File name:

Wave Browser.exe

Full analysis: https://app.any.run/tasks/6310b169-8329-46d5-9a68-8793f2dd9cc1
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:46:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

6069B6AEF105861C5AC4982946FEE7C1

SHA1:

9BE56ACDDB67C6CA33C009A244DE0266F1AE3477

SHA256:

07655313AA7FE9697A2365602CD14C14008DECCD4837E49E8FFFED5F1A4C1A7F

SSDEEP:

49152:v2o3U1o477Q7gb3tUaYcPE6+hTXALAz15A7eA5x/O6X0IknHD6WI3cuGBmcW6KJ5:JE1o47XbdUaj+hTXt15sBxXXyDs3ctm/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SWUpdater.exe (PID: 8108)

    • Actions looks like stealing of personal data

      • wavebrowser.exe (PID: 7708)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Wave Browser.exe (PID: 7488)
      • SWUpdater.exe (PID: 8108)
      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • SWUpdater.exe (PID: 7380)

    • Executable content was dropped or overwritten

      • Wave Browser.exe (PID: 7488)
      • SWUpdaterSetup.exe (PID: 8088)
      • SWUpdater.exe (PID: 8108)
      • WaveInstaller-v1.5.21.2.exe (PID: 3888)
      • setup.exe (PID: 2088)
      • wavebrowser.exe (PID: 9416)

    • Reads the date of Windows installation

      • Wave Browser.exe (PID: 7488)
      • setup.exe (PID: 2960)

    • Creates/Modifies COM task schedule object

      • SWUpdater.exe (PID: 8140)
      • SWUpdaterComRegisterShell64.exe (PID: 8168)
      • SWUpdaterComRegisterShell64.exe (PID: 4688)
      • SWUpdaterComRegisterShell64.exe (PID: 7292)

    • Starts itself from another location

      • SWUpdater.exe (PID: 8108)

    • There is functionality for taking screenshot (YARA)

      • SWUpdater.exe (PID: 8108)
      • SWUpdater.exe (PID: 7268)
      • SWUpdater.exe (PID: 7380)

    • Creates a software uninstall entry

      • setup.exe (PID: 2088)

    • Searches for installed software

      • setup.exe (PID: 2088)

    • Application launched itself

      • setup.exe (PID: 2960)
      • setup.exe (PID: 2088)
      • SWUpdater.exe (PID: 7380)
      • wavebrowser.exe (PID: 7708)

    • The process checks if it is being run in the virtual environment

      • wavebrowser.exe (PID: 7708)

  • INFO

    • Reads the computer name

      • Wave Browser.exe (PID: 7488)
      • SWUpdater.exe (PID: 8108)
      • SWUpdater.exe (PID: 8140)
      • SWUpdater.exe (PID: 4300)
      • SWUpdater.exe (PID: 7268)
      • SWUpdater.exe (PID: 7380)
      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • wavebrowser.exe (PID: 7708)
      • SWUpdater.exe (PID: 7888)
      • wavebrowser.exe (PID: 1328)
      • wavebrowser.exe (PID: 5984)
      • wavebrowser.exe (PID: 5324)
      • wavebrowser.exe (PID: 6004)
      • wavebrowser.exe (PID: 2644)
      • wavebrowser.exe (PID: 3192)

    • Disables trace logs

      • Wave Browser.exe (PID: 7488)

    • Checks supported languages

      • Wave Browser.exe (PID: 7488)
      • SWUpdaterSetup.exe (PID: 8088)
      • SWUpdaterComRegisterShell64.exe (PID: 4688)
      • SWUpdater.exe (PID: 8140)
      • SWUpdaterComRegisterShell64.exe (PID: 8168)
      • SWUpdaterComRegisterShell64.exe (PID: 7292)
      • SWUpdater.exe (PID: 4300)
      • SWUpdater.exe (PID: 8108)
      • SWUpdater.exe (PID: 7268)
      • SWUpdater.exe (PID: 7380)
      • WaveInstaller-v1.5.21.2.exe (PID: 3888)
      • setup.exe (PID: 7188)
      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • setup.exe (PID: 7516)
      • wavebrowser.exe (PID: 7708)
      • wavebrowser.exe (PID: 7828)
      • SWUpdater.exe (PID: 7888)
      • wavebrowser.exe (PID: 5984)
      • wavebrowser.exe (PID: 1328)
      • wavebrowser.exe (PID: 5324)
      • wavebrowser.exe (PID: 8032)
      • wavebrowser.exe (PID: 6436)
      • wavebrowser.exe (PID: 6268)
      • wavebrowser.exe (PID: 2644)
      • wavebrowser.exe (PID: 4300)
      • wavebrowser.exe (PID: 6004)
      • wavebrowser.exe (PID: 1616)
      • wavebrowser.exe (PID: 6940)
      • wavebrowser.exe (PID: 2236)
      • wavebrowser.exe (PID: 6272)
      • wavebrowser.exe (PID: 4152)
      • wavebrowser.exe (PID: 1852)
      • wavebrowser.exe (PID: 2100)
      • wavebrowser.exe (PID: 7408)
      • wavebrowser.exe (PID: 6828)
      • wavebrowser.exe (PID: 7388)
      • wavebrowser.exe (PID: 7788)
      • wavebrowser.exe (PID: 7584)
      • wavebrowser.exe (PID: 7380)
      • wavebrowser.exe (PID: 7800)
      • wavebrowser.exe (PID: 6248)
      • wavebrowser.exe (PID: 7588)
      • wavebrowser.exe (PID: 2340)
      • wavebrowser.exe (PID: 6632)
      • wavebrowser.exe (PID: 6252)
      • wavebrowser.exe (PID: 7232)
      • wavebrowser.exe (PID: 7504)
      • wavebrowser.exe (PID: 7332)
      • wavebrowser.exe (PID: 960)
      • wavebrowser.exe (PID: 4008)
      • wavebrowser.exe (PID: 4056)
      • wavebrowser.exe (PID: 5576)
      • wavebrowser.exe (PID: 3192)
      • wavebrowser.exe (PID: 1600)
      • wavebrowser.exe (PID: 8188)
      • wavebrowser.exe (PID: 6480)
      • wavebrowser.exe (PID: 5380)
      • wavebrowser.exe (PID: 7360)
      • wavebrowser.exe (PID: 2656)
      • wavebrowser.exe (PID: 3268)
      • wavebrowser.exe (PID: 8084)
      • wavebrowser.exe (PID: 8392)
      • wavebrowser.exe (PID: 8320)
      • wavebrowser.exe (PID: 8352)
      • wavebrowser.exe (PID: 8344)
      • wavebrowser.exe (PID: 8368)
      • wavebrowser.exe (PID: 8384)
      • wavebrowser.exe (PID: 8376)
      • wavebrowser.exe (PID: 8360)
      • wavebrowser.exe (PID: 8720)
      • wavebrowser.exe (PID: 8552)
      • wavebrowser.exe (PID: 8400)
      • wavebrowser.exe (PID: 8852)
      • wavebrowser.exe (PID: 6416)
      • wavebrowser.exe (PID: 2908)
      • wavebrowser.exe (PID: 1164)
      • wavebrowser.exe (PID: 4728)
      • wavebrowser.exe (PID: 3300)
      • wavebrowser.exe (PID: 8328)
      • wavebrowser.exe (PID: 8336)
      • wavebrowser.exe (PID: 8892)
      • wavebrowser.exe (PID: 8932)

    • Checks proxy server information

      • Wave Browser.exe (PID: 7488)
      • SWUpdater.exe (PID: 7380)
      • SWUpdater.exe (PID: 4300)
      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • SWUpdater.exe (PID: 7888)
      • wavebrowser.exe (PID: 7708)

    • Reads the machine GUID from the registry

      • Wave Browser.exe (PID: 7488)
      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • wavebrowser.exe (PID: 7708)

    • Reads Environment values

      • Wave Browser.exe (PID: 7488)

    • Reads the software policy settings

      • Wave Browser.exe (PID: 7488)
      • SWUpdater.exe (PID: 4300)
      • SWUpdater.exe (PID: 7380)
      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • SWUpdater.exe (PID: 7888)
      • slui.exe (PID: 7628)

    • Create files in a temporary directory

      • Wave Browser.exe (PID: 7488)
      • SWUpdaterSetup.exe (PID: 8088)
      • svchost.exe (PID: 4776)
      • SWUpdater.exe (PID: 7380)
      • WaveInstaller-v1.5.21.2.exe (PID: 3888)
      • setup.exe (PID: 2088)
      • wavebrowser.exe (PID: 7708)
      • wavebrowser.exe (PID: 5324)

    • The sample compiled with english language support

      • Wave Browser.exe (PID: 7488)
      • SWUpdaterSetup.exe (PID: 8088)
      • SWUpdater.exe (PID: 8108)
      • WaveInstaller-v1.5.21.2.exe (PID: 3888)
      • setup.exe (PID: 2088)

    • Process checks computer location settings

      • Wave Browser.exe (PID: 7488)
      • SWUpdater.exe (PID: 8108)
      • SWUpdater.exe (PID: 7380)
      • wavebrowser.exe (PID: 7708)
      • wavebrowser.exe (PID: 6436)
      • wavebrowser.exe (PID: 6268)
      • wavebrowser.exe (PID: 5324)
      • wavebrowser.exe (PID: 1852)
      • wavebrowser.exe (PID: 1616)
      • wavebrowser.exe (PID: 6940)
      • wavebrowser.exe (PID: 4152)
      • wavebrowser.exe (PID: 2236)
      • wavebrowser.exe (PID: 6252)
      • wavebrowser.exe (PID: 6828)
      • wavebrowser.exe (PID: 7788)
      • wavebrowser.exe (PID: 7332)
      • wavebrowser.exe (PID: 7232)
      • wavebrowser.exe (PID: 6272)
      • wavebrowser.exe (PID: 7504)
      • wavebrowser.exe (PID: 4008)

    • Wave updater related mutex has been found

      • SWUpdater.exe (PID: 8108)
      • SWUpdater.exe (PID: 8140)
      • SWUpdater.exe (PID: 4300)
      • SWUpdater.exe (PID: 7380)
      • SWUpdater.exe (PID: 7888)

    • Creates files or folders in the user directory

      • setup.exe (PID: 2088)
      • setup.exe (PID: 2960)
      • wavebrowser.exe (PID: 7828)
      • wavebrowser.exe (PID: 7708)
      • wavebrowser.exe (PID: 5984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2078:11:07 22:39:56+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 1450496
InitializedDataSize: 180736
UninitializedDataSize: -
EntryPoint: 0x1640b2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.21.2
ProductVersionNumber: 1.5.21.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WaveBrowser
CompanyName: Wavesor Software
FileDescription: WaveBrowser
FileVersion: 1.5.21.2
InternalName: Wave Browser.exe
LegalCopyright: Copyright 2025 Wavesor Software. All rights reserved.
LegalTrademarks: -
OriginalFileName: Wave Browser.exe
ProductName: WaveBrowser
ProductVersion: 1.5.21.2
AssemblyVersion: 1.5.21.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
306
Monitored processes
168
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wave browser.exe sppextcomobj.exe no specs slui.exe swupdatersetup.exe swupdater.exe swupdater.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdater.exe swupdater.exe no specs swupdater.exe svchost.exe waveinstaller-v1.5.21.2.exe setup.exe setup.exe no specs setup.exe setup.exe no specs wavebrowser.exe wavebrowser.exe no specs swupdater.exe wavebrowser.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs slui.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=117 --field-trial-handle=5676,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5456 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
776"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=8920,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11316 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
920"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=113 --field-trial-handle=11728,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9444 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
960"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=7820,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7936 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
968"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=8108,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6700 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1020"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=122 --field-trial-handle=7272,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9324 /prefetch:2C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1164"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=7300,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8812 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1328"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2008,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=1996 /prefetch:2C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1452"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=7604,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8512 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1600"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=7596,i,16842321633189117537,617100976428992011,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7664 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
Total events
19 523
Read events
17 971
Write events
1 479
Delete events
73

Modification events

(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7488) Wave Browser.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Wave Browser_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
55
Suspicious files
1 798
Text files
722
Unknown types
5

Dropped files

PID
Process
Filename
Type
8088SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUMEBE8.tmp\swupdater.dllexecutable
MD5:F8D2134C1DB5B9110C869C6D093F2C12
SHA256:E60ECF8A974A7210DF2F1EA06E1B19CD3DCF5CAC6024C2B1CEF509AA6AF4F1D2
8088SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUMEBE8.tmp\psuser_64.dllexecutable
MD5:7A7549EDA44453563FA88D594E8C8200
SHA256:9947C3A4ADE9EBA68E6818E2031463691F1BFA614ECBB125BF6E8813DD1975A9
8108SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdater.exeexecutable
MD5:6DC889107D15512BD4A8F544F96B751A
SHA256:0F990FA4CC71C1954B300D2B56CEF02D1C0D3CD33FB4981B02D64F6488A51CE9
8108SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exeexecutable
MD5:0B66C4A341A2DE0525C4EA3203934629
SHA256:3452CF4B6419BC78C4B59FB907761AA4FBE2B13EDF354194BF571AB2404B8B7C
8108SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\1.3.139.0\swupdaterres_en.dllexecutable
MD5:24BF0CF8079B5F1A4C414601AA5C6CEB
SHA256:68BA308AE44DDB13170C78E63CF4618EC9131957B7498A2726B007C1858154E3
8108SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\1.3.139.0\swupdater.dllexecutable
MD5:F8D2134C1DB5B9110C869C6D093F2C12
SHA256:E60ECF8A974A7210DF2F1EA06E1B19CD3DCF5CAC6024C2B1CEF509AA6AF4F1D2
8088SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUMEBE8.tmp\swupdaterres_en.dllexecutable
MD5:24BF0CF8079B5F1A4C414601AA5C6CEB
SHA256:68BA308AE44DDB13170C78E63CF4618EC9131957B7498A2726B007C1858154E3
8088SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUMEBE8.tmp\psuser.dllexecutable
MD5:5CEFB5492D456649CC9BC29D2ECDD839
SHA256:A6E43374BEBACA7D8559057D82FCEB68CCBD11AEC45F7B1F4F7B3CD117E1E5FE
4776svchost.exeC:\Users\admin\AppData\Local\Temp\BITF5BC.tmp —
MD5:—
SHA256:—
4776svchost.exeC:\Users\admin\AppData\Local\Temp\{007F7F6F-2717-4D88-A034-CBFE67528F0A}-WaveInstaller-v1.5.21.2.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
586
DNS requests
967
Threats
511

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6744
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2088
setup.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6744
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2088
setup.exe
GET
200
18.173.208.27:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAdC4QyEgUNnqtiNTeKlhaI%3D
unknown
—
—
whitelisted
4776
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4776
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7488
Wave Browser.exe
54.144.90.228:443
api.wavebrowserbase.com
AMAZON-AES
US
suspicious
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.16.142
whitelisted
api.wavebrowserbase.com
  • 54.144.90.228
  • 44.220.125.252
  • 34.198.33.118
  • 52.21.23.174
  • 54.221.228.202
  • 52.201.186.180
unknown
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.132
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.160.4
  • 40.126.32.134
  • 20.190.160.66
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
swupdater.com
  • 54.87.74.53
  • 3.222.197.228
unknown
cdn.swupdater.com
  • 18.245.86.84
  • 18.245.86.68
  • 18.245.86.129
  • 18.245.86.19
unknown

Threats

PID
Process
Class
Message
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5984
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Wave Browser.exe