File name:

4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe

Full analysis: https://app.any.run/tasks/ba0a088b-c1f0-40c9-ba2d-18366c78c454
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 01, 2024, 17:56:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1684AAB6FAE1ED888CF6D3C45E3F5FA7

SHA1:

6ACC87B81836575BF7B497F0E8A9A23A221F06B7

SHA256:

4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB

SSDEEP:

49152:Go3U1o4h7d7esHiVe4aSw/017+zQnWGTvjpu0+IggeNo+yC0/gODj7RgldaaY99P:BE1o4hl8VefSwsJ+zQnJF+zm+yzgqj1t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdaterSetup.exe (PID: 7112)
      • SWUpdater.exe (PID: 2228)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)

    • Changes the autorun value in the registry

      • SWUpdater.exe (PID: 2228)

    • Scans artifacts that could help determine the target

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)

    • Actions looks like stealing of personal data

      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 888)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 5292)

    • Reads the date of Windows installation

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 5292)

    • Executable content was dropped or overwritten

      • SWUpdater.exe (PID: 2228)
      • SWUpdaterSetup.exe (PID: 7112)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • setup.exe (PID: 6364)

    • Creates/Modifies COM task schedule object

      • SWUpdaterComRegisterShell64.exe (PID: 3376)
      • SWUpdater.exe (PID: 1928)
      • SWUpdaterComRegisterShell64.exe (PID: 2796)
      • SWUpdaterComRegisterShell64.exe (PID: 6244)

    • Starts itself from another location

      • SWUpdater.exe (PID: 2228)

    • Application launched itself

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • SWUpdater.exe (PID: 5292)

    • Checks Windows Trust Settings

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)

    • Creates a software uninstall entry

      • setup.exe (PID: 6364)

    • Searches for installed software

      • setup.exe (PID: 6364)

  • INFO

    • Checks supported languages

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • SWUpdaterSetup.exe (PID: 7112)
      • SWUpdater.exe (PID: 1928)
      • SWUpdaterComRegisterShell64.exe (PID: 2796)
      • SWUpdaterComRegisterShell64.exe (PID: 3376)
      • SWUpdaterComRegisterShell64.exe (PID: 6244)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 4824)
      • SWUpdater.exe (PID: 5292)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6380)
      • setup.exe (PID: 6052)
      • setup.exe (PID: 5940)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 840)
      • wavebrowser.exe (PID: 7060)
      • wavebrowser.exe (PID: 7020)
      • wavebrowser.exe (PID: 3276)
      • wavebrowser.exe (PID: 6220)
      • SWUpdater.exe (PID: 6888)
      • wavebrowser.exe (PID: 6260)
      • wavebrowser.exe (PID: 2636)
      • wavebrowser.exe (PID: 888)
      • wavebrowser.exe (PID: 6276)
      • wavebrowser.exe (PID: 5092)
      • wavebrowser.exe (PID: 5760)
      • wavebrowser.exe (PID: 1984)
      • wavebrowser.exe (PID: 1688)
      • wavebrowser.exe (PID: 6896)
      • wavebrowser.exe (PID: 2324)
      • wavebrowser.exe (PID: 240)
      • wavebrowser.exe (PID: 788)
      • wavebrowser.exe (PID: 3136)
      • wavebrowser.exe (PID: 4168)
      • wavebrowser.exe (PID: 5244)
      • wavebrowser.exe (PID: 6040)
      • wavebrowser.exe (PID: 2212)
      • wavebrowser.exe (PID: 4132)
      • wavebrowser.exe (PID: 4704)
      • wavebrowser.exe (PID: 2932)
      • wavebrowser.exe (PID: 6664)
      • wavebrowser.exe (PID: 3568)
      • wavebrowser.exe (PID: 6156)
      • wavebrowser.exe (PID: 6892)
      • wavebrowser.exe (PID: 6172)
      • wavebrowser.exe (PID: 6696)
      • wavebrowser.exe (PID: 6632)
      • wavebrowser.exe (PID: 6640)
      • wavebrowser.exe (PID: 6636)
      • wavebrowser.exe (PID: 320)
      • wavebrowser.exe (PID: 6312)
      • wavebrowser.exe (PID: 4060)
      • wavebrowser.exe (PID: 5212)
      • wavebrowser.exe (PID: 6600)
      • wavebrowser.exe (PID: 6648)
      • wavebrowser.exe (PID: 6580)
      • wavebrowser.exe (PID: 4296)
      • wavebrowser.exe (PID: 5552)
      • wavebrowser.exe (PID: 7184)
      • wavebrowser.exe (PID: 7296)
      • wavebrowser.exe (PID: 7252)
      • wavebrowser.exe (PID: 7304)
      • wavebrowser.exe (PID: 7452)
      • wavebrowser.exe (PID: 7288)
      • wavebrowser.exe (PID: 7468)
      • wavebrowser.exe (PID: 7460)
      • wavebrowser.exe (PID: 6420)
      • wavebrowser.exe (PID: 7476)
      • wavebrowser.exe (PID: 7484)
      • wavebrowser.exe (PID: 7492)
      • wavebrowser.exe (PID: 7728)

    • Checks proxy server information

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 5292)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • SWUpdater.exe (PID: 6888)
      • setup.exe (PID: 6364)

    • Reads the software policy settings

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 5292)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 6888)

    • Reads the machine GUID from the registry

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 5292)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 6888)
      • wavebrowser.exe (PID: 5980)

    • Reads the computer name

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • SWUpdater.exe (PID: 1928)
      • SWUpdater.exe (PID: 4824)
      • SWUpdater.exe (PID: 1700)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 7060)
      • SWUpdater.exe (PID: 5292)
      • wavebrowser.exe (PID: 7020)
      • SWUpdater.exe (PID: 6888)
      • wavebrowser.exe (PID: 2636)
      • wavebrowser.exe (PID: 6260)
      • wavebrowser.exe (PID: 3568)
      • wavebrowser.exe (PID: 888)

    • Create files in a temporary directory

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdaterSetup.exe (PID: 7112)
      • SWUpdater.exe (PID: 5292)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)
      • wavebrowser.exe (PID: 888)
      • wavebrowser.exe (PID: 5980)

    • Process checks computer location settings

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 320)
      • wavebrowser.exe (PID: 6220)
      • SWUpdater.exe (PID: 5292)
      • wavebrowser.exe (PID: 888)
      • wavebrowser.exe (PID: 5760)
      • wavebrowser.exe (PID: 2324)
      • wavebrowser.exe (PID: 6896)
      • wavebrowser.exe (PID: 240)
      • wavebrowser.exe (PID: 6276)
      • wavebrowser.exe (PID: 5092)
      • wavebrowser.exe (PID: 1984)
      • wavebrowser.exe (PID: 1688)
      • wavebrowser.exe (PID: 2212)

    • Disables trace logs

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)

    • Reads Environment values

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)

    • Creates files or folders in the user directory

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 840)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 7020)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 6364)
      • wavebrowser.exe (PID: 5980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2055:07:27 05:22:29+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 1087488
InitializedDataSize: 177152
UninitializedDataSize: -
EntryPoint: 0x10b64e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.17.2
ProductVersionNumber: 1.3.17.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WaveBrowser
CompanyName: Wavesor Software
FileDescription: WaveBrowser
FileVersion: 1.3.17.2
InternalName: Wave Browser.exe
LegalCopyright: Copyright 2024 Wavesor Software. All rights reserved.
LegalTrademarks: -
OriginalFileName: Wave Browser.exe
ProductName: WaveBrowser
ProductVersion: 1.3.17.2
AssemblyVersion: 1.3.17.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
73
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe swupdatersetup.exe swupdater.exe swupdater.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdater.exe swupdater.exe no specs swupdater.exe waveinstaller-v1.5.18.2.exe setup.exe setup.exe no specs setup.exe setup.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs swupdater.exe wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4976,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5716 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
320"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3176 /prefetch:2C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
788"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3924,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6424 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
840"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\WaveBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.18.2 --initial-client-data=0x150,0x154,0x158,0x10c,0x15c,0x7fffdd92ccf0,0x7fffdd92ccfc,0x7fffdd92cd08C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
888"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3900,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3916 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe
wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
WaveBrowser
Exit code:
0
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1688"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4800,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5328 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1700"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9IntFQkMxNTRDRi1DMzJELTQxMjMtOEU0Ny04NkFDNjhFNTRGNjh9IiB1c2VyaWQ9Ins1YzYxNTIzYi1iMmM2LTRkZTAtYjg4OC02NmNlZjNiMjQwZWF9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezYxRkQ0NDNGLTA1NzEtNDcxQS1CRkY1LTE4ODA2NjVGQ0MyQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iODI4Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe
SWUpdater.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
Wavesor SWUpdater
Exit code:
0
Version:
1.3.133.0
Modules
Images
c:\users\admin\wavesor software\swupdater\swupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1928"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe" /regserverC:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe—SWUpdater.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
Wavesor SWUpdater
Exit code:
0
Version:
1.3.133.0
Modules
Images
c:\users\admin\wavesor software\swupdater\swupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1984"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4784,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5112 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2212"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4864,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5600 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
61 676
Read events
57 778
Write events
3 829
Delete events
69

Modification events

(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
36
Suspicious files
123
Text files
162
Unknown types
0

Dropped files

PID
Process
Filename
Type
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdater.exeexecutable
MD5:57428456C6E6C2EA328C864681DB5DF3
SHA256:EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\psuser.dllexecutable
MD5:71DD0ABC865C9D8873E93478707A16D8
SHA256:A0439F5455EF696B70A230AB76C15F4BC3D7571AD4FBC32FDA95247789AA5822
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterBroker.exeexecutable
MD5:558A3FA51457575EA29F9B041729EE8B
SHA256:74BD216198FF11F08542473AAA7E5A619B50574E344BA8E8CA2C19FF497BF284
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\psmachine_64.dllexecutable
MD5:19E105E099B7653CF60FF5783EC59453
SHA256:7E05780AFFFB2834EC4E2E1D67C9031616C13394CCFEB3A3C678415F19BA1104
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterSetup.exeexecutable
MD5:18693249F3A283E83B8179E692FFBBA9
SHA256:3D828BCCCC628E7096856337B178DA5608A6C3DB99383374E6C49D50A1895E64
2228SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdater.exeexecutable
MD5:57428456C6E6C2EA328C864681DB5DF3
SHA256:EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterComRegisterShell64.exeexecutable
MD5:10B82DC9D9A29BC4AF224981F0E1C6FE
SHA256:00CD644354032257A39FF710DDD03E9FB98348F5323DEC31CA670C903D68274C
5292SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.5.18.2\WaveInstaller-v1.5.18.2.exe —
MD5:—
SHA256:—
5292SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\Install\{9EA4593C-24A2-4EA0-815C-D3BCF4CDD4D1}\WaveInstaller-v1.5.18.2.exe —
MD5:—
SHA256:—
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\psuser_64.dllexecutable
MD5:3D08BFC845A13602E942F839E75BE233
SHA256:2992995FE9FBB5B0FF1DA5F081F2AABD32CA276EDE41889B4E457E6CBCF21EFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
29
DNS requests
18
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
18.245.86.84:443
https://cdn.swupdater.com/build/WaveBrowser/stable/win/1120987643906/64/WaveInstaller-v1.5.18.2.exe
unknown
—
—
unknown
—
—
GET
200
18.207.34.87:443
https://api.wavebrowserbase.com/inst/0/status/chr_stub_started?id=&v=1.3.17.2
unknown
binary
53 b
unknown
—
—
GET
200
54.91.66.17:443
https://dct.wavebrowser.co/dct?ad=0&pk=jDkjCzfQQft108RaOX%2B3pyMfIXti9hytrMgHjk1SIVg%3D&ct=QHVpVt6ch%2BVI6Zw86ZStjcgJ%2FQVr9my4QfSwuqpxsorlHOldd0z54g6Q5ZpY6n7CbE86y8xXsdXaubqaiGrVB5Sf2frMio25I%2BUF8bfWf48fMG4%3D
unknown
text
1.64 Kb
unknown
—
—
GET
200
3.220.179.139:443
https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.3.17.2&swexcr=0
unknown
binary
55 b
unknown
—
—
GET
200
174.129.220.5:443
https://api.wavebrowserbase.com/inst/15/status/chr_offer_accepted?id=&v=1.3.17.2&format=ini
unknown
text
75 b
unknown
—
—
GET
200
54.91.66.17:443
https://dct.wavebrowser.co/dct?ad=0&pk=DxIUBacWxTqftN3dyyoqB%2BW8btDb4KuM329pKO0grzM%3D&ct=GzmoWgxAdniU7rxJHH9W3FznR%2FcfGE9IDJ2QmWax1QfITq2wXG9nQCeI1T6ITRzJaVOWvKMj6Kh9G81vf51wN3jCKx5%2BMUq6Mxof7%2BfUib0xn3XIDg6h9BdGNT%2BfHBnWIr5kBxcggibKBcnar8bfqFmVnizSoOhWoJmp3AHE15LzRTsSjVa5xacN1WgvpQTq6jqqY%2FMPLc7onx%2FU4hlZgQNm89jI%2BSu2LeRH%2BP93%2Fk%2Bh8Tyemb%2Fk7xdQqupLSg0S
unknown
text
100 b
unknown
—
—
GET
200
3.220.179.139:443
https://api.wavebrowserbase.com/inst/15/status/chr_swupd_started?id=&v=1.3.17.2
unknown
binary
53 b
unknown
—
—
GET
200
54.91.66.17:443
https://dct.wavebrowser.co/dct?ad=0&pk=bL%2F9jKgLq4xJLdLi4baKPZ6SmXPwuruewlfdAiZo8Wo%3D&ct=u266%2BRCI5Y7R2LIJY%2BRgn8o9UUDD56FVRVaxz0e0uk3HB6eYTwWKetBCeWz6rUss2zKscSBDclWGEH6V9d0cP1qhIRDs6%2Fhwcz87awV19IXCBAdsZ0JwxRl2fNolW4AzD%2BVSmbOqd5zss3kHFXZolH%2FJUuBJijY3%2BLzpq4V90nlm6AOPV65Ff8tA%2FSX8CJfkxc4nrxQTOTE4VQ9PllbEkgYrdPSJIOTBuJcH63j1nQ2WGdE4XsC8bLOhklTT0Rbm
unknown
text
96 b
unknown
—
—
GET
200
44.212.212.255:443
https://api.mywavehome.net/cnvt/getsupportedfileformats
unknown
text
3.32 Kb
unknown
—
—
POST
200
54.204.63.98:443
https://swupdater.com/service/update2?cup2key=1:1866142310&cup2hreq=b44ef27e1c0f5fd787705fce9e9ac690e77a21b1d2373035728e35574c590ade
unknown
xml
2.48 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3980
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6576
4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe
18.207.34.87:443
api.wavebrowserbase.com
AMAZON-AES
US
unknown
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3980
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4324
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
api.wavebrowserbase.com
  • 18.207.34.87
  • 3.217.70.1
  • 54.91.66.17
  • 44.212.212.255
  • 3.220.179.139
  • 174.129.220.5
unknown
swupdater.com
  • 52.1.211.99
  • 54.204.63.98
unknown
cdn.swupdater.com
  • 18.245.86.84
  • 18.245.86.129
  • 18.245.86.68
  • 18.245.86.19
unknown
dct.wavebrowser.co
  • 18.207.34.87
  • 54.91.66.17
  • 3.220.179.139
  • 174.129.220.5
  • 3.217.70.1
  • 44.212.212.255
unknown
accounts.google.com
  • 108.177.127.84
whitelisted
s2.googleusercontent.com
  • 142.250.186.33
whitelisted
api.mywavehome.net
  • 54.91.66.17
  • 3.217.70.1
  • 18.207.34.87
  • 3.220.179.139
  • 44.212.212.255
  • 174.129.220.5
unknown
api.wavebrowser.net
  • 18.207.34.87
  • 44.212.212.255
  • 174.129.220.5
  • 3.220.179.139
  • 3.217.70.1
  • 54.91.66.17
unknown

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA STREAM suspected RST injection
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe