.exe (PID: 8428)

    • Found regular expressions for crypto-addresses (YARA)

      • brave.exe (PID: 4128)

  • INFO

    • The sample compiled with english language support

      • chrome.exe (PID: 6796)
      • chrome.exe (PID: 9092)
      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)
      • brave_installer-x64.exe (PID: 7976)
      • setup.exe (PID: 8676)

    • Drops script file

      • chrome.exe (PID: 9092)
      • brave.exe (PID: 4128)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)

    • Launching a file from the Downloads directory

      • chrome.exe (PID: 9092)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6796)
      • chrome.exe (PID: 9092)

    • Application launched itself

      • chrome.exe (PID: 9092)

    • The sample compiled with russian language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with swedish language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with Italian language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with arabic language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with bulgarian language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • Create files in a temporary directory

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • svchost.exe (PID: 4948)
      • brave.exe (PID: 4128)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)

    • The sample compiled with french language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with Indonesian language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with german language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with czech language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with japanese language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with polish language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with portuguese language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with korean language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with slovak language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • Checks supported languages

      • BraveUpdate.exe (PID: 8264)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdate.exe (PID: 7812)
      • BraveUpdate.exe (PID: 4708)
      • BraveUpdateComRegisterShell64.exe (PID: 7308)
      • BraveUpdateComRegisterShell64.exe (PID: 7544)
      • BraveUpdateComRegisterShell64.exe (PID: 1084)
      • BraveUpdate.exe (PID: 1352)
      • BraveUpdate.exe (PID: 1324)
      • BraveUpdate.exe (PID: 6516)
      • brave_installer-x64.exe (PID: 7976)
      • setup.exe (PID: 8676)
      • setup.exe (PID: 1316)
      • setup.exe (PID: 5612)
      • BraveUpdate.exe (PID: 8320)
      • setup.exe (PID: 7916)
      • BraveUpdate.exe (PID: 7620)
      • brave.exe (PID: 4128)
      • brave.exe (PID: 1344)
      • brave.exe (PID: 7320)
      • brave.exe (PID: 6320)
      • BraveUpdateOnDemand.exe (PID: 5828)
      • brave.exe (PID: 7844)
      • brave.exe (PID: 7020)
      • brave.exe (PID: 7820)
      • elevation_service.exe (PID: 8780)
      • brave.exe (PID: 5608)
      • brave.exe (PID: 2248)
      • brave.exe (PID: 6432)
      • brave.exe (PID: 5536)
      • brave.exe (PID: 6796)
      • brave.exe (PID: 7360)
      • brave.exe (PID: 7372)
      • brave.exe (PID: 6284)
      • brave.exe (PID: 8132)
      • brave.exe (PID: 4280)
      • brave.exe (PID: 9048)
      • chrmstp.exe (PID: 9112)
      • chrmstp.exe (PID: 8720)
      • chrmstp.exe (PID: 7828)
      • brave.exe (PID: 2372)
      • brave.exe (PID: 8112)
      • brave.exe (PID: 6708)
      • chrmstp.exe (PID: 6020)
      • brave.exe (PID: 8980)
      • brave.exe (PID: 1676)
      • brave.exe (PID: 6108)
      • brave.exe (PID: 3096)
      • brave.exe (PID: 2608)
      • brave.exe (PID: 7076)
      • brave.exe (PID: 6908)
      • brave.exe (PID: 2448)
      • brave.exe (PID: 2872)
      • brave.exe (PID: 7492)
      • brave.exe (PID: 8332)
      • brave.exe (PID: 4952)
      • brave.exe (PID: 8564)
      • tor-0.4.8.22-win32-brave-0 (PID: 1908)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 6336)
      • brave.exe (PID: 7104)
      • brave.exe (PID: 6784)
      • brave.exe (PID: 2564)
      • elevation_service.exe (PID: 2868)
      • brave.exe (PID: 7360)
      • brave.exe (PID: 3636)
      • brave.exe (PID: 6208)
      • brave.exe (PID: 3164)
      • brave.exe (PID: 6848)
      • brave.exe (PID: 2372)
      • brave.exe (PID: 3980)
      • brave.exe (PID: 2788)
      • tor-0.4.8.22-win32-brave-0 (PID: 8788)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 7700)
      • brave.exe (PID: 7712)
      • elevation_service.exe (PID: 4756)
      • brave.exe (PID: 8748)
      • brave.exe (PID: 6804)
      • brave.exe (PID: 4800)
      • brave.exe (PID: 8700)
      • brave.exe (PID: 6376)
      • brave.exe (PID: 1084)
      • brave.exe (PID: 3624)
      • brave.exe (PID: 8012)
      • brave.exe (PID: 4992)
      • brave.exe (PID: 8428)
      • tor-0.4.8.22-win32-brave-0 (PID: 3036)
      • brave.exe (PID: 1836)
      • brave.exe (PID: 8732)
      • brave.exe (PID: 4300)
      • brave.exe (PID: 5440)
      • brave.exe (PID: 2496)
      • brave.exe (PID: 7944)
      • elevation_service.exe (PID: 1768)
      • brave.exe (PID: 2360)
      • brave.exe (PID: 5660)
      • brave.exe (PID: 3352)
      • brave.exe (PID: 4936)
      • brave.exe (PID: 7612)
      • brave.exe (PID: 7272)
      • brave.exe (PID: 6852)

    • Reads the computer name

      • BraveUpdate.exe (PID: 8264)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdate.exe (PID: 4708)
      • BraveUpdateComRegisterShell64.exe (PID: 7308)
      • BraveUpdateComRegisterShell64.exe (PID: 1084)
      • BraveUpdateComRegisterShell64.exe (PID: 7544)
      • BraveUpdate.exe (PID: 1352)
      • BraveUpdate.exe (PID: 7812)
      • BraveUpdate.exe (PID: 1324)
      • BraveUpdate.exe (PID: 6516)
      • brave_installer-x64.exe (PID: 7976)
      • setup.exe (PID: 8676)
      • setup.exe (PID: 7916)
      • BraveUpdate.exe (PID: 7620)
      • brave.exe (PID: 4128)
      • BraveUpdate.exe (PID: 8320)
      • brave.exe (PID: 7320)
      • elevation_service.exe (PID: 8780)
      • brave.exe (PID: 6320)
      • chrmstp.exe (PID: 6020)
      • chrmstp.exe (PID: 8720)
      • brave.exe (PID: 5608)
      • tor-0.4.8.22-win32-brave-0 (PID: 1908)
      • brave.exe (PID: 8168)
      • elevation_service.exe (PID: 2868)
      • brave.exe (PID: 2564)
      • brave.exe (PID: 7104)
      • brave.exe (PID: 2372)
      • tor-0.4.8.22-win32-brave-0 (PID: 8788)
      • brave.exe (PID: 1576)
      • elevation_service.exe (PID: 4756)
      • brave.exe (PID: 7712)
      • brave.exe (PID: 6376)
      • brave.exe (PID: 4992)
      • tor-0.4.8.22-win32-brave-0 (PID: 3036)
      • elevation_service.exe (PID: 1768)
      • brave.exe (PID: 5440)
      • brave.exe (PID: 7944)
      • brave.exe (PID: 4936)
      • brave.exe (PID: 4300)
      • brave.exe (PID: 8732)

    • Brave updater related mutex has been found

      • BraveUpdate.exe (PID: 8264)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdate.exe (PID: 7812)
      • BraveUpdate.exe (PID: 4708)
      • BraveUpdate.exe (PID: 1352)
      • BraveUpdate.exe (PID: 1324)
      • BraveUpdate.exe (PID: 6516)
      • BraveUpdate.exe (PID: 8320)
      • BraveUpdate.exe (PID: 7620)

    • Reads security settings of Internet Explorer

      • BraveUpdate.exe (PID: 8264)
      • BraveUpdate.exe (PID: 6904)
      • BraveUpdate.exe (PID: 1324)
      • brave.exe (PID: 4128)
      • chrmstp.exe (PID: 8720)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)

    • Process checks computer location settings

      • BraveUpdate.exe (PID: 8264)
      • BraveUpdate.exe (PID: 6904)
      • brave.exe (PID: 7020)
      • brave.exe (PID: 7844)
      • brave.exe (PID: 4128)
      • brave.exe (PID: 2608)
      • brave.exe (PID: 7076)
      • brave.exe (PID: 6908)
      • brave.exe (PID: 2448)
      • brave.exe (PID: 2872)
      • brave.exe (PID: 7492)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 3636)
      • brave.exe (PID: 6208)
      • brave.exe (PID: 7360)
      • brave.exe (PID: 3980)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 6848)
      • brave.exe (PID: 3164)
      • brave.exe (PID: 6804)
      • brave.exe (PID: 4800)
      • brave.exe (PID: 8700)
      • brave.exe (PID: 3624)
      • brave.exe (PID: 1084)
      • brave.exe (PID: 8012)
      • brave.exe (PID: 5440)
      • brave.exe (PID: 2360)
      • brave.exe (PID: 3352)
      • brave.exe (PID: 5660)
      • brave.exe (PID: 7272)
      • brave.exe (PID: 7612)
      • brave.exe (PID: 6852)

    • The sample compiled with turkish language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • The sample compiled with chinese language support

      • BraveBrowserBetaSetup.exe (PID: 8972)
      • BraveUpdateSetup.exe (PID: 7280)
      • BraveUpdate.exe (PID: 6904)

    • Creates files in the program directory

      • BraveUpdate.exe (PID: 6904)
      • BraveUpdate.exe (PID: 6516)
      • brave_installer-x64.exe (PID: 7976)
      • setup.exe (PID: 8676)
      • setup.exe (PID: 7916)

    • Checks proxy server information

      • BraveUpdate.exe (PID: 1352)
      • BraveUpdate.exe (PID: 1324)
      • brave.exe (PID: 4128)
      • slui.exe (PID: 6936)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)

    • Reads the machine GUID from the registry

      • BraveUpdate.exe (PID: 1324)
      • brave.exe (PID: 4128)
      • tor-0.4.8.22-win32-brave-0 (PID: 1908)
      • brave.exe (PID: 8168)
      • tor-0.4.8.22-win32-brave-0 (PID: 8788)
      • brave.exe (PID: 1576)
      • tor-0.4.8.22-win32-brave-0 (PID: 3036)
      • brave.exe (PID: 5440)

    • Creates files or folders in the user directory

      • BraveUpdate.exe (PID: 1324)
      • setup.exe (PID: 7916)
      • brave.exe (PID: 4128)
      • brave.exe (PID: 7320)
      • chrmstp.exe (PID: 8720)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 6336)
      • tor-0.4.8.22-win32-brave-0 (PID: 1908)
      • brave.exe (PID: 7104)
      • tor-0.4.8.22-win32-brave-0 (PID: 8788)
      • brave.exe (PID: 7700)
      • brave.exe (PID: 1576)
      • tor-0.4.8.22-win32-brave-0 (PID: 3036)
      • brave.exe (PID: 6376)
      • brave.exe (PID: 7944)
      • brave.exe (PID: 5440)
      • brave.exe (PID: 8732)

    • There is functionality for taking screenshot (YARA)

      • BraveUpdate.exe (PID: 6904)
      • BraveUpdate.exe (PID: 8264)
      • BraveUpdate.exe (PID: 1324)
      • BraveUpdate.exe (PID: 6516)

    • Launching a file from a Registry key

      • setup.exe (PID: 8676)

    • Creates a software uninstall entry

      • setup.exe (PID: 8676)

    • Disables trace logs

      • brave.exe (PID: 4128)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)

    • Reads CPU info

      • brave.exe (PID: 4128)
      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)

    • Manual execution by a user

      • brave.exe (PID: 8168)
      • brave.exe (PID: 1576)
      • brave.exe (PID: 5440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
296
Monitored processes
140
Malicious processes
4
Suspicious processes
7

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bravebrowserbetasetup.exe braveupdate.exe no specs braveupdatesetup.exe braveupdate.exe braveupdate.exe no specs braveupdate.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdatecomregistershell64.exe no specs braveupdate.exe braveupdate.exe braveupdate.exe svchost.exe brave_installer-x64.exe slui.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs braveupdate.exe braveupdateondemand.exe no specs braveupdate.exe no specs brave.exe brave.exe brave.exe no specs brave.exe elevation_service.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs chrmstp.exe no specs brave.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs tor-0.4.8.22-win32-brave-0 conhost.exe no specs brave.exe brave.exe no specs brave.exe no specs brave.exe elevation_service.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs tor-0.4.8.22-win32-brave-0 conhost.exe no specs brave.exe brave.exe no specs brave.exe no specs brave.exe elevation_service.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs tor-0.4.8.22-win32-brave-0 conhost.exe no specs brave.exe brave.exe no specs brave.exe no specs brave.exe no specs brave.exe elevation_service.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1980,i,13723437210179196227,5238072312207054235,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=1976 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1084"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe" C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\1.3.361.151\braveupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1084"C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe" --type=renderer --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5716,i,11786931548937423639,14005678426797784130,2097152 --field-trial-handle=1456,i,856343350726361618,7012812204543565488,262144 --variations-seed-version=main@8e7212b3cd2e55b70a8f5af6f276598f46d04922 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5720 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
145.1.88.115
Modules
Images
c:\program files\bravesoftware\brave-browser-beta\application\brave.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser-beta\application\145.1.88.115\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1316"C:\Program Files (x86)\BraveSoftware\Update\Install\{A0F67CF5-7EE0-4AD1-A669-07616B14D8AB}\CR_7AAD9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=channel=beta --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=145.1.88.115 --attachment=C:\WINDOWS\SystemTemp\chromium_installer.log --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff683ecd6e8,0x7ff683ecd6f4,0x7ff683ecd700C:\Program Files (x86)\BraveSoftware\Update\Install\{A0F67CF5-7EE0-4AD1-A669-07616B14D8AB}\CR_7AAD9.tmp\setup.exe—setup.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
HIGH
Description:
Brave Installer
Exit code:
0
Version:
145.1.88.115
Modules
Images
c:\program files (x86)\bravesoftware\update\install\{a0f67cf5-7ee0-4ad1-a669-07616b14d8ab}\cr_7aad9.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1324"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={103BD053-949B-43A8-9120-2E424887DE11}&appname=Brave-Browser-Beta&needsadmin=prefers&ap=beta&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{2C8C9970-95C1-4CED-AC2D-C6A67183AE75}"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1344"C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\BraveSoftware\Brave-Browser-Beta\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\BraveSoftware\Brave-Browser-Beta\User Data\Crashpad" --url=https://cr.brave.com --annotation=channel=beta --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=145.1.88.115 --initial-client-data=0x13c,0x140,0x144,0x10c,0x148,0x7ffd71043128,0x7ffd71043134,0x7ffd71043140C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe
brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
MEDIUM
Description:
Brave Browser
Exit code:
1
Version:
145.1.88.115
Modules
Images
c:\program files\bravesoftware\brave-browser-beta\application\brave.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser-beta\application\145.1.88.115\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
1352"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsyQzhDOTk3MC05NUMxLTRDRUQtQUMyRC1DNkE2NzE4M0FFNzV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkE1NjY0QzMtNEVDOS00RjQ3LUIzQjMtOTFGNjYyMTQzMzdCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE1MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI2MjYiLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.361.151
Modules
Images
c:\program files (x86)\bravesoftware\update\braveupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1432"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5588,i,13723437210179196227,5238072312207054235,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5840 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5604,i,13723437210179196227,5238072312207054235,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5832 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1576"C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe" C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe
explorer.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
MEDIUM
Description:
Brave Browser
Exit code:
0
Version:
145.1.88.115
Modules
Images
c:\program files\bravesoftware\brave-browser-beta\application\brave.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser-beta\application\145.1.88.115\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
Total events
23 598
Read events
22 082
Write events
1 368
Delete events
148

Modification events

(PID) Process:(8972) BraveBrowserBetaSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BraveSoftware\Promo
Operation:writeName:StubInstallerPath
Value:
C:\Users\admin\Downloads\BraveBrowserBetaSetup.exe
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D1B9C89-4F34-425C-9C13-F3497C4F9B93}\InprocHandler32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF231279-4293-422F-9EC2-38869CAFDBC5}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(1084) BraveUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(1084) BraveUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}
Operation:delete keyName:(default)
Value:
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}
Operation:delete keyName:(default)
Value:
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(4708) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}
Operation:delete keyName:(default)
Value:
Executable files
244
Suspicious files
394
Text files
584
Unknown types
47

Dropped files

PID
Process
Filename
Type
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF1e5198.TMP —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1e5198.TMP —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1e5198.TMP —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1e51a8.TMP —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF1e51a8.TMP —
MD5:—
SHA256:—
9092chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
134
TCP/UDP connections
206
DNS requests
129
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
unknown
—
—
whitelisted
6796
chrome.exe
GET
200
216.58.206.78:80
http://clients2.google.com/time/1/current?cup2key=8:Jyrx2ImLVwohIls2PlXCeTggWR2EG--iMeoM5DSTiko&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
6796
chrome.exe
GET
200
3.171.214.97:443
https://brave.com/download-beta/
unknown
html
75.3 Kb
unknown
6796
chrome.exe
GET
200
216.58.206.74:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
unknown
binary
41 b
whitelisted
6796
chrome.exe
GET
200
142.251.143.99:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
unknown
compressed
87.7 Kb
whitelisted
6796
chrome.exe
GET
200
3.171.214.97:443
https://brave.com/static-assets/css/fonts-latin.min.e207b9357b68ec783b0e1f403686906eb346848ac6a311fca5bf053703866d3a.css
unknown
text
16.2 Kb
unknown
6796
chrome.exe
GET
200
3.171.214.97:443
https://brave.com/static-assets/css/main.min.5c2980fd142d20586cbf1041fe1348683559d0e59a92fdc4fd969ae6e8df29fc.css
unknown
text
398 Kb
unknown
6796
chrome.exe
POST
200
142.251.127.84:443
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
unknown
text
17 b
whitelisted
6796
chrome.exe
GET
200
3.171.214.97:443
https://brave.com/static-assets/js/ie-shims.js
unknown
text
1.64 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7564
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5780
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
2.16.204.146:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3412
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6796
chrome.exe
216.58.206.74:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted
6796
chrome.exe
216.58.206.78:80
clients2.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.44.10.123
  • 52.182.143.208
whitelisted
google.com
  • 172.217.20.142
whitelisted
www.bing.com
  • 2.16.204.146
  • 2.16.204.138
  • 2.16.204.137
  • 2.16.204.136
  • 2.16.204.149
  • 2.16.204.160
  • 2.16.204.135
  • 2.16.204.150
  • 2.16.204.147
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 162.159.142.9
  • 172.66.2.5
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
clients2.google.com
  • 216.58.206.78
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.206.74
  • 142.250.201.170
  • 172.217.16.170
  • 142.251.208.10
  • 142.251.141.106
  • 142.251.37.10
  • 142.251.140.170
  • 142.250.187.202
  • 172.217.168.74
  • 142.251.36.106
  • 142.251.141.138
  • 142.251.127.95
  • 142.250.201.74
  • 172.217.16.202
  • 142.251.141.74
whitelisted
clientservices.googleapis.com
  • 142.251.143.99
whitelisted
brave.com
  • 3.171.214.97
  • 3.171.214.16
  • 3.171.214.88
  • 3.171.214.36
whitelisted

Threats

PID
Process
Class
Message
6796
chrome.exe
Potentially Bad Traffic
ET INFO PE EXE or DLL Windows file download HTTP
6796
chrome.exe
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
6796
chrome.exe
Misc activity
ET INFO Packed Executable Download
6796
chrome.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
4948
svchost.exe
Potentially Bad Traffic
ET INFO PE EXE or DLL Windows file download HTTP
4948
svchost.exe
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
4948
svchost.exe
Misc activity
ET INFO Packed Executable Download
7320
brave.exe
Misc activity
INFO [ANY.RUN] Cloudflare DNS-over-HTTPS service requested (cloudflare-dns .com)
7320
brave.exe
Misc activity
ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)
7320
brave.exe
Potential Corporate Privacy Violation
ET INFO bridges.torproject.org over TLS with SNI
Process
Message
brave.exe
[0225/161738.084:ERROR:third_party\crashpad\crashpad\client\crash_report_database_win.cc:613] CreateDirectory C:\Users\admin\AppData\Local\BraveSoftware\Brave-Browser-Beta\User Data\Crashpad: The system cannot find the path specified. (0x3)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://brave.com/download-beta/