File name:

Wave Browser.zip

Full analysis: https://app.any.run/tasks/16a617ad-d0f6-4835-bc66-5b00affc96e3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 25, 2025, 23:41:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

3162D7A85242CEBD990EBB3C426CFE64

SHA1:

C343FB80EE443567FB68A5761C13B233465759F5

SHA256:

2F91246FB02DD36951C46238E6160ADDD9BB2A0E56398C2C1F6A1E9E1432DBD6

SSDEEP:

49152:6usb0X5zvoa5dTjOxSrtM1ezDZg/5z6i5ZhJ7bLoYtEQP3hRX0I0nHDqW43ZuGB4:6u3Nvoaj6ktM1Yg/5z6whJ/LGQPXiDEI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 512)

    • Changes the autorun value in the registry

      • SWUpdater.exe (PID: 5620)

    • Actions looks like stealing of personal data

      • wavebrowser.exe (PID: 4032)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Wave Browser.exe (PID: 5884)
      • SWUpdater.exe (PID: 5620)
      • setup.exe (PID: 3948)
      • Wave Browser.exe (PID: 1964)
      • setup.exe (PID: 5348)
      • SWUpdater.exe (PID: 1244)
      • SWUpdaterCore.exe (PID: 9000)

    • Reads the date of Windows installation

      • Wave Browser.exe (PID: 5884)
      • setup.exe (PID: 5348)

    • Executable content was dropped or overwritten

      • SWUpdaterSetup.exe (PID: 1932)
      • SWUpdater.exe (PID: 5620)
      • WaveInstaller-v1.5.21.7.exe (PID: 6504)
      • setup.exe (PID: 3948)
      • Wave Browser.exe (PID: 5884)

    • Starts itself from another location

      • SWUpdater.exe (PID: 5620)

    • Creates/Modifies COM task schedule object

      • SWUpdaterComRegisterShell64.exe (PID: 3400)
      • SWUpdaterComRegisterShell64.exe (PID: 5780)
      • SWUpdater.exe (PID: 5576)
      • SWUpdaterComRegisterShell64.exe (PID: 3092)

    • Application launched itself

      • setup.exe (PID: 3948)
      • setup.exe (PID: 5348)
      • wavebrowser.exe (PID: 4032)
      • SWUpdater.exe (PID: 1244)
      • SWUpdater.exe (PID: 9036)

    • Searches for installed software

      • setup.exe (PID: 3948)

    • Creates a software uninstall entry

      • setup.exe (PID: 3948)

    • There is functionality for taking screenshot (YARA)

      • Wave Browser.exe (PID: 5884)

    • The process checks if it is being run in the virtual environment

      • wavebrowser.exe (PID: 4032)

  • INFO

    • Manual execution by a user

      • Wave Browser.exe (PID: 5884)
      • Wave Browser.exe (PID: 1964)
      • SWUpdaterCore.exe (PID: 9000)
      • SWUpdaterBroker.exe (PID: 8752)
      • SWUpdater.exe (PID: 8652)
      • SWUpdaterComRegisterShell64.exe (PID: 8712)

    • Reads the computer name

      • Wave Browser.exe (PID: 5884)
      • Wave Browser.exe (PID: 1964)
      • SWUpdater.exe (PID: 5620)
      • SWUpdater.exe (PID: 5576)
      • SWUpdater.exe (PID: 6236)
      • SWUpdater.exe (PID: 1216)
      • SWUpdater.exe (PID: 1244)
      • setup.exe (PID: 3948)
      • setup.exe (PID: 5348)
      • wavebrowser.exe (PID: 4032)
      • SWUpdater.exe (PID: 6004)
      • wavebrowser.exe (PID: 2188)
      • wavebrowser.exe (PID: 2980)
      • wavebrowser.exe (PID: 1212)
      • wavebrowser.exe (PID: 5576)
      • wavebrowser.exe (PID: 1852)
      • wavebrowser.exe (PID: 7976)
      • SWUpdaterCore.exe (PID: 9000)
      • SWUpdater.exe (PID: 9036)
      • SWUpdater.exe (PID: 9076)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 512)

    • Reads the machine GUID from the registry

      • Wave Browser.exe (PID: 5884)
      • setup.exe (PID: 3948)
      • Wave Browser.exe (PID: 1964)
      • wavebrowser.exe (PID: 4032)
      • setup.exe (PID: 5348)

    • Checks supported languages

      • Wave Browser.exe (PID: 5884)
      • Wave Browser.exe (PID: 1964)
      • SWUpdater.exe (PID: 5620)
      • SWUpdaterSetup.exe (PID: 1932)
      • SWUpdater.exe (PID: 5576)
      • SWUpdaterComRegisterShell64.exe (PID: 3400)
      • SWUpdaterComRegisterShell64.exe (PID: 5780)
      • SWUpdaterComRegisterShell64.exe (PID: 3092)
      • SWUpdater.exe (PID: 6236)
      • SWUpdater.exe (PID: 1216)
      • SWUpdater.exe (PID: 1244)
      • WaveInstaller-v1.5.21.7.exe (PID: 6504)
      • setup.exe (PID: 3948)
      • setup.exe (PID: 5528)
      • setup.exe (PID: 5348)
      • setup.exe (PID: 5240)
      • wavebrowser.exe (PID: 4032)
      • wavebrowser.exe (PID: 6240)
      • SWUpdater.exe (PID: 6004)
      • wavebrowser.exe (PID: 2980)
      • wavebrowser.exe (PID: 2188)
      • wavebrowser.exe (PID: 5372)
      • wavebrowser.exe (PID: 5564)
      • wavebrowser.exe (PID: 1212)
      • wavebrowser.exe (PID: 5368)
      • wavebrowser.exe (PID: 2356)
      • wavebrowser.exe (PID: 2384)
      • wavebrowser.exe (PID: 1852)
      • wavebrowser.exe (PID: 3688)
      • wavebrowser.exe (PID: 1352)
      • wavebrowser.exe (PID: 5576)
      • wavebrowser.exe (PID: 1036)
      • wavebrowser.exe (PID: 7280)
      • wavebrowser.exe (PID: 4036)
      • wavebrowser.exe (PID: 1828)
      • wavebrowser.exe (PID: 6900)
      • wavebrowser.exe (PID: 7820)
      • wavebrowser.exe (PID: 3636)
      • wavebrowser.exe (PID: 7880)
      • wavebrowser.exe (PID: 7288)
      • wavebrowser.exe (PID: 4528)
      • wavebrowser.exe (PID: 4984)
      • wavebrowser.exe (PID: 7960)
      • wavebrowser.exe (PID: 7952)
      • wavebrowser.exe (PID: 8080)
      • wavebrowser.exe (PID: 8120)
      • wavebrowser.exe (PID: 7368)
      • wavebrowser.exe (PID: 8128)
      • wavebrowser.exe (PID: 8116)
      • wavebrowser.exe (PID: 8144)
      • wavebrowser.exe (PID: 7976)
      • wavebrowser.exe (PID: 7284)
      • wavebrowser.exe (PID: 2504)
      • wavebrowser.exe (PID: 1212)
      • wavebrowser.exe (PID: 6668)
      • wavebrowser.exe (PID: 8156)
      • wavebrowser.exe (PID: 8160)
      • wavebrowser.exe (PID: 7940)
      • wavebrowser.exe (PID: 8164)
      • wavebrowser.exe (PID: 8116)
      • wavebrowser.exe (PID: 7356)
      • wavebrowser.exe (PID: 8132)
      • wavebrowser.exe (PID: 3572)
      • wavebrowser.exe (PID: 1604)
      • wavebrowser.exe (PID: 8148)
      • wavebrowser.exe (PID: 5368)
      • wavebrowser.exe (PID: 2280)
      • wavebrowser.exe (PID: 7332)
      • wavebrowser.exe (PID: 8172)
      • wavebrowser.exe (PID: 7336)
      • wavebrowser.exe (PID: 8240)
      • wavebrowser.exe (PID: 8232)
      • wavebrowser.exe (PID: 8260)
      • wavebrowser.exe (PID: 8220)
      • wavebrowser.exe (PID: 8272)
      • wavebrowser.exe (PID: 7184)
      • wavebrowser.exe (PID: 7384)
      • wavebrowser.exe (PID: 8756)
      • wavebrowser.exe (PID: 8800)
      • wavebrowser.exe (PID: 8644)
      • wavebrowser.exe (PID: 8740)
      • wavebrowser.exe (PID: 8748)
      • SWUpdater.exe (PID: 9036)
      • SWUpdaterCore.exe (PID: 9000)
      • wavebrowser.exe (PID: 8960)
      • wavebrowser.exe (PID: 8248)
      • wavebrowser.exe (PID: 8624)
      • wavebrowser.exe (PID: 8632)
      • wavebrowser.exe (PID: 8828)
      • wavebrowser.exe (PID: 8872)
      • wavebrowser.exe (PID: 9116)
      • wavebrowser.exe (PID: 9108)
      • wavebrowser.exe (PID: 9148)
      • wavebrowser.exe (PID: 9092)
      • wavebrowser.exe (PID: 9140)
      • wavebrowser.exe (PID: 3736)
      • wavebrowser.exe (PID: 7348)
      • wavebrowser.exe (PID: 7260)
      • wavebrowser.exe (PID: 9124)
      • wavebrowser.exe (PID: 1852)
      • wavebrowser.exe (PID: 9164)
      • SWUpdater.exe (PID: 9076)
      • wavebrowser.exe (PID: 9084)
      • wavebrowser.exe (PID: 9132)
      • wavebrowser.exe (PID: 8456)
      • wavebrowser.exe (PID: 9100)
      • wavebrowser.exe (PID: 8696)
      • SWUpdaterBroker.exe (PID: 8752)
      • wavebrowser.exe (PID: 8996)
      • SWUpdaterComRegisterShell64.exe (PID: 8712)
      • SWUpdater.exe (PID: 8652)
      • wavebrowser.exe (PID: 8988)
      • wavebrowser.exe (PID: 5780)
      • wavebrowser.exe (PID: 8888)
      • wavebrowser.exe (PID: 8256)

    • Disables trace logs

      • Wave Browser.exe (PID: 5884)

    • Checks proxy server information

      • Wave Browser.exe (PID: 5884)
      • SWUpdater.exe (PID: 6236)
      • SWUpdater.exe (PID: 1244)
      • setup.exe (PID: 3948)
      • setup.exe (PID: 5348)
      • SWUpdater.exe (PID: 6004)
      • wavebrowser.exe (PID: 4032)
      • SWUpdater.exe (PID: 9076)
      • slui.exe (PID: 6364)

    • Reads Environment values

      • Wave Browser.exe (PID: 5884)

    • Reads the software policy settings

      • Wave Browser.exe (PID: 5884)
      • SWUpdater.exe (PID: 6236)
      • SWUpdater.exe (PID: 1244)
      • setup.exe (PID: 3948)
      • SWUpdater.exe (PID: 6004)
      • setup.exe (PID: 5348)
      • slui.exe (PID: 6364)

    • Process checks computer location settings

      • Wave Browser.exe (PID: 5884)
      • SWUpdater.exe (PID: 5620)
      • SWUpdater.exe (PID: 1244)
      • wavebrowser.exe (PID: 4032)
      • wavebrowser.exe (PID: 5564)
      • wavebrowser.exe (PID: 1212)
      • wavebrowser.exe (PID: 2356)
      • wavebrowser.exe (PID: 2384)
      • wavebrowser.exe (PID: 3688)
      • wavebrowser.exe (PID: 4528)
      • wavebrowser.exe (PID: 1036)
      • wavebrowser.exe (PID: 4036)
      • wavebrowser.exe (PID: 1828)
      • wavebrowser.exe (PID: 4984)
      • wavebrowser.exe (PID: 3636)
      • wavebrowser.exe (PID: 6900)
      • wavebrowser.exe (PID: 7820)
      • wavebrowser.exe (PID: 1352)
      • wavebrowser.exe (PID: 7880)
      • wavebrowser.exe (PID: 7940)
      • SWUpdaterCore.exe (PID: 9000)
      • wavebrowser.exe (PID: 9108)
      • wavebrowser.exe (PID: 9092)
      • wavebrowser.exe (PID: 9140)
      • wavebrowser.exe (PID: 9148)
      • wavebrowser.exe (PID: 9116)
      • wavebrowser.exe (PID: 3736)
      • wavebrowser.exe (PID: 9124)
      • wavebrowser.exe (PID: 1852)
      • wavebrowser.exe (PID: 9132)
      • wavebrowser.exe (PID: 9084)
      • wavebrowser.exe (PID: 8456)
      • wavebrowser.exe (PID: 9164)
      • wavebrowser.exe (PID: 9100)
      • wavebrowser.exe (PID: 7260)
      • wavebrowser.exe (PID: 8996)
      • wavebrowser.exe (PID: 8988)
      • wavebrowser.exe (PID: 8256)

    • The sample compiled with english language support

      • SWUpdaterSetup.exe (PID: 1932)
      • SWUpdater.exe (PID: 5620)
      • WaveInstaller-v1.5.21.7.exe (PID: 6504)
      • setup.exe (PID: 3948)
      • Wave Browser.exe (PID: 5884)

    • Create files in a temporary directory

      • SWUpdaterSetup.exe (PID: 1932)
      • svchost.exe (PID: 2140)
      • SWUpdater.exe (PID: 1244)
      • WaveInstaller-v1.5.21.7.exe (PID: 6504)
      • setup.exe (PID: 3948)
      • Wave Browser.exe (PID: 5884)
      • wavebrowser.exe (PID: 4032)
      • wavebrowser.exe (PID: 1212)

    • Launching a file from a Registry key

      • SWUpdater.exe (PID: 5620)

    • Wave updater related mutex has been found

      • SWUpdater.exe (PID: 5620)
      • SWUpdater.exe (PID: 5576)
      • SWUpdater.exe (PID: 6236)
      • SWUpdater.exe (PID: 1244)
      • SWUpdater.exe (PID: 6004)
      • SWUpdater.exe (PID: 9036)
      • SWUpdater.exe (PID: 9076)

    • Creates files or folders in the user directory

      • setup.exe (PID: 3948)
      • setup.exe (PID: 5348)
      • wavebrowser.exe (PID: 6240)
      • wavebrowser.exe (PID: 4032)
      • wavebrowser.exe (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2025:07:25 16:34:18
ZipCRC: 0x22337cd1
ZipCompressedSize: 1263100
ZipUncompressedSize: 1642792
ZipFileName: Wave Browser.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
258
Monitored processes
119
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe wave browser.exe wave browser.exe no specs swupdatersetup.exe swupdater.exe swupdater.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdater.exe swupdater.exe no specs swupdater.exe svchost.exe waveinstaller-v1.5.21.7.exe setup.exe setup.exe no specs slui.exe setup.exe setup.exe no specs wavebrowser.exe wavebrowser.exe no specs swupdater.exe wavebrowser.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs swupdatercore.exe no specs swupdater.exe no specs swupdater.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs swupdaterbroker.exe no specs swupdatercomregistershell64.exe no specs swupdater.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
512"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Wave Browser.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1036"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4728,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5676 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1212"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=3932,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3948 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1212"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=7468,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7960 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1216"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{722CF951-B138-4197-A965-3E6ACF17D358}"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe—SWUpdater.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
Wavesor SWUpdater
Exit code:
0
Version:
1.3.139.0
Modules
Images
c:\users\admin\wavesor software\swupdater\swupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1244"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe" -EmbeddingC:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe
svchost.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
Wavesor SWUpdater
Exit code:
0
Version:
1.3.139.0
Modules
Images
c:\users\admin\wavesor software\swupdater\swupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1352"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4976,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5008 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1604"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=6728,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9096 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1828"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4744,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5144 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1852"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=4780,i,16445980996854936333,18241855182017940318,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4956 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
WaveBrowser
Exit code:
0
Version:
1.5.21.7
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.21.7\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
Total events
19 474
Read events
18 491
Write events
899
Delete events
84

Modification events

(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Wave Browser.zip
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
37
Suspicious files
664
Text files
496
Unknown types
0

Dropped files

PID
Process
Filename
Type
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\SWUpdaterOnDemand.exeexecutable
MD5:CBC3F8783D640E261136A75530E30C25
SHA256:CA4AB0A584CB97ECA35848ACE35FBB918E811DBD7CD046C60200E22799428935
512WinRAR.exeC:\Users\admin\Desktop\Wave Browser.exeexecutable
MD5:6069B6AEF105861C5AC4982946FEE7C1
SHA256:07655313AA7FE9697A2365602CD14C14008DECCD4837E49E8FFFED5F1A4C1A7F
5884Wave Browser.exeC:\Users\admin\AppData\Local\Temp\Wave\SWUpdaterSetup.exeexecutable
MD5:5813F14260ADB068F4B289003DC97FEF
SHA256:0F7C252831041C590B60F1CA997750C58A8F10A1B1AA8A7B4AD8CE844C7E413F
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\swupdater.dllexecutable
MD5:F8D2134C1DB5B9110C869C6D093F2C12
SHA256:E60ECF8A974A7210DF2F1EA06E1B19CD3DCF5CAC6024C2B1CEF509AA6AF4F1D2
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\SWUpdaterBroker.exeexecutable
MD5:AA476B0F86AA1DED20A69B8F70FD6688
SHA256:7F0CF244AE86A32FD9296FF8AE4EBAB2E44663AD90C9F5BEC8BE8E94B51B4FDB
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\psmachine.dllexecutable
MD5:E7FFAB130261A1653EF4604AA5C3CB4B
SHA256:745621681B9A699549A71A1903806DB9B46ACE2A01FFFF70BE8123F2EC749766
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\SWUpdaterComRegisterShell64.exeexecutable
MD5:0B66C4A341A2DE0525C4EA3203934629
SHA256:3452CF4B6419BC78C4B59FB907761AA4FBE2B13EDF354194BF571AB2404B8B7C
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\psmachine_64.dllexecutable
MD5:C7FD940E573D9C0EDC302F52BC5A9CFA
SHA256:2BB6080168A52AF06098AAD299C4B79FFDB8DE7349D49DCF816C73A0C11E4644
1932SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM4617.tmp\SWUpdater.exeexecutable
MD5:6DC889107D15512BD4A8F544F96B751A
SHA256:0F990FA4CC71C1954B300D2B56CEF02D1C0D3CD33FB4981B02D64F6488A51CE9
2140svchost.exeC:\Users\admin\AppData\Local\Temp\BIT4ED2.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
230
DNS requests
262
Threats
300

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
1268
svchost.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
2032
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
2032
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
420 b
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
DE
binary
734 b
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
312 b
whitelisted
3948
setup.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
US
binary
1.40 Kb
whitelisted
3948
setup.exe
GET
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAzNhCMvqqerLFbI47OQv1Q%3D
US
binary
471 b
whitelisted
5708
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1040
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5708
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5708
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
52.191.219.104:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1268
svchost.exe
23.55.110.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.3.109.244:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 52.191.219.104
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.238
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.2
  • 20.190.159.131
  • 20.190.159.71
  • 40.126.31.130
  • 20.190.159.68
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
whitelisted
www.microsoft.com
  • 23.3.109.244
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
api.wavebrowserbase.com
  • 50.16.115.74
  • 52.86.170.115
  • 44.199.114.27
  • 52.206.73.161
  • 54.243.251.241
  • 52.44.94.29
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2980
wavebrowser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Wave Browser.zip