b8546f2662b5f95baf2f2fd25c3207c50403428bd73b71721bd8f02cfb65e6d6

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/03/2023, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BraveBrowserSetup (2).exe
Size

1.3MB
MD5

d7b3f0ba9013b54f0ee26f8e1363db6f
SHA1

4e2d0ef3b828c700c22862472ee5eaebb1e78161
SHA256

b8546f2662b5f95baf2f2fd25c3207c50403428bd73b71721bd8f02cfb65e6d6
SHA512

47a64d4919b1232a0c5c8e5af209836fb154aa2fe8fb7bad4b63cda03f7d837705cfc263a0d9ac10196a4bbe12df289127f79802039504f43070dc064de1a909
SSDEEP

24576:XahOv5YWCTmhb+i8XvfZX51YTjph3PvsomqtcbeWA8v10RvMgCUWA:KhOvPCTmhIRKHmucyW190RvtCUR

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe	BraveUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0"	BraveUpdate.exe

Executes dropped EXE 14 IoCs

pid	Process
1012	BraveUpdate.exe
1480	BraveUpdate.exe
1288	BraveUpdate.exe
652	BraveUpdateComRegisterShell64.exe
1472	BraveUpdateComRegisterShell64.exe
752	BraveUpdateComRegisterShell64.exe
1564	BraveUpdate.exe
240	BraveUpdate.exe
1544	BraveUpdate.exe
1580	brave_installer-x64.exe
1656	setup.exe
1860	setup.exe
1192	setup.exe
1052	setup.exe

Loads dropped DLL 52 IoCs

pid	Process
836	BraveBrowserSetup (2).exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1480	BraveUpdate.exe
1480	BraveUpdate.exe
1480	BraveUpdate.exe
1012	BraveUpdate.exe
1288	BraveUpdate.exe
1288	BraveUpdate.exe
1288	BraveUpdate.exe
652	BraveUpdateComRegisterShell64.exe
1288	BraveUpdate.exe
1288	BraveUpdate.exe
1472	BraveUpdateComRegisterShell64.exe
1288	BraveUpdate.exe
1288	BraveUpdate.exe
752	BraveUpdateComRegisterShell64.exe
1288	BraveUpdate.exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1564	BraveUpdate.exe
1012	BraveUpdate.exe
240	BraveUpdate.exe
240	BraveUpdate.exe
240	BraveUpdate.exe
1544	BraveUpdate.exe
1544	BraveUpdate.exe
1544	BraveUpdate.exe
1544	BraveUpdate.exe
240	BraveUpdate.exe
1544	BraveUpdate.exe
1580	brave_installer-x64.exe
1656	setup.exe
1656	setup.exe
1192	setup.exe
1192	setup.exe
1192	setup.exe
1192	setup.exe
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1656	setup.exe
1656	setup.exe
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found

Registers COM server for autorun 1 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ServerExecutable = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}\InProcServer32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\ml\messages.json	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\psuser.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\psmachine_arm64.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fa.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ms.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sv.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\el\messages.json	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\fi\messages.json	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateOnDemand.exe	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateCore.exe	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\psmachine.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\libEGL.dll	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\ru\messages.json	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_ko.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_lt.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_uk.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\nl.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\vi\messages.json	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_es-419.dll	BraveBrowserSetup (2).exe
File opened for modification	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateSetup.exe	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_ja.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\cs.pak	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandlerArm64.exe	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_tr.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\SETUP.EX_	brave_installer-x64.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\cs\messages.json	setup.exe
File opened for modification	C:\Program Files (x86)\BraveSoftware\Temp\GUTBA6.tmp	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_pt-BR.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\sl.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_vi.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\CHROME.PACKED.7Z	brave_installer-x64.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_th.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdate.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateOnDemand.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe	brave_installer-x64.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\ar.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\sk\messages.json	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_bn.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pt-BR.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateSetup.exe	BraveBrowserSetup (2).exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\da.pak	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sk.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\109.1.47.186.manifest	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\en-US.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\fi.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\id.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\ml.pak	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_ta.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\psuser_arm64.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\es_419\messages.json	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\psmachine_64.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_da.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\resources\brave_extension\_locales\nl\messages.json	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1656_386733759\Chrome-bin\109.1.47.186\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandler64.exe	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_am.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ro.dll	BraveBrowserSetup (2).exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_vi.dll	BraveUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods\ = "6"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\ = "BraveUpdate Update3Web"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}\ = "Google Update Legacy On Demand"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\NumMethods\ = "10"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\LocalServer32	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598BBE98-5919-4392-B62A-50D7115F10A3}\LocalServer32	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\ = "IPolicyStatusValue"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\BraveHTML	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc.1.0\CLSID\ = "{3A9D7221-2278-41DD-930B-C2356B7D3725}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ = "ICredentialDialog"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveHTML\shell\open\command\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ = "IPolicyStatus"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine.1.0\CLSID	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598BBE98-5919-4392-B62A-50D7115F10A3}\LocalServer32\ = "\"C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\BraveUpdateBroker.exe\""	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB}\ = "Update3COMClass"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ = "ICoCreateAsync"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\NumMethods\ = "5"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\VersionIndependentProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassMachineFallback"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7965C30-7D58-4D86-9E18-4794256409EE}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\NumMethods\ = "10"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\LocalServer32	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7965C30-7D58-4D86-9E18-4794256409EE}\1.0\0\win64\ = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\109.1.47.186\\elevation_service.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods\ = "10"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6836CFF-5949-44BC-B6BE-9C8C48DD8D97}\ = "ICurrentState"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachine\CLSID	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine\ = "Google Update Broker Class Factory"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C974F2DD-CFB8-4466-8E6D-96ED901DAACA}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CLSID	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine\CurVer	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\ProxyStubClsid32\ = "{89E5413A-07B5-40BD-B18E-3C1CBA8D5C6B}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\ProgID	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BraveUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BraveUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	BraveUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	BraveUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe
1012	BraveUpdate.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1012	BraveUpdate.exe
Token: SeDebugPrivilege	1012	BraveUpdate.exe
Token: SeDebugPrivilege	1012	BraveUpdate.exe
Token: SeDebugPrivilege	1012	BraveUpdate.exe
Token: 33	1580	brave_installer-x64.exe
Token: SeIncBasePriorityPrivilege	1580	brave_installer-x64.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 836 wrote to memory of 1012	836	BraveBrowserSetup (2).exe	28
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1480	1012	BraveUpdate.exe	29
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1012 wrote to memory of 1288	1012	BraveUpdate.exe	30
PID 1288 wrote to memory of 652	1288	BraveUpdate.exe	31
PID 1288 wrote to memory of 652	1288	BraveUpdate.exe	31
PID 1288 wrote to memory of 652	1288	BraveUpdate.exe	31
PID 1288 wrote to memory of 652	1288	BraveUpdate.exe	31
PID 1288 wrote to memory of 1472	1288	BraveUpdate.exe	32
PID 1288 wrote to memory of 1472	1288	BraveUpdate.exe	32
PID 1288 wrote to memory of 1472	1288	BraveUpdate.exe	32
PID 1288 wrote to memory of 1472	1288	BraveUpdate.exe	32
PID 1288 wrote to memory of 752	1288	BraveUpdate.exe	33
PID 1288 wrote to memory of 752	1288	BraveUpdate.exe	33
PID 1288 wrote to memory of 752	1288	BraveUpdate.exe	33
PID 1288 wrote to memory of 752	1288	BraveUpdate.exe	33
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 1564	1012	BraveUpdate.exe	34
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1012 wrote to memory of 240	1012	BraveUpdate.exe	35
PID 1544 wrote to memory of 1580	1544	BraveUpdate.exe	37
PID 1544 wrote to memory of 1580	1544	BraveUpdate.exe	37
PID 1544 wrote to memory of 1580	1544	BraveUpdate.exe	37
PID 1544 wrote to memory of 1580	1544	BraveUpdate.exe	37
PID 1580 wrote to memory of 1656	1580	brave_installer-x64.exe	38
PID 1580 wrote to memory of 1656	1580	brave_installer-x64.exe	38
PID 1580 wrote to memory of 1656	1580	brave_installer-x64.exe	38
PID 1656 wrote to memory of 1860	1656	setup.exe	39
PID 1656 wrote to memory of 1860	1656	setup.exe	39
PID 1656 wrote to memory of 1860	1656	setup.exe	39
PID 1656 wrote to memory of 1192	1656	setup.exe	40
PID 1656 wrote to memory of 1192	1656	setup.exe	40
PID 1656 wrote to memory of 1192	1656	setup.exe	40
PID 1192 wrote to memory of 1052	1192	setup.exe	41
PID 1192 wrote to memory of 1052	1192	setup.exe	41
PID 1192 wrote to memory of 1052	1192	setup.exe	41

C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup (2).exe
"C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup (2).exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe
  "C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1480
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:652
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1472
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:752
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins2RDM4RkQ4Mi0wQTU2LTQ4QkEtQjI1Mi0wOUFGM0Q2NjA0NDV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkM2NzJCNDEtQkQ5Qi00NDE5LUEzRTItOTQ0NTc5QzFDODkxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjEzNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyNjgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:1564
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none" /installsource taggedmi /sessionid "{6D38FD82-0A56-48BA-B252-09AF3D660445}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:240

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\brave_installer-x64.exe
  "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\brave_installer-x64.exe" --do-not-launch-chrome
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
    "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=109.1.47.186 --initial-client-data=0x144,0x148,0x14c,0x118,0x150,0x13f989710,0x13f989720,0x13f989730
      4⤵
      Executes dropped EXE
      PID:1860
  - - C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{648313C6-6D6A-4710-9C09-3928C33A053A}\CR_05B4F.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=109.1.47.186 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f989710,0x13f989720,0x13f989730
        5⤵
        Executes dropped EXE
        
        PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandler.exe

Filesize
293KB

MD5
abb49e6c916cff25bbf5242645fd557e

SHA1
ed609fb8b041778da2e1533360e23d50bf002d75

SHA256
3b8f707a42f5066a73365a8c1add83c2c0471ec5023fa78e29e462c0fedb07f5

SHA512
49e3c3a6e748f003a9cfb1f3d0bff741974dc16926b37d295757b1eac5147b244cb7f62a0d035349a1ce38f49da373fda94d9d5fa36ad912fc18e365519f92fc

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandler64.exe

Filesize
386KB

MD5
beb606f6abcdac6b5d28de211c0d4994

SHA1
82b029ec64b2ec5763aa9cab2123b29648a2e302

SHA256
722657346ee99cc00381b4c776eaebc234fafa3e5c793f88a5d8a78a35aadd99

SHA512
4df5d358bb96f0cf5243bae4882aed50f1b370089638325c9719967237e2326e7dff5e57dcf681d265a750064f003765a4e6f1cd98fb18d745bc8250ebff16bf

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveCrashHandlerArm64.exe

Filesize
360KB

MD5
274e80f8eb7fa05bd261f2ccd6c2390e

SHA1
7cec99912119392d7eb6992111c681906bee4f20

SHA256
39ccbb5fcedda830ab38d4b4eafafdfd91c52ddf0af7c330a09aed7226910143

SHA512
19ddb56070ec853964421ac57a6590a7e943630ac18cdf101d37d31cd67bbcfdb5a884cf8a9b076369f5db0dda3b21fd3622d99f05c62292c80bfca3274ed82e

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe

Filesize
170KB

MD5
03b044f98add31e5a2f9b426e071c79e

SHA1
368eac50491d63765846dc15730a03d3865c2357

SHA256
d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

SHA512
b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe

Filesize
170KB

MD5
03b044f98add31e5a2f9b426e071c79e

SHA1
368eac50491d63765846dc15730a03d3865c2357

SHA256
d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

SHA512
b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateComRegisterShell64.exe

Filesize
188KB

MD5
3c9c826018046cdca56c2a836be9b335

SHA1
22edad3dee4f3dccf8c54e53f7bd7641116427f5

SHA256
672fa5f1c003e947ce1e91f29179842a65abd6af9aacb51fcdfb87734e817785

SHA512
944623416671d6790620bef79271b69392596819978939e4a525e60e965d4a619cc2bc4dc1bd547a381e716e957a34d30c85694c17f82e03953b26711ac5b388

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateComRegisterShellArm64.exe

Filesize
148KB

MD5
5b5f553e1188300dc69884f1866feb87

SHA1
d074eaedd00e78405dee4104df55e5712d7b9ec2

SHA256
1390f9a36491000cd5fc040947b8366c45f91541c9ff635ab3d2317e04892aa5

SHA512
ebd79509da32df3e07da930e406dcab80b1453dfabbc179b1c1cfc2167606134a062745330d3b8b6474ab77466d66e71dbef81a2d05c490940e446a27956c1e3

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdateCore.exe

Filesize
217KB

MD5
fb3a65a300be7d3be09e62d21024e8cf

SHA1
800c6656e487c4b31927f09825fe061cdc665d8d

SHA256
d031fd1220844dafc8d791d4ecafb225d097f29060c00f90389b9b354d0a869f

SHA512
5221bef6a5b27916d48851c85d785fea15d094809819b100e44e6c0a490f9588351407ed811f665739abed2f0ce0a7eee45766a5fb6fbc7fb38ca65326486c3b

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdate.dll

Filesize
1.1MB

MD5
fe167e5aef821cd99da031451f1a37db

SHA1
2b3972bd0feecdfa80cee56d8e1378c5d44d6c23

SHA256
b8239acce72683344981558cda543df6c51194f6dc0b79073369a1a1707310b0

SHA512
755912da93f75cf6b94a3805c01f94fe46ab5169d3787bba15a230a95c543323801d51b71912dc46f17ec1769f4c421fa71debda406a3e90ee03d2337d7f9e3d

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_am.dll

Filesize
51KB

MD5
952d728eb12b3ae0cbbe510cb88c9125

SHA1
98154a08ebb701d6e250d928ac090ed6319d17f1

SHA256
4170acb4971b5373c760b02a81aa71ec7927efc50af69091e07c66c67ab3b884

SHA512
21efd8f71d7f2f817f76a88273f1101022b21e8adfc8515218627bf863ffab7b2560a41767350ac47028427e3313b8933997cf799ce8efa524c32c732c3c9b4c

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ar.dll

Filesize
50KB

MD5
c7af9d4f208838ac39a6243207200412

SHA1
96de7400552706d036b3ce100a25bd7a0f336152

SHA256
d78959ad0e5febdcebfec904f77e1229428bf3086c149b4dd94930e18b727e52

SHA512
d230998443c3718e547064afa5f2afe94da3a5297a7b6a071449a588b4dc51741c179892eaf7d4a8d7db3681744c520046a841c67b32cb9d3a4c244ef9c94580

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_bg.dll

Filesize
53KB

MD5
c2d5910c73b089748760138b0da0bbcd

SHA1
ee90ca2adbd41345d48b7e8821c44e55934913b9

SHA256
9a165e164dd179e4fcbd50a29b9a0f9d5682f14046b8a15c593850342d0ae6b1

SHA512
bd2c47952663e188b9d788e538a65adf37a4260c13bde970556ca538d2b0d58d913713ce22e743ac8aa0b571a51e6ee14218f5f5728f0a3b77b87189d710bd0b

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_bn.dll

Filesize
53KB

MD5
456d9591ce37ea5ac81a587048312ec0

SHA1
4b8673321e5c47e758f2c3128197ed84c8b0a681

SHA256
afc531f51285860b3db534855f152c326fd59a42a5b4554c07ca894ebb6ed100

SHA512
f123ad5e18128c26d30c3e9394d40331f183dd255edf06b5f9c5c4f609ece464111fd4dace39bba15a9a0265afb35bfc6b6e858b65ab1d5fec306ac837163e5a

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ca.dll

Filesize
53KB

MD5
edf6ed54c56ec183e22f8e61a23b3e4e

SHA1
8bce2a05e8b3f4a2b96991d19bfd79cb4fa0246e

SHA256
8f1f3af179ce7431dc3c85f74a3029daface80f0bc40b0435b4e7bf4a4966efe

SHA512
60e8e354a886bb8090a57f84a122b909e92f9b05cb98bf537109ad68e9ff9b97aedb0465c802f0e42ea4548aa013e8569eef283c8ec0acedaa47fd4c71df10db

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_cs.dll

Filesize
52KB

MD5
6239aac4448afe6a7c8ca08ca6fd8477

SHA1
f5ebb49968ed75a6470205c1c068e680dacd44c1

SHA256
ed0f1127eade9ac63c159388ada59fe6727c03a526820423be30769b6c3407be

SHA512
176006c675c23fede59847fc257887b50c5c6898053000beecbede1c00bde3446a9d400dac25a782d12646e7ca21945e6860b30be992931c8c3f42cd92d433c9

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_da.dll

Filesize
52KB

MD5
bf0deb435d0fb825ac19187540deaee8

SHA1
5aee9b601ebe86191d8a470b3ac9dbca054f5114

SHA256
a34c551be33fff045cbbfe7ee234840ec94cbf67f94b5a4e90fe2ea02b36e13c

SHA512
639ce39403bce096f9c0b64adfa5e45b2f3dd7819180f9d8d6cf5cf77209fbe052779cd2d402252052c3261b6a134f872e3d70dc99cc1c67bbfdbe6deba95772

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_de.dll

Filesize
54KB

MD5
732ffb4e91ea6f1cfd0b5075abb8e616

SHA1
b529a294f219bfb6f3384b13fd4f0cacabf2ead6

SHA256
e883fd20ccc807c084798adaf5cbd8c9b192c3e21713bc26c196f93aa92cfb2f

SHA512
2bd9acb40f780078748f9e2c99b11233fe8f6a04218404d94ad350b1b43282560a58e7ad681032a2fe01b98f6e96d0784c64983afb82f9d2f92f3a4033f6923b

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_el.dll

Filesize
54KB

MD5
8e8bb6d072d0fd0d78b1d7ea912fe8d1

SHA1
ecdda631b83573f0023294f4b2f1cf14aa64613a

SHA256
1111fd426002a993332e175461c8d81638357fa61f31212f48131ab2e454abea

SHA512
2ce4231abb03ad6d46da822ec90c8b1d741f84e780f41326519c5c6df0c50b46dcca1f86bdf43a711655ec71c38a6f8a9f274b02f46f43ca77af536288d0b10c

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en-GB.dll

Filesize
51KB

MD5
50fe0df9d9612b6d4636c0b8543bb1ae

SHA1
f1d183ead20c7f4707525d970e4f69c6df38b7a7

SHA256
5acbd02c5aa6f3fa9fe640e27ff58357b4e3b625e521aa9167698a1c574be0a2

SHA512
fa89b39e71285f21914a615b00043af3dae185a24d8a8d4bb5faad682d351203afdc4271258562b78d552a2ba877b9555b9ba2b9fe2a3f7533c90c574d2fe6cf

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en.dll

Filesize
52KB

MD5
c119b7f4421d3b56286ccc95fb6072db

SHA1
3386841db70d8b3c24f4f8a61e03b8bcd0ddcc01

SHA256
f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b

SHA512
f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_es-419.dll

Filesize
53KB

MD5
5ee19bf2cda7cd4f5d2b904aaeaf1a70

SHA1
8910926d01c1551a1ad0d4914ae7704a95f44855

SHA256
99124fc1426f415dbd44799c1c95c8774b569ab6502b1f71fdaf34a789bd46ca

SHA512
ab851cabc8f83c86542247b2226f3a52be12a08fcafc7d3d7c093646a010dc199d35f3978e07db7beb281858b69ad968adba092cd64c2d8010d1362a77998da6

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_es.dll

Filesize
54KB

MD5
f95890d91bdb05c8c9f894c8e702e944

SHA1
b2d371d71b9b8ea59286b61f45d0450c4e466ed1

SHA256
2bf91b4b88f19c30f50f73cdbd77251abf5d2ec87502fd0125845cb17e49c047

SHA512
1fb96de04492c70f05fa70db11706c04b71f2e00b93d5c1b4d4d9ddad47918402c3e7d89baf0dbbcdcf587b08bea6b29f2dbe31d286c18398a097635d1a6f01f

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_et.dll

Filesize
52KB

MD5
336d29829a5e7f45b3c668c5318d59d0

SHA1
e078502116345a3d42805a103c3c744207768ea2

SHA256
c9f02b65f1ae42932098aa15f079a7bbc62af675e8ec4170fca2e5607517ed48

SHA512
648be41e0f0e3ddcf00c1d5030c918db4171c00534045db253366189722a1e99fe23e94ff7f960f3614252a7b72a8c56fc10e1d91f91b072de6f19cdce49a2af

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fa.dll

Filesize
51KB

MD5
b2dea0295b886bb951715d7437ce2502

SHA1
272f12985ffacb46432c014cdd0c44b5e4de8fa2

SHA256
fa08a49321dadea11d5b060d9e6baedd63fd9cd641744b8158da9d8fdc4dcffa

SHA512
fc471a8ea39b6bcfcebda72469b27008fe98888f066db6d074cd52393a320da96f9d9ceae7d12b15415525f1d81215172e05c8c903a78ced03d1014399573d88

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fi.dll

Filesize
52KB

MD5
e017a8cc3a9a3842c21442f06c347b89

SHA1
f2f0022a093e1b896d8910116826eda60573b036

SHA256
c8a08859c185da734f95f69cc2e7d0e76c2b922f9b7b25b72d9aa28ea9302419

SHA512
c05fdd334aef7cf5f230eca6702c7346b133a0ea5b24528d9ff0fcd7ffd18b20f8a4d5ae8184767f93da02e3a6fd4bd87ff3bf55602d90734d2c813f98b0f459

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fil.dll

Filesize
53KB

MD5
44f3f887738b5c4b5a8b474c11c88ba6

SHA1
f5acd286f6a34994cf3dfcb79fa21ca93e5833d3

SHA256
0e63151e6a39c394c939e34a22854122ee6d217754ea575ede21eaec3267d4d4

SHA512
520b7a71651a2fbf0820f7e6458eb6c3289b675feb27dca758d1731788d95407d89e3bd6901f4bcf81ab144f0e2996a498b4ac5f00129a5f47e7456a3d5b7bb6

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_fr.dll

Filesize
54KB

MD5
d6fed020daef639970bae58a52d96b7f

SHA1
4de8d2aa82ec0954b32c8ffa136e2e9d7bc30d86

SHA256
c08e507c3f5b07fc818c0204e34789ec8e5e6bf97ef78bef80a0658fe76403ad

SHA512
46cf1e03bb3f0cc5d55b9d57900bc4fbfb8dfdc0e6dd71449307c93a54861ae35f89d52056a6dee2457a6c9c4c10a03525017c06fa76dc8ca6205ef97ee7b057

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_gu.dll

Filesize
54KB

MD5
96f5aa5232067ca2c14d74a41e0ced25

SHA1
a00451c1b1860f5da35ac509f0f97f4c4ba94f87

SHA256
7d8a7bba1057a83ef03ea971299eaaac1ed92d23642aa040c233acf263bc51a9

SHA512
c52130b049dc8e981b85d0fbb1e34a9ec98fb44b50fd60c856000d525e9e9d32ff6edcb2e1174031f9b779998a73fa72c148591d0622de46067f81450ab2d150

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_hi.dll

Filesize
52KB

MD5
3cb19e36ec8aaa6095dd8fc9e1b0b199

SHA1
18a202c5bb123f9667f0328e4efd5dd814a0d3bd

SHA256
6b21d6b9bed85798a748c3a8905960b8526739392d7d3d8bd9833d39d5c92aee

SHA512
21b477480c0e697e7ae201e3c15e772cab4f77519db74c3d71b37f689a24cee918ea37dba9f488096e687e768c09c194447dfb0e13b3e9a9caecd03f333005d6

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_hr.dll

Filesize
53KB

MD5
a3fa90aa21c2c5f0b2d72c223d899da4

SHA1
fd93fad70ade266657b302237e3dca51401cc550

SHA256
223198f64aaca92df2dbd6e6311760353c83671d202a2abb597679720d20c303

SHA512
b8e1b891ac468570492f3812341028732355ca8193370a00fda6de67b60f3e64bc4d3207d139a5c11f1c486c3dafcb78591583aee61b17c110e13f9b358717d4

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_hu.dll

Filesize
53KB

MD5
5e17dd7c7c950af55f69f9e926fd5999

SHA1
534cabac60a359b4098900e2c936c090e265dab5

SHA256
0f6c78eae1a14d67cdc112d100a0f05764a7039b14a3fd6138f6c1efb3ef44a0

SHA512
802e7f17f8519631ad4847d0ed53bb83cd1601cba455a432b13e4dc3ba1bcf4fff6bc7d1cf4866298f52b897f2c6ce7ce845ef3fc676328ca84c35bda6c8ddef

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_id.dll

Filesize
52KB

MD5
f8457a1cfe368b3c19bcacf7010f276e

SHA1
0fa4bc120abf94a8b5c0de30f910040f10351ad9

SHA256
0fb838120c6a0c8cb95a4e54073c905fb7d2b27811792e01fe221b3991e89c6e

SHA512
cfd90e17adbb9796de2e63dc1c22d887aead64f929f3260bed0a796247757dc09b895de0cf2f5c3acd2ed6e067ac587f1f616c84f2dcfcb5a8e51ec12a9748b1

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_is.dll

Filesize
52KB

MD5
3ee5e70581c5c0b9beb9d8d326502dc3

SHA1
7dfaa038f13b66e33e8f49a593afffc7d0973689

SHA256
529eddf4c8ae1d513a49b8e70a3e6b87f7cd7100500ab09bdeb42c83b6708ce3

SHA512
6d5e7337efe57bb9a42c4b93698bc4caef2b270e87c914d3205035919e5ba2bcf3a8fb04c3f15731a5a563c9d683cfcb1f202e56e0683387c5d5364522064bec

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_it.dll

Filesize
54KB

MD5
3f2b1d765a20ccdbfafb4a4bb4f07f22

SHA1
475e9b6a08df9ece6267c3424434e460051f5fdb

SHA256
fe8400f598c83c8631cd619ec647535e63a9444d17a8942f8f2e320222cbf459

SHA512
5bc377ab81ac1b5c0271859021e0f9beca37d97f1e7090ce67a2f2fdb49684909956e2839cb63cd55fa69f80613f9023a3c306bc9035ed07926a18a62bece861

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_iw.dll

Filesize
50KB

MD5
b511684bcc597a2f708092397806e652

SHA1
661c507e1b0a9022d1bef90ac1a4c64ac6193c4c

SHA256
db19c22a5496596835b5677637234d1814d5c1004268add0b79ecf37796df3c3

SHA512
f294cad9c98b2a7de124a1088c55713560d35822ab2e9dcee430ca925266424d8eff5e68602ddb050aab43e05b60ff6dd9f444136f8a8e1406fcdfaaf2c1adae

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ja.dll

Filesize
49KB

MD5
9cfb7801967c067b2d8a81a35f2b1493

SHA1
82bd4b32850bccdeb576737947dd9c82a58c83d7

SHA256
1187c6ae64f67ce6fccf5e8f79b395aa7501c0e5ff15cd07672d4c541780a169

SHA512
421e2f969e393b5b7c1c61f0d2249f7c2d38ea21141a4a79c3bf275d10e6b75d81717f3c734220a6f459797aed59003c63ca43818d2cbdba028c618d153425a8

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_kn.dll

Filesize
54KB

MD5
1b15c55ea11bc61757e5d0c28eb10593

SHA1
bbfc52e0a500b4d2c1a46fda5a5fd3a03d0f5ccc

SHA256
73f7b6e62ec05ab990051a41c6309e75357700a57171832aab20c45bcc33951c

SHA512
d22bbcbffcc64c6c0e59b254b2f6ba4af516f786c2877de82bb32184218bfd187c8f80e915ca68505d5b01efff98455713ae47849dc5acf98a67fcd30ef14dde

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ko.dll

Filesize
48KB

MD5
4e34d3e033f632a26d470d5e6fa8d921

SHA1
90714ad57783ea435dd9df0974350e69cfc7a132

SHA256
f8d20332d9ca70cade411d28e853aab93219939c17387918f4a8bb167926a342

SHA512
2e671236a0d57838405ef8118999e1dd85a51a19bcf80e90d15cc50d7232a90152f2b57769404397b8d3402ff1222d62ba6a623208111dc697b634517cb6e1c1

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_lt.dll

Filesize
52KB

MD5
a5caa7eb451940d8cb8e9a93a78c7b7f

SHA1
7645f6445948aefac145a3c354e6f9ef27398391

SHA256
5a504f7e2c7248a32ccfe2f21218eebbc2d84bd13863247cc2855d1d91376658

SHA512
24321764a6deeb59231fe666d01dea1eb311f53e9438408b02e4562feecd2e3c71a27ab38242bfbcab6d4626b84fea2d3924b9f3643a167b22adb3024c629564

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_lv.dll

Filesize
53KB

MD5
ddc97b4cf9f34c4b75f6f46f47f8c064

SHA1
a1ecfc6b8fa7d82103413bcc07716e12f6e1df1f

SHA256
ad7f288eebc3403b98480181f4a209a12d80d742765b2ba43ba97a85aef7e515

SHA512
d613bf6c6c214da9eb27022f5a654443c1f4e1be0b30d45682affebb1f8c070fdb04d88b8bd1e658ac378d5cae9f86a51d8932901696e59ef275ec0baacc45b4

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ml.dll

Filesize
55KB

MD5
fb29f8bccaca36cfe696af9c42ad1144

SHA1
594708a8516eea8450c13a97a72790e2cd9d2df0

SHA256
52d928792790ba56cf28fad00accd6087560e864e9b839e9c77a1b15000df001

SHA512
881d872d2d9ff6012bef1bd6e5811c9947040da77b7b75fae71e29988959e59a3848e33025100197abb1eae4101fd93456f743fdb53e4e895c1e0d59c6daea83

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_mr.dll

Filesize
53KB

MD5
96099c3ca5f9cdfb13ba7ab6f95d2db8

SHA1
a26f2af76338d83f48c1180d24469e661ec3c2c2

SHA256
c0a5466fd29780f92db373d95e0a15c6c0f5d751b7783ba1a4fa584c56a46eec

SHA512
2aecc53834a13ffd1a0586223c07ac61abd97b342108eadb39c36cbd5ee9477b5f36dfa1efa7af39905611edec242e74e9d8e3cd806694056678f0e0f1826ab8

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ms.dll

Filesize
52KB

MD5
b54dceae59496fea77e4553f7e901b2f

SHA1
f4e109925ae7f697ea7ba1f215c053bd9bbf457e

SHA256
55a0cd74c934ee3674bef493dc0e6cfa25be119a297d7e04b8ce7651705dc2c3

SHA512
acaece2ff20f63fee3b6ed9b09ce742f0ca08ddfa021f998e5fac991d22a73e9ab399420cf73fb5b8efd2d8da467653a162d78d55a85fd439f1b4d26c02de291

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_nl.dll

Filesize
53KB

MD5
7f7d273fdd78862dd9b3c0f367d547fb

SHA1
9f137a382ecbdd2299a2a5d586796bb877901ebb

SHA256
22546626e25468d569afba2035e68d8ea4514cba9dfaae3dbc1517c30af98849

SHA512
860ec4a40fc1a52483329268e1add66a1f9bdaa21930fdfbb83ebe1a83f5966ac9cfdcae87e3e4ff2ed8a76dc3f6fd3244378d9eebda664cc350ca45c00c93d5

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_no.dll

Filesize
52KB

MD5
d50df053f14f93c1b489ff11e31f877b

SHA1
bed9373f755d9c051279554bb8217bf06325a8c3

SHA256
25d36d848aa7c510348667a918a23388b3059248358910b92b8f05ccd6ee7e59

SHA512
33b455209993ad4d758750e14c26e21c4f0306ca30bd9afe56ea17d27cc62593130fffce72d1a0a94891b4682237d4729a11ab3554fb66ab3ade5d7154de504f

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pl.dll

Filesize
53KB

MD5
5f720368334375a3c1486938064f1d7c

SHA1
3dbabc5b3714926a74523427067df9a170ef1ad8

SHA256
624aa14c0f78ca26a685aab27f35e4b235e970666da8575b28faffdf71661327

SHA512
a375d3b77d5d3e2f3dd50d83a3f2028669b166fd3b94445986abd370339793e95263983b8d120d196b2edb172db1e42dbd48ad9ba5a40482ad19ce273f1f165a

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pt-BR.dll

Filesize
52KB

MD5
fe920d6abbeb347f7be6cb113869e405

SHA1
9e708cc5ccef1f2dd4cb3a87807aa0c0f9768604

SHA256
79c509515e24b57ac1e6bc85cec17217d5dedaa582268d6b3fb7d0d596feeaa3

SHA512
c1e26da50bffe378e2f878aedffaea7b1bb965a9f481b76de2358ddfe88e6c36011b10f90d253c5a802f9b374ada69c0eeedbcb6f824f7229cc25ff82f75a679

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_pt-PT.dll

Filesize
53KB

MD5
ee4066da61344abc68469272cd6b4d3c

SHA1
553ed28fc59ca18e0b72bfb1cf5f8e592a68af45

SHA256
e0039b9e02c7ce1fa6f1cd6eaa92891ef6d852f4099138f0354d964a1bb68d1a

SHA512
180a76dae9ac52f2ce0fc2783ae720ec4033ad4930aa519466bc2175ff4bd3806c7494fd9ef31ac62cdd4ee062b8d8c3b2f10f9290268d136abd0c494be3556e

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ro.dll

Filesize
53KB

MD5
d3ae897d40f731303ee6a1581f91e9ac

SHA1
a88d49a2f276699994670625dfce2f2b6ec1cad1

SHA256
d5b18ffdacfac2f6c11568961ec513c82b88fa55fcc3600e9353cfe5b6e31dee

SHA512
9afa29e3bef3c8e7313a85b52759859861339dc2ab1162ffe28be4a8f9e13c3c88e4ecd8df17ada32cd3a76ff580af739ac8a331c2f5d0d821cc7399d3fb5efd

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ru.dll

Filesize
52KB

MD5
3ae763152c6b3f4cbf2cef797a3e6a30

SHA1
d56b64d0d1770dfb4501cb22e8d048161649b568

SHA256
0d1a5570526b0709919871a628968fee0c81eafdff068611e170087753b3cf50

SHA512
81c77aef5654ac6d628a5c6839f01c161fc58a392528944d3f65ba03b434854dbab34b5cdd668f45250a2fd4aa8fa4080784ac6fff70edd42812f388a0543441

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sk.dll

Filesize
52KB

MD5
82d06e4181b4430b82516fd204fa3060

SHA1
7d6dc8e04e86a950ce877c1dc8d489fd9eb962f2

SHA256
cbdd7c4663cbd2ddfea9be39739de303fe848733f2a36ab6851a910d99d047e5

SHA512
cbf28df25e38f7f87e85c3eac9005d7d04b86d962399235c69a9816c0427f56d727de563c2ec98341082dbbc732eb3fd788dc48dc7a9d10276975d5cc2de1e05

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sl.dll

Filesize
53KB

MD5
67505810f3a2f7a62e41b266c63089b7

SHA1
effa6a0dd0e44e5ef7bda5437b2a88b24f3215d8

SHA256
872fb34599b78c787e89e66f9968f1bd6e76488a2b7dc0c14cd3930abb8c5cef

SHA512
f39ce7aa6bfe5b22b54f465d8ed5e1e28d0d48fe51a0cbb841fd6dc3eaa2ab4592277f9e470d932eb2b093f7fd71128b66c9d2886611618df16aa33c2d679373

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sr.dll

Filesize
52KB

MD5
b51894d5b79c77ee9c5284a8540fa0ba

SHA1
aeb94bb01bc2d28a14d24ee0da0943c52b5ea0b9

SHA256
b092ca092e0f653c1649603ae4b7ecf38dbbedeffb65d11a241fecad66cf3274

SHA512
544894d19921ef0764b82997a6e7a8969396bdf85483f8278d70eca9f97ed47c0ffcec89053be048835fc298c55048fe40e5b9401e794154af9d75b961fd8cab

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sv.dll

Filesize
52KB

MD5
379cf8bd71842efd4af506562a11e7c1

SHA1
92c4416558b4a419f40d8445d80266f272f921ec

SHA256
63b76553af76b31fa6c34e4e3be71e2d144d0ed8ec3a2fe9e3634175d795cbac

SHA512
34f4c22aed0d151159005a4ae8309d217fb7b0b28e2f0b95cd18cf2fe9826d11a68e046f0fed69a954eb99ef105fcc06da03667b45fc756f59bd9402868d621a

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_sw.dll

Filesize
54KB

MD5
ba9c6a3681424ec11586936a04200a2e

SHA1
ec86a71db9c8bf39ca4205f5a3f1ac92defc2ea1

SHA256
ea9207dc37c8806913665028aa6440bdd14c10c7e09b251e99937d1062e0bcc6

SHA512
977eed7cee3617c916b83fdb9136728ff64163f6aa4dfbabd2bde5c43e881075cc8a65742c4f7e23e69fbf86293e4767bb28f1184e32707221b1ab7858794616

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_ta.dll

Filesize
54KB

MD5
0fe4e8e35d75999ff7b4639994eaef07

SHA1
af469e1b62a6fe8e5feac3889f44ae009b6bdb88

SHA256
ce6a20ce93579fa0be8a334395d5d6ba395a242e9a288d3d907eb62f3eb8ba7f

SHA512
d9f7d8ca1a58059e44b6eff9411e92ca4211c5ee83577b4d42433e697096b5d8a9b651e7b5bb4959d6952fee4c1b9f13f4062fd10205f6a18bdaced5159a9dc2

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_te.dll

Filesize
54KB

MD5
ab5817d15b4272cdba6ad78806e6cdde

SHA1
af7139e6b06ee30133c7ffb3e9e3a0f0b5de554d

SHA256
5030f0d18f191622f6d5a0fe010949e3c8e2ffc63d0f2f76fb87340e2c29d0da

SHA512
9a9f2d3c69d0f13933f6373d683abe676a75725a75380af389de91624d7f9a5033f674797665ab1a1a185491a5c9f828723b05f54935f16e0031dee86d13fa08

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_th.dll

Filesize
51KB

MD5
ace174d516146601b46bab25d1e6b25f

SHA1
20d5f3381e6a3b97a38bdcc9b385791b88392d8f

SHA256
f87bd8490cbd7ac13fe81d1d04017218db88f8a3f6afbac734dfdc9e662228c2

SHA512
428068e7dfce8ddc5fbb625b71168489d9b6cce10f6fd8bfd5390b2b6cc7273cbab310d68daae825fd1e75697e7d4e16fb4b0a5c71bff8096425cc6061598678

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_tr.dll

Filesize
52KB

MD5
7e6c746dcc0522d285dcaa59c626f3d3

SHA1
65b8434658926d7eb53aa3bb937044ee42adec9b

SHA256
2b8f98783f81f7cf60073482c9b014667ab4663a7e617bc080d35778a25bf401

SHA512
5820f22ec392bdfd1fe943f70e76ae82f2d3bba0721779794011c5903f36c8c9187912a0d679b440029c13a83217b6ef242242c307e05356d573226d4100f0c2

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_uk.dll

Filesize
52KB

MD5
198d90c9de4097d4dc19ee8b342f5a18

SHA1
1d7512b2b6daf5d99dfde548296960cbd24c094d

SHA256
b12cf6a71db741a0bf27a1371c0a78de9e6174bd75c2d945bfab36fd62de9e27

SHA512
fc0bd9a21c1059b610020bf74784ab43097d228bfe96504e5884e6552db7b940361ca20a69445c42bd42bd7a3b51d3f0b2bf1fdda510a735cce39fbf0322575f

Download Submit
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdate.exe

Filesize
170KB

MD5
03b044f98add31e5a2f9b426e071c79e

SHA1
368eac50491d63765846dc15730a03d3865c2357

SHA256
d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

SHA512
b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

Download Submit
C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\109.1.47.186\brave_installer-x64.exe

Filesize
100.9MB

MD5
a4599022b5d1691983c26936f2125d5c

SHA1
1456be249bbf22ea515d817ea89e91d9b30ffba3

SHA256
24d4198fe7204663379a308532b997a70841fe55f8b20f10536c9e6f445cb791

SHA512
4464c1670391f1e4654593d2af32f0c35f1c68e4fa84c3c6e54aae85952f8429247bca22ff9babff4110876b5262411dd1bd34c71574c6b81e529b2c0b4bcdd4

Download Submit
C:\Program Files\BraveSoftware\Brave-Browser\Application\109.1.47.186\Installer\setup.exe

Filesize
3.5MB

MD5
43a8a1eaf7c7b53c8569d8a5b4dbb476

SHA1
b57972aee7518565e4eda1f20d3717d205c87ccc

SHA256
90f1ce74855aa7e17a44a75fcbb356c315aabd84dd9c2d01062a27383c5444a8

SHA512
9b2543da8851836a08aa185c1596e0ce23a4eedc18d04b9876fa1ee16cb8cf588886f76d2dd3b2f37b6961911af0333284044a835c3244b112598087d27e67a2

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk

Filesize
2KB

MD5
8de7607305d5086bb7fe86274b7df2bb

SHA1
96ce1cdf3bfc4a8bc4145810928edc8a55d95c4e

SHA256
84e52559ddded3ff4c6c9f8b006492ea577bb4973aa40d29e6073a458f8cff0a

SHA512
10941bc738e3925ea028c7faad99137105e838f3bfb67a1d68f6ab22d679d1102671f4aca9b3742f3c3c0f194c811edba98dca4edb29f15b96b62a54c5a704dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Windows\Temp\Tar341D.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\BraveUpdate.exe

Filesize
170KB

MD5
03b044f98add31e5a2f9b426e071c79e

SHA1
368eac50491d63765846dc15730a03d3865c2357

SHA256
d1938269d463f62fa6941b9787e70216a543dfa8e476aa8999dd3e7e4c1b74d0

SHA512
b11c4f5acb4c7773e42e705a37bf411e714617c10ecd8bdfd6decd72abedfd56b86a49e48e9e0744c773d7ca6e52a47c8575717d9e03d067f7caa44a58c28b07

Download Submit
\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdate.dll

Filesize
1.1MB

MD5
fe167e5aef821cd99da031451f1a37db

SHA1
2b3972bd0feecdfa80cee56d8e1378c5d44d6c23

SHA256
b8239acce72683344981558cda543df6c51194f6dc0b79073369a1a1707310b0

SHA512
755912da93f75cf6b94a3805c01f94fe46ab5169d3787bba15a230a95c543323801d51b71912dc46f17ec1769f4c421fa71debda406a3e90ee03d2337d7f9e3d

Download Submit
\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en.dll

Filesize
52KB

MD5
c119b7f4421d3b56286ccc95fb6072db

SHA1
3386841db70d8b3c24f4f8a61e03b8bcd0ddcc01

SHA256
f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b

SHA512
f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767

Download Submit
\Program Files (x86)\BraveSoftware\Temp\GUMBA5.tmp\goopdateres_en.dll

Filesize
52KB

MD5
c119b7f4421d3b56286ccc95fb6072db

SHA1
3386841db70d8b3c24f4f8a61e03b8bcd0ddcc01

SHA256
f016d516b14b91abca60de0c2394efebde267892acc112556c48345cdf3f283b

SHA512
f71a5dd370153bfa88b61fe7152d2a0dbaae7cc0aaef16a0bceebe7c3ccc939337da18910479c7aca49db1ca495c623e3415681a3cf417d6bbe35a6bc88ca767

Download Submit
memory/240-346-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1012-312-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download