metasploit | 81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
Size

2.3MB
MD5

2fbdb362290d3330c8792078fccf7583
SHA1

79eae1d9fb13b1cf163fbf44c3252e69fd28344c
SHA256

81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7
SHA512

83cc2a9eec1e8d905fd9d195b6f9ec8dbb8d2e58c49bf8cfad6559212ca223b783dd0d6e501a680cbdb73256b541758b1e02a9f0143e0b73eb210cb2df62a0e0
SSDEEP

49152:kr/KPLe0RLCxriiiiINsMdRPLe0RLCxriiiiINs8Ft:krmLB0WiRIeM/LB0WiRIe83

Score

10^/10

metasploit backdoor defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe	BraveUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0"	BraveUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
2880	BraveUpdate.exe
2072	BraveUpdate.exe
908	BraveUpdate.exe
1028	BraveUpdateComRegisterShell64.exe
1488	BraveUpdateComRegisterShell64.exe
3016	BraveUpdateComRegisterShell64.exe
688	BraveUpdate.exe
2324	BraveUpdate.exe
2548	BraveUpdate.exe
2864	BraveUpdate.exe
2684	BraveUpdate.exe
2088	BraveUpdateComRegisterShell64.exe
1592	BraveUpdateComRegisterShell64.exe
2788	BraveUpdateComRegisterShell64.exe
1416	BraveUpdate.exe

Loads dropped DLL 49 IoCs

pid	Process
1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2072	BraveUpdate.exe
2072	BraveUpdate.exe
2072	BraveUpdate.exe
2880	BraveUpdate.exe
908	BraveUpdate.exe
908	BraveUpdate.exe
1028	BraveUpdateComRegisterShell64.exe
908	BraveUpdate.exe
908	BraveUpdate.exe
1488	BraveUpdateComRegisterShell64.exe
908	BraveUpdate.exe
908	BraveUpdate.exe
3016	BraveUpdateComRegisterShell64.exe
908	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
688	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2324	BraveUpdate.exe
2324	BraveUpdate.exe
2324	BraveUpdate.exe
2548	BraveUpdate.exe
2548	BraveUpdate.exe
2548	BraveUpdate.exe
2548	BraveUpdate.exe
2324	BraveUpdate.exe
2548	BraveUpdate.exe
2864	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2684	BraveUpdate.exe
2088	BraveUpdateComRegisterShell64.exe
2684	BraveUpdate.exe
1592	BraveUpdateComRegisterShell64.exe
2684	BraveUpdate.exe
2788	BraveUpdateComRegisterShell64.exe
2684	BraveUpdate.exe
2880	BraveUpdate.exe
1416	BraveUpdate.exe
1416	BraveUpdate.exe
1416	BraveUpdate.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation	BraveUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fr.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_pt-BR.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ta.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_th.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_zh-TW.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fi.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ms.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_mr.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_pt-PT.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ru.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_te.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_bg.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fr.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_mr.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_zh-CN.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_bn.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_da.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_zh-CN.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ja.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_tr.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fi.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_iw.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fil.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_nl.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_vi.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\psmachine_64.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\psuser_arm64.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_gu.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_id.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_nl.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdate.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_es-419.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_hr.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_uk.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_hu.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_pt-BR.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_zh-TW.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShellArm64.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\psuser.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ca.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_en-GB.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_gu.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ms.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_hi.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\psuser.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ru.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sr.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sv.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_te.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdateSetup.exe	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_sr.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\psmachine_arm64.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fa.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_is.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandlerArm64.exe	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\psmachine.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_et.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ko.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sw.dll	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdate.dll	BraveUpdate.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_cs.dll	BraveUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
688	BraveUpdate.exe
2864	BraveUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\ = "IPolicyStatusValue"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CLSID\ = "{4C3BA8F3-1264-4BDB-BB2D-CA44734AD00D}"	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachineFallback.1.0	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\ProxyStubClsid32	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\NumMethods\ = "5"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods\ = "13"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods\ = "4"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32\ = "{B804142C-9485-4705-A810-066A166A4854}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E265DCD6-547D-417A-911A-C1BB7398FE95}\InprocHandler32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ = "IPolicyStatus"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreMachineClass	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\ProxyStubClsid32	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F6D9FE5-6ED3-43A3-80D2-EA8766D65352}\ProgID	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\VersionIndependentProgID	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ProxyStubClsid32\ = "{B804142C-9485-4705-A810-066A166A4854}"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\LocalServer32	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ = "ICoCreateAsync"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B804142C-9485-4705-A810-066A166A4854}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48B5E6B2-9383-4B1E-AAE7-720C4779ABA6}\ = "IRegistrationUpdateHook"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine.1.0\CLSID	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\NumMethods\ = "12"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08F15E98-0442-45D3-82F1-F67495CC51EB}	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\ = "IJobObserver2"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\NumMethods	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods\ = "13"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\NumMethods	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassSvc\CLSID\ = "{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc\CurVer	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreClass.1\CLSID	BraveUpdate.exe

Modifies system certificate store 2 TTPs 10 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BraveUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BraveUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BraveUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc180000000100000010000000fd960962ac6938e0d4b0769aa1a64e264b0000000100000044000000420036003600320034003000420030004600360043003800340042004400340038003500370041004200410036003000430046003500430045003400410030005f000000200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	BraveUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	BraveUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	BraveUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	BraveUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	BraveUpdate.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2864	BraveUpdate.exe
2864	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe
2880	BraveUpdate.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2864	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe
Token: SeDebugPrivilege	2880	BraveUpdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 1992 wrote to memory of 2880	1992	81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe	30
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 2072	2880	BraveUpdate.exe	31
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 2880 wrote to memory of 908	2880	BraveUpdate.exe	32
PID 908 wrote to memory of 1028	908	BraveUpdate.exe	33
PID 908 wrote to memory of 1028	908	BraveUpdate.exe	33
PID 908 wrote to memory of 1028	908	BraveUpdate.exe	33
PID 908 wrote to memory of 1028	908	BraveUpdate.exe	33
PID 908 wrote to memory of 1488	908	BraveUpdate.exe	34
PID 908 wrote to memory of 1488	908	BraveUpdate.exe	34
PID 908 wrote to memory of 1488	908	BraveUpdate.exe	34
PID 908 wrote to memory of 1488	908	BraveUpdate.exe	34
PID 908 wrote to memory of 3016	908	BraveUpdate.exe	35
PID 908 wrote to memory of 3016	908	BraveUpdate.exe	35
PID 908 wrote to memory of 3016	908	BraveUpdate.exe	35
PID 908 wrote to memory of 3016	908	BraveUpdate.exe	35
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 688	2880	BraveUpdate.exe	36
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2880 wrote to memory of 2324	2880	BraveUpdate.exe	37
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2548 wrote to memory of 2864	2548	BraveUpdate.exe	40
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2880 wrote to memory of 2684	2880	BraveUpdate.exe	41
PID 2684 wrote to memory of 2088	2684	BraveUpdate.exe	42
PID 2684 wrote to memory of 2088	2684	BraveUpdate.exe	42
PID 2684 wrote to memory of 2088	2684	BraveUpdate.exe	42

C:\Users\Admin\AppData\Local\Temp\81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe
"C:\Users\Admin\AppData\Local\Temp\81a2d56b22ca43be120f138d7aa220b79fbd0dda5d4df3de5a8bc2e4882bc8c7.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdate.exe
  "C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={103BD053-949B-43A8-9120-2E424887DE11}&appname=Brave-Browser-Beta&needsadmin=prefers&ap=beta&installdataindex=default&referral=none"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Indicator Removal: Clear Persistence
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2072
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1028
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1488
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3016
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InszMDM4NzkzRi04RTEyLTQ3QkEtQTc0Ny0wNjJCNDJCRTMxOUF9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkU1NDUxODctNzVDMS00QUM0LTk4MTUtODVDNzI0MDQ3RTA3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE1MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI2ODYiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies system certificate store
    PID:688
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={103BD053-949B-43A8-9120-2E424887DE11}&appname=Brave-Browser-Beta&needsadmin=prefers&ap=beta&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{3038793F-8E12-47BA-A747-062B42BE319A}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:2324
- - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /unregserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe" /unregister
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:2088
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe" /unregister
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1592
  - - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe" /unregister
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2788
- - C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdate.exe
    "C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdate.exe" /unregsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1416

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
  "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InszMDM4NzkzRi04RTEyLTQ3QkEtQTc0Ny0wNjJCNDJCRTMxOUF9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MkUxNEJBODAtN0I1RS00N0MzLUEzMDEtQTA4OTAwM0E4NTZFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9InsxMDNCRDA1My05NDlCLTQzQTgtOTEyMC0yRTQyNDg4N0RFMTF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIiIGFwPSJiZXRhIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzIxOTQ0NyIgZXh0cmFjb2RlMT0iMjY4NDM1NDU5IiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzkwMCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveCrashHandler.exe

Filesize
270KB

MD5
ac0f347f1568b42bdb99a0ed24484427

SHA1
dd0f3094b41488199686522c8245a90e01411831

SHA256
038094f7923689333715438ece88818bdef62d5ece7d00e6edf046740177c53e

SHA512
26905849a03a227cd5e219d42c4319cc6adcb9623c67ad0b4270ad273c5c0a60502a86d4cf4f290b52c35d662f39ed8d55ebcf0650f6da5cffa3359b01cd877a

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveCrashHandler64.exe

Filesize
355KB

MD5
56ebdf4bb0592c067ced31ace9efa9aa

SHA1
dc611fb8c83eddf4f5935cd83a3a6734d707a3f9

SHA256
39b89c5641ee63897303a7dadeffa7f6aef2f4eb4010a7e67dec90bf36b37fad

SHA512
ddd70e8426ccbfe3ca63e942dc3b9070cccae3b809f1cd331441a3c9d8c588823f0bb95b1163f02cf8daa9bd1926fca46621b280c17f080e751e6be1d7f6245d

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveCrashHandlerArm64.exe

Filesize
353KB

MD5
78dbb9bd3310c349a0a92e1fa62c525d

SHA1
d2eea3953914b40a7721c7dd4e74e69ea1061af9

SHA256
579c969d1fdc88a9e3c3e1859356b6db4c64bcca64e4c4e2d958dd93d6042d4d

SHA512
e54ffde0d29f6463cea22d6f53354ef4e89d4b02ca464471620a7bd09f1855cb16d1c62fb64f8034e52346e288c05fdcc2aba4bad0f4de336943f777c51c9cdc

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdateComRegisterShell64.exe

Filesize
170KB

MD5
4efb057994a802f168acaea1e66f1cec

SHA1
d9e835064a99bb46b72dcf22710bc41d12a255a7

SHA256
0c40341e52807ca64503397a208732f27697500550cd33145a57c818982dd6cf

SHA512
41da09b19d2774d2c0a150aa2695ef4aaa11ab4f57c167ce949f30fc8a5af53faa3bf68ddc01a05c37cf84ddc30a6b13b0fab3c33eb0fd777c6dc34306fbe7d4

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdateComRegisterShellArm64.exe

Filesize
154KB

MD5
de19d9a8fab707ec73c76bb331c7ee71

SHA1
9227f86826437a920a1994ccbb0ec67d46a32fa9

SHA256
107673d364f7a545055f909c338f64b8c5161a3b74978585c67e455b1eb89f0d

SHA512
a69133c245275b8bdcde46e74e13b719b7857293a5f81be6a5b69975a2a5fa22c523cc3e3715c7edd9d1648eb59e813c4445b22115108fb2d7c035d7db2ca828

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdateCore.exe

Filesize
195KB

MD5
cfcec9cea12a9ad81bb2e9d99bee97c6

SHA1
093c986c8e90a646a581b5ea9b3c3b2b26963c40

SHA256
9e0b50e176e7834d8be907072dd675af522fa3e85b33dfbca7d30e16d58dbe6c

SHA512
e879689c4f4909ff797a1cae963b3de62843cef421db74ea75f814ce0d9249dd700750b17fed68a51bc788cfd13b46f4514f2a3dd49b870ce7b62867bdf76a2c

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdate.dll

Filesize
1.0MB

MD5
031acce8a1e2ded41bf36b6842804fb5

SHA1
30d52d202f8994b67544f7c447ec87da505d19cf

SHA256
df2d8d14dc53c919e7b329cd36e1d201597ac79b381da269a77d2985f0ed2a5d

SHA512
9c1a4c6efc98f4dcb9b4c3c0ba1ed3c8121b8d39812c2a71c7f5f620d9b0d15e8e511b1d7ed0513b5c7c81f48eeffe0440e252f9d1485cb50f285ecfaca204de

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_am.dll

Filesize
42KB

MD5
5ebcf5f83a31782c807608060ed751f4

SHA1
5d2d96e38380f491469bae8db8fb7cd17d02b3ad

SHA256
29d952d3570eec99f0c5f91464951995c4972abb77f9992d4743eaf598bac375

SHA512
c346dc0eb93738222dfa0779d263a81c0939ddfddb5522cbb784198133ce9f1fd5b6da559869026dd270d960139676a0e584be8b1923a6e15a8f2b280942eb82

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
07a3d38fbc5c1fe8921debfc61d4c0e3

SHA1
d5fbcf27599939eacf1f1a1372532aa715954ed9

SHA256
ad2d28cfef0f1c780391ec261f8d406f906848c32f0bbf449b0c456b5e92bc4e

SHA512
d7732d1e7b15769c66307cd94d1a2271d3c323f2088a0225345f4b0587bceae3d276df97f47f95e191b5e2d89940f7f85c785bea06f8da28b47630be872310f3

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
5ce70bb88875139f5707e77ba73ee4a3

SHA1
3bab08f2af373ae452df4390a2c6bdb332cc6ef2

SHA256
53bdb0a1776542cb84b2de506baa56315fc28601968e3028bd9f3eec9b7853ed

SHA512
40ecc273ef9ce2bf10751788ac3e3cee444012e39d34816d7e2090340705f9379d19b81675fb0c8b0515c766efb011aa5a24544896db320d4f2fc3c67c8a73da

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
52bd54a66e4d92a9bbb93fe508d6fa5d

SHA1
9bff5547652e62aed6a13648bef37aeb2ad46937

SHA256
316e8ff7ea785c0c759d22e666280f8f07e8bf9b3367ae5fd7b0268f961f9762

SHA512
b55aace353cca20890d1896e71a76934446c9ce0ef5d72deb593dd0a45d696c65079006dc7dfdce48307071810ddcc5f0eb751783b37d584f276563b1d49f209

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
a4f6e2d1060e07e3a171b0bcb93f474c

SHA1
a4d4ebc45a9da0dfcf898a51da8da90a6e9d3832

SHA256
0af4d96580dcb1ce4ed54b7b95f37da7a1d44e31d9fb2b077657e53cd115f88f

SHA512
dc74e66dfb9d950fcbafdb69116a3fdb19ff1c51b1e17b30deb41977bd9a79b85d8afef54dd1307415f321a40300e5a59ea2561ac44f306bde8c27d89e086494

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
8bf63175ac228d3954a5958f4c39d3a8

SHA1
1654b70274986aa0b01fa8e4c012f0f9c0feb8e8

SHA256
f4dc8c96575de632e1c3b0653f0927034de935d9985cd3320066d70853762bb7

SHA512
58414d6644ca817bc4ac03b8dd451d022047882ef0ac2347c25505b56e47a846da7d6b89842fd92492bb6a4d3a8c2e01fea2c1fec000e593e0182f5376bc34f6

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_da.dll

Filesize
43KB

MD5
483947b51388e26f78606b2c92afabf9

SHA1
e41f5819c0c7dc3961b00c082e1283e1fd27b469

SHA256
b81eeaf7027e376dd620add80feb9f177b7b3e0bcbb9ace13bc2b95d41fce245

SHA512
c1de5164666debdd7a682a7bf53427a802982ca020a8e1dcdc71bcd96d6fb6f4111851069eafb59944c349688245e7c36a70c4a34887a4a3c3ac0585ceb2966b

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_de.dll

Filesize
45KB

MD5
01f5efede1d09cfed0e7432529627a4f

SHA1
c43eda5380ff18d814a5e492e839422bdcd1c712

SHA256
6cfc190dd237726899246e000bfd04a5c214cfeabf3d946c186617b768e29864

SHA512
176446bf6bd5c3b4324b9b3b86a39bad90282e119c762c72eb9f2ee8e6729e9296efbfcd342ab0e173f2d88b411963f45c09bfc92bcb2a29d066fe8a1c4ff039

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_el.dll

Filesize
44KB

MD5
2dfdf558116624d113e7630bdfd8181c

SHA1
d426d6710e090a10639d77cc46910ab031d89d66

SHA256
e3e1c7e90365532533a540c0da3517cf3782e700dd463296eba8342b86f4607c

SHA512
d19cb2bddf7840a7b4f137964ddf8dd3dbf4a6d85a3930bed43ca184d6b7aaec59f3c3c6d73e7dd12643161480e5a853ca77a8bbfe5ad31caf757f61843de5a5

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
5785b0bb1c9cdad72d657abf459ad2f2

SHA1
905cc4f096d4f61569d2b833de884ca6fe60dc69

SHA256
ad082a39b4c3ceef636fb0da49f96d1ecc0a85869c5048f4a324dac77a0b7485

SHA512
1b8b8909f3ef974a5be3c86b497e5fb9e16634110503d96c89690925f0e5898351be59147d43dfa87b4d8c35e88c6ed5fa503de588fe65573e262394ca149b89

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_en.dll

Filesize
42KB

MD5
d5395881631ee10128275bb126b3bced

SHA1
4bab65323b2048f2cc80bc49914c9bf5ad374576

SHA256
0c0f38ce29bd513093f288775e7cd929a8d83085b9f2728cb7593f99b6da569b

SHA512
66bb1300f2a4bc9c5c67bd2028475cc8a4abd30510880476a21f5295b80048017684e6a7f495184fd2fb6e3bebaa014b1f08cce631f83f7b5dcad98de776b3a1

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
711502b7b1f4300418b47237cc7b5295

SHA1
20f8f88a26443056161b6ecb8cef667cb2a120f5

SHA256
a8f407aa643c3883e2acd052000c4c117a82fc94123a34e4543d792fc289aa99

SHA512
ac74bec5eba752cf02930f78d566412b46322debedb7d0ab4543182cdd0f7ef4b2554a70fe8e11fb46bc4894c025d1675b88272db6160233c01b225cb7cc50bb

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_es.dll

Filesize
45KB

MD5
c1f906f2a9c39018ca83731f44f531f2

SHA1
6ce6f9926f820b9e0adc7973a152964c6970717b

SHA256
193de60a3d8ece533256793327257e31476b5836b71b8db3bf459eef978165a9

SHA512
f9a5beb103da0b53d5a91e437a6f99b1aca2075513c944d52ee070d9ccc2120ff6c4c6c540ceb78cddc6f859e5e658f611418b816b8927e8acd9f91fd74dace6

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_et.dll

Filesize
42KB

MD5
7a363140fbab31c456f04d47db0783b4

SHA1
6cc73f835f1b7d9af5b0830b60b57651f484a9b2

SHA256
ad6c3920e76e76c5ff5706db3b54603affbd3c3bdf4407c2405511f7f70fc49f

SHA512
09d6d078ddd443853962c5497b62565d6378637e62e8c6e410c240314f821f13de2c7c9ec864059e06d912d38e9e8657083828e1a9ac731375a3c21f86d9a310

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fa.dll

Filesize
42KB

MD5
c9defa4ef68fe72870bed94920c2171a

SHA1
10cbbf7684fc7656dfcda52d48ef6805a43901e2

SHA256
fd1b44bb5eb0fd06a1bba243a00bc9cf54dcb180f4a7530eb949e0c69dba87fb

SHA512
58ce100bbee6129301a4701b249db9867fd0a208e80e06e54c23a7a9d3773e0f0daff6850d3684d66b619559d2cbd313984a8a26c98413388e808512217d069e

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fi.dll

Filesize
43KB

MD5
8a7356a6a27759ba5714915e5297a4c1

SHA1
e1db02b2d970477ba54f76f82f325bf93737b2b5

SHA256
9cda2b0d996ae8924a52cdd8e456884c274ce5cc1711734cefded6266e2b2e52

SHA512
6d9479de4afb12363cb4b7ef3e08600f186ff30049f36fa85db40b39e4faa4a99e9e705606c2dbd25e24c6b382f90e18c1e5329d104e727a005a296b99aba925

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fil.dll

Filesize
44KB

MD5
659493dee0a32c77d5af707a699f28cb

SHA1
5b302e0154bdd7d15c77256b7d932d3b9ebf859e

SHA256
abebd2240d99dfd85c3abdd0aa8602f825ea4ecb95eb3807deb64a961dd98bcd

SHA512
1de661860d0f896636f6be086ade4a34198e8fbf8ff5947f20edc86e9b8cc5fc2a1dad33429c5b43cf03a7e47d0282d84b5b4c52daa3f1bd35b70bd72a517915

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_fr.dll

Filesize
44KB

MD5
5132b44324880d97d0931d8d1a773302

SHA1
3a0cd971a11f21b692b49b79e845d3f2132eab91

SHA256
ee5aa17f1a1abd08d9019f3a3c6f837087c9f943ba0d4f1331233eb3a5061dd1

SHA512
22ce351473cb381b37b8c2d8a201363d6161fc3b9684d068a8ce5f830a5741387eccbbebb077fcc3b6e9200b77c8199c539e833c9dfdf23102ab8149737e4171

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_gu.dll

Filesize
44KB

MD5
84d618397d84e14cf9c42b5547ea0974

SHA1
a084927b9de73eb033470fa4a354d51443228e86

SHA256
2a344738ad8ff304fc3f586775c4b99c8b8c483e585074f819a073da00379860

SHA512
508f527ea3931f6b018a47b450767d4618950594dc251129438fd81a9dde3e522e7dfc24991e402456d8b54ea97481dcf50097a44efff78f4e73f7b509442d5d

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_hi.dll

Filesize
43KB

MD5
abb885dd0130194143aec6e50fddaa20

SHA1
df8b756c7c8a6dfa81ba4c9416ec8425cac5d1d1

SHA256
c0ed51edb1a97a9dff7d10df711f59e1f086c64fbfa9d441b2c955cfc9238978

SHA512
959523ab8e294206b41f0541e756f6ab84b47d274a183d376dc31200422dc3bb5472974d1ec02341ea7d4b6f664951921c3ef5b74aef747fa3c91c1b9ea6feb8

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_hr.dll

Filesize
43KB

MD5
b4844afa96de3a5b4c50cb5dd99b4d07

SHA1
6f0ddf256964ccc6fdb854f991fd694838fbd6b6

SHA256
d978bc3c336e3b18a1f20c76c25284458d7faf084f2c9d5d5e3c363baf0bcb87

SHA512
8fcac60819c2a4919ffdcc68d6c95117d20bfca78f2e04f9b96ccc899ef82f760ec8fa1a0a40ad966ba282a3ff1cb0bdb00d0add64a3678982887400e15cf226

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_hu.dll

Filesize
43KB

MD5
ea39527496cbb2ea901ef3ed7c5b7db8

SHA1
2e2bcbd80e70c0b8529acba4d2e2923340ce096c

SHA256
a3742fa3d51656ae860df29956eeadc66aaa07530ad9482c319ff8058af6b992

SHA512
d5a2760d1e462942798f6ee84bfde1c21ee919fac97c2c8a372414137f230d3e78910fc74c9d4b7ec02b3a6eebb2d9eccddd14602a2112e77e60793301e19af3

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_id.dll

Filesize
42KB

MD5
9f28c14f2bfe2aee2e85fcae12799e2f

SHA1
e9673e7e8f05c102f7973d28916299698f487020

SHA256
f9d4665e71cd3960fc2967086ffacd7b5e560e8f73575a77ebb2d6dfdb475978

SHA512
b2c2055224779cb655b8a98c47f7c01d5141a9b219c340b8b4b74c1f4079eb321669990f7fbe35a5a2d4292bd14dffce35d48dca2df1c676f2c0851b88d20f05

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_is.dll

Filesize
42KB

MD5
d232f674f32de9b5b9a377c51cd76d3b

SHA1
194b176947b537984e04a937fc8bfd4556fd2610

SHA256
46a460fee8cfbcae13d11b1028ad5bbd59b08fea523fb615cdcf33289f888bc3

SHA512
b06c426f0998a800d7d87230c6be895367c5794573ddaa26fcaaaaa56021550efd5899ae7a1fdc75f5ddebfceeb66d11b4ca4d693bc6e109f706acf995e8da33

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_it.dll

Filesize
44KB

MD5
88051cb09f0e1e77a10d18f71161d8da

SHA1
f19a6cf882f904caae69909a985cf5b5758c413d

SHA256
29fa3ff92d088f6c62c126607bb7e7c0bab9869556a7ff3f2d9a837cfea7542a

SHA512
8905b31841d48ee680fc661ba1492a863f286dff7c6bc639a1b375fc8429baedbd0aa0966bd35bd03558591caa8bd8905d282bc4faf313251f231a2f63b605ea

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_iw.dll

Filesize
40KB

MD5
6f1259ab825c08e120bd836aeb56641b

SHA1
61325432bcc9e27fa78272739dbdf58598069c39

SHA256
021e0bb46a488fbf533aea9524e4dcee6aa391b232c1d9a596cae15c8068e558

SHA512
4482ec58b966df48161fbe2c5e2a66a369119d7147361c9007dfbca4e76e3af5d2594a943866c59e0ec73060638bdbe8aa846f6f7fed8f903ee9d4ab274fd8e5

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ja.dll

Filesize
39KB

MD5
f6cb2087c7f9b5d0256d62dbe9f307ca

SHA1
e2d92a1f0dfc6423bd9938671aadcf291069035e

SHA256
584c56c41f481ddc95fe8186b3977c6426f773388d08586ade0b122e1faf911b

SHA512
28cd743088fd204d02991d2741909c22a878006537d0063e1275a51b2ee4c40189ac168a9055b8a277e1b75ed6cb987624189ff6e53930e01d5d3898def08970

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_kn.dll

Filesize
44KB

MD5
ca3ea74a3a207a757277fc362dc3f3f1

SHA1
58cd916f104280aefc3754bfe0d568fe61ee878b

SHA256
0fc344dea3b1212a6ac7433143be73827c53b58ea8c4056ef48c2b080927312c

SHA512
e2bb722d450a1625533a6d45ca158240afd8c9d73fd167e884a216c575eba29e69f2fdfc67fc830518d2fa8d806fd1194dce65c7adbdf118318edc4ad665ba02

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ko.dll

Filesize
39KB

MD5
947d88587ea69e253a5d2af107a47f88

SHA1
db41bf7d1c6ce3c83495081d7e5c56de7052567e

SHA256
444cef978ff565c0708af15a02bba82d523839e7860095be4448ec2971b7f9df

SHA512
94e13a25ac4ebb0735c784faedc483c15856823125d818dea11949b23baa2ab4b4ddd01149081fd9a4d37082883b4ff5dc27f4d7394c0d450d1b6c159a7e52ac

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_lt.dll

Filesize
42KB

MD5
f0b1889167de8202ef1aa60541792440

SHA1
86ef8d688d6935d64aa6e49c3f079509785ca2dd

SHA256
f0c5180dc8cef1dc6e15024ca311b3e008f82aee8f3df92ada38678473c402eb

SHA512
ccae2f72556e3a8cf990fabe03094f9958745ad39daa1a269a5bd4d7beabae5b5bf49e3352bd92854d0b52d884f5043d32effa18c41473970627a24270a24edd

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_lv.dll

Filesize
43KB

MD5
24a1feb39491ff04289736c34f6a565f

SHA1
bed2bc8bbe10ba44d2bdc237aaafc8f74b346415

SHA256
2c419b62d9b8357a2fa8264a7d5ad289144e33e737849a23efbd77b73ead88b0

SHA512
cd0cffea8dd5d749f0a9e72a52f5c1da618ef2c9eb7d654f18e3c1bce76bd5fa454379291f0558e1869be0f16272011150e1ddda1db314868684573e019b3597

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ml.dll

Filesize
46KB

MD5
0de1995121c1d9857a770285b225daa9

SHA1
add6303079844c5037f1f2c7fcb6f8f8717ccc1a

SHA256
fa063c47545281be9365d33ad59d20a2df559f77a2d9f0b74928929907fa2471

SHA512
6687755edb339de73e6fa7be08af5d33b3bf3daf927574afb1d41f383104d4b098dd3c742f03519cf52d1b76e198e59041c1b63b5a4604016ca2c9b1bf68c156

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_mr.dll

Filesize
44KB

MD5
c127141aeaa2c56225c7d3f174f33a1a

SHA1
cf0dc04a9670e060fcc903df38831212824b095c

SHA256
03f62eb8d772f13e0426699f8717d1e0ef4427067e8dffb38cc8dde994f974b7

SHA512
0886bbdd4498411af7594e9dc7a911321a9685c8bd9634705af2926d979809a9d26d547734b1415b5395d238a249c61753cd75f2b917172bb6ca720c1e5b7db4

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ms.dll

Filesize
42KB

MD5
11ab1a5c1defded79f7d3136243b62ec

SHA1
5e57f434e54445ac66d89d8cdca5c4ee53eb18b7

SHA256
411eae3ec0d9b2bc648a7a68e440bec87dcee0555c5de3a9cc84f2a6df9b8cc9

SHA512
e8c792b634b52ba80f9e4019da7eea3af7d20e3e21d05ed1a689976c02add2acda9be0e4fc0acc41ac8ebd1c608af31d5a9601f51088b16d452c592deeb2c101

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_nl.dll

Filesize
44KB

MD5
9dd8750b300952845e57acfedcd5e9fe

SHA1
6f64c03bd8a585bcac40bbe864706112fbbc2bf6

SHA256
fd1f263de9e4ad7a1826165ac4105b5e593b80f2139b429189bc9c34257bef33

SHA512
16901c84cae1d49f96defa888ea5effcf7472b6f712e99963991039f98f8ee340e8e05d9c9974eca62d0c9fb402cb051ecd7466f6ecd5d88586f9eec808fa5e9

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_no.dll

Filesize
43KB

MD5
bfb458c9ae57a3bca6d022b87a6b8b81

SHA1
691430c52df32c597cd3a57afaeb23fa83fe55b9

SHA256
f4c350013aef814c88e22d6fd3bd9bddb61ec980c6781ef9aa855fe692227298

SHA512
0064b8f472d7151fd2ed629630116fca0f57efb4f557e7ac681f36487901d53c13313822ebad743b88b76506b9afe2de36db3905aa4c6ac53c1caeeb127f57e2

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_pl.dll

Filesize
43KB

MD5
38c160b5a556c1b77e43217b025d13dd

SHA1
bba43bee21e0f1673c8055493694ca238281d004

SHA256
36934e70b1ce1cec2c8aab87dde39267db70d18363328f681800c729cf811989

SHA512
d94399b5a08b6f14cac6edde8b1363e1d032a44cdb14fb7adbd084e385e7d061d02726b2982c74f2c43495c39999cbd03a59b623e572fb4fe37d261595c5d433

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_pt-BR.dll

Filesize
43KB

MD5
d500725b91882bea374de9c94d0a941e

SHA1
2bedc6d0f0530e2d6c707f3eae93ad6729ffd500

SHA256
958add0a9383ab0885de98dc6994ba595c6bdb8847c6d0b11186097830b51b3e

SHA512
a567dd60df33ca9fcb9b68197da94fde1df22ecc20f78dde9e95cdb28166715071621e4642f3499491a58242888d87eec73b2b7ea3bc99f306673c2afc4273a0

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_pt-PT.dll

Filesize
43KB

MD5
3ffab1dfca27fa8cfc3a78c82e8510de

SHA1
c2496c7ce9d3504057bd988fa93a684ff1b7aa9e

SHA256
fccc99a560d022c54053d7caf17a6eb9365352f9ab4aeee683e7db1d9c5e5315

SHA512
200e96e59c171927e357baa3f11affdc04a1a75789e3dd245d16ed9057ac42305edd70a47271dea1377cdc40a528fe5f61251f5c4f73d04afeb94824469828be

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ro.dll

Filesize
43KB

MD5
ee5784087e444c49714d1cf1bc55dc9a

SHA1
3c0005326914230d1ca924b11fc2455b994b04fc

SHA256
ecb96c35d0404cd193c4fa342d3cdcb1d8abafe03b93b53699148706474332c9

SHA512
cbe71fb43e69183e0c57c4a7adb7e72c511daa1a1f211baefaed7c2c94c5283a24e7ffe902245091d4013573d30e67436faa7a21b2570b0be45eedfcfe37be71

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ru.dll

Filesize
42KB

MD5
0d391576c62fb82a79838b60bb1e7914

SHA1
698c7abe78b9653e14fb9d6fb36d0001315f58c8

SHA256
dbcc273c6c548cdb6325e20f20f57fcc5179c70d8450b1bfdd45a3d5687832a1

SHA512
68e83802f32a5e2b6faf63e11786613e4439958040471a76445ac5b45bad330a63f1eb9afcfd233b5a0322a136d0de6a7152ef1aca8e112aefd39ca4de38e274

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sk.dll

Filesize
43KB

MD5
455a46497f85ffc3310feab84741e35d

SHA1
5c75e54ba2a371d8e453c0a054c4eed65cb9375e

SHA256
45aa114d7c88b9152e6649bb2e460e8bcfa5365fbbc5234d07054c1c4abb85fd

SHA512
7aea8659f17208e41750c9e4224e9b27ab2811cfd667f47cd8197755f2e7417ef14e088f423634a35506a3113084d99c00151ef7721b7e23489f83337ecfa3dc

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sl.dll

Filesize
43KB

MD5
9dd0fe75ae88241ff89c58db588a6f1b

SHA1
9d64e5f75af04b7a549b9f57ba15a2ce4adeada9

SHA256
20c639efaf2eeb06abe6e11e652396b53f7c33099d0ab492359c3de371f3e6a6

SHA512
8d161762e4faf8b33383f8b4453c91f6814d54f8d0f22a6a61aed4f3f9638b39008796ca33314d44d675357d6b5a4b1c5c33fd397d83539de41d3d8e38a79332

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sr.dll

Filesize
43KB

MD5
0a83471aabc53ddab2d28fbbc8c05219

SHA1
fc20435ccfd774a93f01535ef206fdb51e2be7fe

SHA256
aacc220026ebb24b106b808f15807bf5881a8f63aa89f2cbf7210fa9b1b3f9a1

SHA512
3d3ad52a66ccf080b452bc264dffa0e2d69cc1b2ce841b27c10ae3c8f376d79c427aac31ad577c87e9dc4c988b31c6fcfb78f32fac74159a94ba92f7e5f30500

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sv.dll

Filesize
43KB

MD5
fbe97478fd4c9aeb8903106eacd56d63

SHA1
d20600ecf529a46e47798c0f1456095eb002c289

SHA256
a4e9901d14f9616b84e0351fc38f93c3eda9062a48a46158a6cc420c1ab09bc7

SHA512
8aa99c3d35a72249e6164ca2ff849c6fec5cce4896768a0e405227d5404d2670aacedab67a30768a94a1611a674ddc3983a60c0ebcc2ef4df2a36fbb270a8c50

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_sw.dll

Filesize
44KB

MD5
1826f808763f47a4db4b7f89d45fe7bd

SHA1
9d397f0cd8463487b55f25bf4ee394a2feeba39c

SHA256
8de71e053dd576425d6699205f81f164443c6e16e05987582993159cec52ef05

SHA512
6dd6d795a39a1d22ad680aeaf13a5f926021065fb304ff01c5bc8d7a861e999d0aa11808792f615b2c6cee1725769c0899c8ac348d1d435e490b3aed3c0a1d09

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_ta.dll

Filesize
45KB

MD5
357710372ab4b49eb527267c6f2dd9a8

SHA1
2a3d6b3e23225c13ffac31f8a24a524bcc161198

SHA256
b553accef9ff55a894f7bef09f9319d3807bcdc888ac8f8b6082b5fa11ac9e9d

SHA512
c2615445484226d915dac72c25fd9403ecb404a14d9536106d7dfe31ce0cb136427060d60f07eb6daefbd86823f5616ad86abafdb7efb731c73a65851f82f2a7

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_te.dll

Filesize
44KB

MD5
701cec31c30c33e2233c52f66c0504ed

SHA1
83151aa7cd3464a647b309197406faa7c9b5eaaa

SHA256
9b09e07195430118df60ebbbde3c441e90aafc4eafd2dd1305bda8c73458e37a

SHA512
1fe5bef35403532abbc53d972250a9a18383bb5ce36e497e5bec53e561ef4e3584fca156f237831b80518409fb936d657af3e5f16a164bbfafeafdb0edee69c6

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_th.dll

Filesize
42KB

MD5
f00fba8f350918a2d591a25425687cc3

SHA1
7e6813c0c4d1c1bc5f88ceb349e64e8d9421bdf3

SHA256
c6c4bf72753b8912a5440ceb50088f1b59c40edfb8eb7ab8dfa9d5559a6734a1

SHA512
041581fc350b228ed9b0044e23621fc332295cbebdad2c766c20ed69756f9fed047e33ac82a3b8ea19ca117e9deecb111fc2724c1264a19a506c10c38020cfb8

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_tr.dll

Filesize
43KB

MD5
c0e07a05b2c62adca9feb82faf182844

SHA1
3506ebe102789d3ee77c6de924a5d3938720d7a7

SHA256
d6f02ae74bd1f9033a8b6bc3235c5e3f5e827fd33db7a0fcddd8c17fac0f3722

SHA512
c36484cb13897d34e97f25c33853fe982d86e0256d8137841223f90a8065841c8074cd83fb6e62b96829c6c107e8cd39a44a770ef717722ec2b9e6b31a9a5072

Download Submit
C:\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\goopdateres_uk.dll

Filesize
43KB

MD5
daaa289daa0a4e70b493b87187e64875

SHA1
6237333ddf81fdd849327de0a0ccbe57121375dc

SHA256
10c040f8709c304e8d2a51016054287cde27846b264380ec276d9354fb3cd721

SHA512
144f2334c1084b9af2501cf6c8bf0c255d182e00bda5197e526afff38bca71a55a8e317b2267c97c6ec00d2e35310a0c2736a55279f4623cd0976d332bbd6ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB780.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB84D.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Windows\Temp\CabB77F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Windows\Temp\CabB84B.tmp

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
\Program Files (x86)\BraveSoftware\Temp\GUMA6FA.tmp\BraveUpdate.exe

Filesize
163KB

MD5
54d8af76152db7febf1b238cf3687b30

SHA1
36e7e0c048f77c75264a8d44a2820ca2cd566526

SHA256
f64438e46ff023c5f088a50d300c4bfff960191f14c6590ca3e21ccc5a178025

SHA512
fad6972be3ec024c0006f7c6d6422c723a47e30e319d825870530e4919f939fb55a7aab314667f0f7c157b9785203cd8014c9a1956afd6a04858b961a435232b

Download Submit
memory/1992-0-0x0000000000400000-0x0000000000648538-memory.dmp

Filesize
2.3MB

Download
memory/1992-674-0x0000000000400000-0x0000000000648538-memory.dmp

Filesize
2.3MB

Download
memory/2880-82-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download