File name:

BraveBrowserSetup32.exe

Full analysis: https://app.any.run/tasks/6733daad-ac65-4efd-9696-7f6565989f9b
Verdict: Malicious activity
Analysis date: June 20, 2019, 18:40:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3217D7DF8CE40E7C0B35E427FEBA5E33

SHA1:

0A6033D1BC550647815B70CD62A5D290E6693474

SHA256:

AEAA885D817E094F7EC31ED26D892E7F0C28058BB20B00F058923ECC6E3DE6B3

SSDEEP:

24576:TZQH8ziQ7TsF6hPqCdMkX3uDpAn9OAum9vmMA15Ye2f6evmvhnDgr6E12GKMV4:FQHW7TsF6hxdzOteEKt+H4CKYWX11Ki4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BraveUpdate.exe (PID: 3540)
      • BraveUpdate.exe (PID: 2904)
      • BraveUpdate.exe (PID: 1920)
      • BraveUpdate.exe (PID: 3524)
      • BraveUpdate.exe (PID: 2924)
      • BraveUpdate.exe (PID: 1064)
      • BraveUpdate.exe (PID: 3372)
      • setup.exe (PID: 3712)
      • setup.exe (PID: 3836)
      • BraveUpdate.exe (PID: 2896)
      • BraveUpdateOnDemand.exe (PID: 2528)
      • brave.exe (PID: 2468)
      • brave.exe (PID: 920)
      • brave.exe (PID: 3064)
      • brave.exe (PID: 3132)
      • brave.exe (PID: 2452)
      • brave.exe (PID: 2612)
      • brave.exe (PID: 3176)
      • BraveUpdate.exe (PID: 1896)
      • brave.exe (PID: 2176)
      • brave.exe (PID: 796)
      • brave.exe (PID: 3724)
      • brave.exe (PID: 2692)
      • brave.exe (PID: 1568)
      • chrmstp.exe (PID: 2852)
      • chrmstp.exe (PID: 800)
      • brave.exe (PID: 2084)
      • brave.exe (PID: 3864)
      • brave.exe (PID: 3660)
      • brave.exe (PID: 3716)
      • brave.exe (PID: 3848)
      • brave.exe (PID: 312)
      • brave.exe (PID: 3916)
      • brave.exe (PID: 2668)
      • brave.exe (PID: 1156)
      • brave.exe (PID: 3180)
      • brave.exe (PID: 2504)
      • brave.exe (PID: 1660)
      • brave.exe (PID: 3376)
      • brave.exe (PID: 4072)
      • brave.exe (PID: 2224)
      • brave.exe (PID: 2744)
      • brave.exe (PID: 3520)
      • brave.exe (PID: 1000)
      • brave.exe (PID: 3496)
      • brave.exe (PID: 2196)
      • brave.exe (PID: 3476)
      • brave.exe (PID: 2216)
      • brave.exe (PID: 3408)
      • brave.exe (PID: 2308)
      • brave.exe (PID: 1812)
      • brave.exe (PID: 1332)
      • brave.exe (PID: 3204)
      • brave.exe (PID: 2116)
      • brave.exe (PID: 2824)
      • brave.exe (PID: 3092)
      • brave.exe (PID: 4484)
      • brave.exe (PID: 4784)
      • brave.exe (PID: 4336)
      • brave.exe (PID: 5596)
      • brave.exe (PID: 4604)
      • brave.exe (PID: 3556)
      • brave.exe (PID: 4780)
      • brave.exe (PID: 4704)
      • brave.exe (PID: 5860)
      • brave.exe (PID: 5024)
      • brave.exe (PID: 5096)
      • brave.exe (PID: 6132)
      • brave.exe (PID: 5580)

    • Loads dropped or rewritten executable

      • BraveUpdate.exe (PID: 3540)
      • BraveUpdate.exe (PID: 2904)
      • BraveUpdate.exe (PID: 1920)
      • BraveUpdate.exe (PID: 3524)
      • BraveUpdate.exe (PID: 2924)
      • BraveUpdate.exe (PID: 1064)
      • BraveUpdate.exe (PID: 3372)
      • brave.exe (PID: 3064)
      • svchost.exe (PID: 680)
      • brave.exe (PID: 920)
      • brave.exe (PID: 3132)
      • brave.exe (PID: 2612)
      • brave.exe (PID: 2452)
      • BraveUpdate.exe (PID: 2896)
      • BraveUpdate.exe (PID: 1896)
      • brave.exe (PID: 2468)
      • brave.exe (PID: 2176)
      • brave.exe (PID: 2084)
      • brave.exe (PID: 3864)
      • brave.exe (PID: 796)
      • brave.exe (PID: 3724)
      • brave.exe (PID: 2692)
      • brave.exe (PID: 1568)
      • brave.exe (PID: 3176)
      • brave.exe (PID: 2504)
      • brave.exe (PID: 1660)
      • brave.exe (PID: 3660)
      • brave.exe (PID: 3376)
      • brave.exe (PID: 3716)
      • brave.exe (PID: 3848)
      • brave.exe (PID: 3916)
      • brave.exe (PID: 312)
      • brave.exe (PID: 1156)
      • brave.exe (PID: 2668)
      • brave.exe (PID: 3180)
      • brave.exe (PID: 2224)
      • brave.exe (PID: 2196)
      • brave.exe (PID: 4072)
      • brave.exe (PID: 2216)
      • brave.exe (PID: 3476)
      • brave.exe (PID: 3520)
      • brave.exe (PID: 3092)
      • brave.exe (PID: 2744)
      • brave.exe (PID: 1000)
      • brave.exe (PID: 3408)
      • brave.exe (PID: 4784)
      • brave.exe (PID: 4484)
      • brave.exe (PID: 4336)
      • brave.exe (PID: 4604)
      • brave.exe (PID: 3496)
      • brave.exe (PID: 5596)
      • brave.exe (PID: 3556)
      • brave.exe (PID: 4704)
      • brave.exe (PID: 4780)
      • brave.exe (PID: 5024)
      • brave.exe (PID: 5860)
      • brave.exe (PID: 6132)
      • brave.exe (PID: 5096)
      • brave.exe (PID: 5580)

    • Loads the Task Scheduler COM API

      • BraveUpdate.exe (PID: 2904)

    • Changes settings of System certificates

      • BraveUpdate.exe (PID: 2924)

    • Changes the autorun value in the registry

      • setup.exe (PID: 3712)

  • SUSPICIOUS

    • Creates files in the program directory

      • BraveUpdateSetup.exe (PID: 3156)
      • BraveUpdate.exe (PID: 2904)
      • BraveUpdate.exe (PID: 3372)
      • setup.exe (PID: 3712)

    • Executable content was dropped or overwritten

      • BraveBrowserSetup32.exe (PID: 2848)
      • BraveUpdate.exe (PID: 2904)
      • BraveUpdateSetup.exe (PID: 3156)
      • setup.exe (PID: 3712)
      • brave_installer-ia32.exe (PID: 2408)

    • Disables SEHOP

      • BraveUpdate.exe (PID: 2904)

    • Starts itself from another location

      • BraveUpdate.exe (PID: 2904)

    • Creates COM task schedule object

      • BraveUpdate.exe (PID: 3524)
      • BraveUpdate.exe (PID: 2904)

    • Executed as Windows Service

      • BraveUpdate.exe (PID: 3372)
      • WmiApSrv.exe (PID: 2584)
      • WmiApSrv.exe (PID: 1796)

    • Adds / modifies Windows certificates

      • BraveUpdate.exe (PID: 2924)

    • Creates a software uninstall entry

      • setup.exe (PID: 3712)

    • Application launched itself

      • setup.exe (PID: 3712)
      • brave.exe (PID: 2468)
      • BraveUpdate.exe (PID: 3372)
      • chrmstp.exe (PID: 800)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 3712)

    • Creates files in the user directory

      • setup.exe (PID: 3712)

    • Executed via COM

      • BraveUpdateOnDemand.exe (PID: 2528)

    • Starts application with an unusual extension

      • brave.exe (PID: 1660)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • setup.exe (PID: 3712)
      • tor-0.3.5.8-win32-brave-0 (PID: 2488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:06:19 19:15:31+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 183808
InitializedDataSize: 1099776
UninitializedDataSize: -
EntryPoint: 0x18886
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.99.0
ProductVersionNumber: 1.3.99.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: BraveSoftware Inc.
FileDescription: BraveSoftware Update Setup
FileVersion: 1.3.99.0
InternalName: BraveSoftware Update Setup
OriginalFileName: BraveUpdateSetup.exe
ProductName: BraveSoftware Update
ProductVersion: 1.3.99.0
LanguageId: en
PrivateBuild: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-2019 17:15:31
Detected languages:
  • Arabic - Saudi Arabia
  • Bulgarian - Bulgaria
  • Catalan - Spain
  • Chinese - PRC
  • Chinese - Taiwan
  • Croatian - Croatia
  • Czech - Czech Republic
  • Danish - Denmark
  • Dutch - Netherlands
  • English - United Kingdom
  • English - United States
  • Estonian - Estonia
  • Farsi - Iran
  • Finnish - Finland
  • French - France
  • German - Germany
  • Greek - Greece
  • Gujarati - India
  • Hebrew - Israel
  • Hindi - India
  • Hungarian - Hungary
  • Icelandic - Iceland
  • Indonesian - Indonesia (Bahasa)
  • Italian - Italy
  • Japanese - Japan
  • Kannada - India (Kannada script)
  • Korean - Korea
  • Latvian - Latvia
  • Lithuanian - Lithuania
  • Malay - Malaysia
  • Marathi - India
  • Norwegian - Norway (Bokmal)
  • Polish - Poland
  • Portuguese - Brazil
  • Portuguese - Portugal
  • Romanian - Romania
  • Russian - Russia
  • Serbian - Serbia (Cyrillic)
  • Slovak - Slovakia
  • Slovenian - Slovenia
  • Spanish - Mexico
  • Spanish - Spain (International sort)
  • Swahili - Kenya
  • Swedish - Sweden
  • Tamil - India
  • Telugu - India (Telugu script)
  • Thai - Thailand
  • Turkish - Turkey
  • Ukrainian - Ukraine
  • Urdu - Pakistan
  • Vietnamese - Viet Nam
Debug artifacts:
  • mi_exe_stub.pdb
CompanyName: BraveSoftware Inc.
FileDescription: BraveSoftware Update Setup
FileVersion: 1.3.99.0
InternalName: BraveSoftware Update Setup
OriginalFilename: BraveUpdateSetup.exe
ProductName: BraveSoftware Update
ProductVersion: 1.3.99.0
LanguageId: en
PrivateBuild: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 19-Jun-2019 17:15:31
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002CCDF
0x0002CE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.66638
.rdata
0x0002E000
0x00011286
0x00011400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.55556
.data
0x00040000
0x00002910
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.56656
.gfids
0x00043000
0x00000140
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.65094
.rsrc
0x00044000
0x000F7AA0
0x000F7C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.98308
.reloc
0x0013C000
0x0000273C
0x00002800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.6132

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20417
1166
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
4.13669
1384
Latin 1 / Western European
English - United States
RT_ICON
3
3.91985
744
Latin 1 / Western European
English - United States
RT_ICON
4
4.83772
2216
Latin 1 / Western European
English - United States
RT_ICON
5
3.68656
1640
Latin 1 / Western European
English - United States
RT_ICON
6
4.50268
3752
Latin 1 / Western European
English - United States
RT_ICON
101
2.86669
90
Latin 1 / Western European
English - United States
RT_GROUP_ICON
102
7.99982
981523
Latin 1 / Western European
UNKNOWN
B
1321
3.67135
424
Latin 1 / Western European
Serbian - Serbia (Cyrillic)
RT_STRING

Imports

ADVAPI32.dll
CRYPT32.dll
IPHLPAPI.DLL
KERNEL32.dll
NETAPI32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
USERENV.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
76
Malicious processes
40
Suspicious processes
14

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start bravebrowsersetup32.exe braveupdate.exe no specs braveupdatesetup.exe braveupdate.exe braveupdate.exe no specs braveupdate.exe no specs braveupdate.exe braveupdate.exe no specs braveupdate.exe brave_installer-ia32.exe setup.exe setup.exe no specs braveupdateondemand.exe no specs braveupdate.exe no specs braveupdate.exe svchost.exe no specs brave.exe brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs wmiapsrv.exe no specs brave.exe no specs chrmstp.exe no specs chrmstp.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs tor-0.3.5.8-win32-brave-0 brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs wmiapsrv.exe no specs brave.exe no specs brave.exe no specs brave.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --disable-databases --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5982146819574582289 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
680C:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\secur32.dll
796"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=770690343087628081 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
800"C:\Program Files\BraveSoftware\Brave-Browser\Application\75.0.65.121\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settingsC:\Program Files\BraveSoftware\Brave-Browser\Application\75.0.65.121\Installer\chrmstp.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
MEDIUM
Description:
Brave Installer
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\installer\chrmstp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
920"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --gpu-preferences=KAAAAAAAAADgAAAwAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9514752488421935385 --mojo-platform-channel-handle=1004 --ignored=" --type=renderer " /prefetch:2C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1000"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11021510918607347506 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1064"C:\Program Files\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&lang=en&ap=x86-rel&referral=none" /installsource taggedmi /sessionid "{368B4B5B-7C76-4785-98CD-66B8142D905A}"C:\Program Files\BraveSoftware\Update\BraveUpdate.exe—BraveUpdate.exe
User:
admin
Company:
BraveSoftware Inc.
Integrity Level:
HIGH
Description:
BraveSoftware Update
Exit code:
0
Version:
1.3.99.0
Modules
Images
c:\program files\bravesoftware\update\braveupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1156"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4427461280125817147 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1332"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3534649846993535089 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
1568"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --field-trial-handle=988,10956556806417516093,3885643012816167036,131072 --enable-features=DesktopPWAWindowing,NewExtensionUpdaterService --disable-features=AudioServiceOutOfProcess,AutofillSaveCardSignInAfterLocalSave,AutofillServerCommunication,DefaultEnableOopRasterization,LookalikeUrlNavigationSuggestionsUI,NetworkService,TranslateUI,UnifiedConsent --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=42734276574644791 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe—brave.exe
User:
admin
Company:
Brave Software, Inc.
Integrity Level:
LOW
Description:
Brave Browser
Exit code:
0
Version:
75.0.65.121
Modules
Images
c:\program files\bravesoftware\brave-browser\application\brave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\bravesoftware\brave-browser\application\75.0.65.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
4 649
Read events
1 675
Write events
2 958
Delete events
16

Modification events

(PID) Process:(2848) BraveBrowserSetup32.exeKey:HKEY_CURRENT_USER\Software\BraveSoftware\Promo
Operation:writeName:StubInstallerPath
Value:
C:\Users\admin\AppData\Local\Temp\BraveBrowserSetup32.exe
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{08F15E98-0442-45D3-82F1-F67495CC51EB}
Operation:writeName:
Value:
ServiceModule
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BraveUpdate.exe
Operation:writeName:AppID
Value:
{08F15E98-0442-45D3-82F1-F67495CC51EB}
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{08F15E98-0442-45D3-82F1-F67495CC51EB}
Operation:writeName:LocalService
Value:
brave
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{08F15E98-0442-45D3-82F1-F67495CC51EB}
Operation:writeName:ServiceParameters
Value:
/comsvc
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService.1.0
Operation:writeName:
Value:
Update3COMClass
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService.1.0\CLSID
Operation:writeName:
Value:
{08F15E98-0442-45D3-82F1-F67495CC51EB}
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService
Operation:writeName:
Value:
Update3COMClass
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService\CLSID
Operation:writeName:
Value:
{08F15E98-0442-45D3-82F1-F67495CC51EB}
(PID) Process:(1920) BraveUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService\CurVer
Operation:writeName:
Value:
BraveSoftwareUpdate.Update3COMClassService.1.0
Executable files
229
Suspicious files
289
Text files
522
Unknown types
77

Dropped files

PID
Process
Filename
Type
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\goopdate.dllexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\npBraveUpdate3.dllexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveCrashHandler.exeexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveUpdateHelper.msiexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveUpdate.exeexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveUpdateBroker.exeexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\psmachine.dllexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveUpdateWebPlugin.exeexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveUpdateOnDemand.exeexecutable
MD5:—
SHA256:—
2848BraveBrowserSetup32.exeC:\Users\admin\AppData\Local\Temp\GUM47DE.tmp\BraveUpdateComRegisterShell64.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
100
DNS requests
51
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2468
brave.exe
GET
301
104.25.175.100:80
http://unocero.com/
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2848
BraveBrowserSetup32.exe
151.101.1.7:443
laptop-updates.brave.com
Fastly
US
suspicious
2468
brave.exe
151.101.2.217:443
brave-core-ext.s3.brave.com
Fastly
US
suspicious
2468
brave.exe
151.101.37.7:443
go-updater.brave.com
Fastly
US
unknown
1896
BraveUpdate.exe
151.101.2.2:443
updates.bravesoftware.com
Fastly
US
shared
2468
brave.exe
151.101.1.7:443
laptop-updates.brave.com
Fastly
US
suspicious
2468
brave.exe
104.28.22.242:443
static.brave.com
Cloudflare Inc
US
shared
2488
tor-0.3.5.8-win32-brave-0
46.165.230.5:443
—
Leaseweb Deutschland GmbH
DE
suspicious
2488
tor-0.3.5.8-win32-brave-0
62.210.83.207:8008
—
Online S.a.s.
FR
suspicious
2488
tor-0.3.5.8-win32-brave-0
62.210.254.132:443
—
Online S.a.s.
FR
suspicious
2924
BraveUpdate.exe
151.101.2.2:443
updates.bravesoftware.com
Fastly
US
shared

DNS requests

Domain
IP
Reputation
laptop-updates.brave.com
  • 151.101.1.7
  • 151.101.65.7
  • 151.101.129.7
  • 151.101.193.7
suspicious
updates.bravesoftware.com
  • 151.101.2.2
  • 151.101.66.2
  • 151.101.130.2
  • 151.101.194.2
shared
updates-cdn.bravesoftware.com
  • 151.101.2.2
  • 151.101.66.2
  • 151.101.130.2
  • 151.101.194.2
whitelisted
go-updater.brave.com
  • 151.101.37.7
suspicious
no-thanks.invalid
  • —
unknown
componentupdater.brave.com
  • 151.101.37.7
suspicious
brave-core-ext.s3.brave.com
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
crlsets.brave.com
  • 151.101.37.7
suspicious
static.brave.com
  • 104.28.22.242
  • 104.28.23.242
suspicious
static1.brave.com
  • 104.28.23.242
  • 104.28.22.242
malicious

Threats

PID
Process
Class
Message
2488
tor-0.3.5.8-win32-brave-0
Misc Attack
ET TOR Known Tor Exit Node Traffic group 68
2488
tor-0.3.5.8-win32-brave-0
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 68
2488
tor-0.3.5.8-win32-brave-0
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR TLS v.3 Connection (JA3)
2488
tor-0.3.5.8-win32-brave-0
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
2488
tor-0.3.5.8-win32-brave-0
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 541
2488
tor-0.3.5.8-win32-brave-0
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 542
2488
tor-0.3.5.8-win32-brave-0
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 175
2488
tor-0.3.5.8-win32-brave-0
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR TLS v.3 Connection (JA3)
2488
tor-0.3.5.8-win32-brave-0
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR TLS v.3 Connection (JA3)
2488
tor-0.3.5.8-win32-brave-0
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR TLS v.3 Connection (JA3)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BraveBrowserSetup32.exe