File name:

4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe

Full analysis: https://app.any.run/tasks/ba0a088b-c1f0-40c9-ba2d-18366c78c454
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 01, 2024, 17:56:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1684AAB6FAE1ED888CF6D3C45E3F5FA7

SHA1:

6ACC87B81836575BF7B497F0E8A9A23A221F06B7

SHA256:

4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB

SSDEEP:

49152:Go3U1o4h7d7esHiVe4aSw/017+zQnWGTvjpu0+IggeNo+yC0/gODj7RgldaaY99P:BE1o4hl8VefSwsJ+zQnJF+zm+yzgqj1t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdaterSetup.exe (PID: 7112)
      • SWUpdater.exe (PID: 2228)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)

    • Changes the autorun value in the registry

      • SWUpdater.exe (PID: 2228)

    • Scans artifacts that could help determine the target

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)

    • Actions looks like stealing of personal data

      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 888)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 5292)

    • Executable content was dropped or overwritten

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdaterSetup.exe (PID: 7112)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)
      • SWUpdater.exe (PID: 2228)

    • Reads the date of Windows installation

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 5292)

    • Starts itself from another location

      • SWUpdater.exe (PID: 2228)

    • Creates/Modifies COM task schedule object

      • SWUpdaterComRegisterShell64.exe (PID: 3376)
      • SWUpdater.exe (PID: 1928)
      • SWUpdaterComRegisterShell64.exe (PID: 2796)
      • SWUpdaterComRegisterShell64.exe (PID: 6244)

    • Application launched itself

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • SWUpdater.exe (PID: 5292)

    • Checks Windows Trust Settings

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)

    • Searches for installed software

      • setup.exe (PID: 6364)

    • Creates a software uninstall entry

      • setup.exe (PID: 6364)

  • INFO

    • Reads the computer name

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 1928)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 4824)
      • SWUpdater.exe (PID: 5292)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 7060)
      • wavebrowser.exe (PID: 7020)
      • wavebrowser.exe (PID: 888)
      • SWUpdater.exe (PID: 6888)
      • wavebrowser.exe (PID: 6260)
      • wavebrowser.exe (PID: 2636)
      • SWUpdater.exe (PID: 2228)
      • wavebrowser.exe (PID: 3568)

    • Checks supported languages

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdaterSetup.exe (PID: 7112)
      • SWUpdater.exe (PID: 2228)
      • SWUpdaterComRegisterShell64.exe (PID: 3376)
      • SWUpdater.exe (PID: 1928)
      • SWUpdaterComRegisterShell64.exe (PID: 2796)
      • SWUpdaterComRegisterShell64.exe (PID: 6244)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 5292)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)
      • SWUpdater.exe (PID: 4824)
      • setup.exe (PID: 6380)
      • setup.exe (PID: 6052)
      • setup.exe (PID: 5940)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 840)
      • wavebrowser.exe (PID: 7060)
      • wavebrowser.exe (PID: 7020)
      • wavebrowser.exe (PID: 3276)
      • wavebrowser.exe (PID: 320)
      • wavebrowser.exe (PID: 6220)
      • wavebrowser.exe (PID: 6260)
      • wavebrowser.exe (PID: 888)
      • SWUpdater.exe (PID: 6888)
      • wavebrowser.exe (PID: 6276)
      • wavebrowser.exe (PID: 2636)
      • wavebrowser.exe (PID: 5760)
      • wavebrowser.exe (PID: 5092)
      • wavebrowser.exe (PID: 1984)
      • wavebrowser.exe (PID: 1688)
      • wavebrowser.exe (PID: 2324)
      • wavebrowser.exe (PID: 6896)
      • wavebrowser.exe (PID: 240)
      • wavebrowser.exe (PID: 2212)
      • wavebrowser.exe (PID: 4060)
      • wavebrowser.exe (PID: 3136)
      • wavebrowser.exe (PID: 788)
      • wavebrowser.exe (PID: 6312)
      • wavebrowser.exe (PID: 4168)
      • wavebrowser.exe (PID: 5244)
      • wavebrowser.exe (PID: 6040)
      • wavebrowser.exe (PID: 2932)
      • wavebrowser.exe (PID: 4132)
      • wavebrowser.exe (PID: 5212)
      • wavebrowser.exe (PID: 4704)
      • wavebrowser.exe (PID: 3568)
      • wavebrowser.exe (PID: 6664)
      • wavebrowser.exe (PID: 6156)
      • wavebrowser.exe (PID: 6172)
      • wavebrowser.exe (PID: 6892)
      • wavebrowser.exe (PID: 5552)
      • wavebrowser.exe (PID: 6632)
      • wavebrowser.exe (PID: 6636)
      • wavebrowser.exe (PID: 6420)
      • wavebrowser.exe (PID: 6648)
      • wavebrowser.exe (PID: 6600)
      • wavebrowser.exe (PID: 4296)
      • wavebrowser.exe (PID: 6580)
      • wavebrowser.exe (PID: 7452)
      • wavebrowser.exe (PID: 7184)
      • wavebrowser.exe (PID: 7252)
      • wavebrowser.exe (PID: 7304)
      • wavebrowser.exe (PID: 7296)
      • wavebrowser.exe (PID: 7288)
      • wavebrowser.exe (PID: 7468)
      • wavebrowser.exe (PID: 7460)
      • wavebrowser.exe (PID: 6696)
      • wavebrowser.exe (PID: 6640)
      • wavebrowser.exe (PID: 7484)
      • wavebrowser.exe (PID: 7476)
      • wavebrowser.exe (PID: 7492)
      • wavebrowser.exe (PID: 7728)

    • Reads Environment values

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)

    • Reads the software policy settings

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 1700)
      • SWUpdater.exe (PID: 5292)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • SWUpdater.exe (PID: 6888)

    • Checks proxy server information

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 5292)
      • SWUpdater.exe (PID: 1700)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • SWUpdater.exe (PID: 6888)

    • Reads the machine GUID from the registry

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 5292)
      • SWUpdater.exe (PID: 1700)
      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 5980)
      • SWUpdater.exe (PID: 6888)

    • Disables trace logs

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)

    • Create files in a temporary directory

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdaterSetup.exe (PID: 7112)
      • SWUpdater.exe (PID: 5292)
      • WaveInstaller-v1.5.18.2.exe (PID: 4672)
      • setup.exe (PID: 6364)
      • wavebrowser.exe (PID: 888)
      • wavebrowser.exe (PID: 5980)

    • Process checks computer location settings

      • 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe (PID: 6576)
      • SWUpdater.exe (PID: 2228)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 6220)
      • wavebrowser.exe (PID: 320)
      • wavebrowser.exe (PID: 888)
      • SWUpdater.exe (PID: 5292)
      • wavebrowser.exe (PID: 2324)
      • wavebrowser.exe (PID: 5760)
      • wavebrowser.exe (PID: 6896)
      • wavebrowser.exe (PID: 240)
      • wavebrowser.exe (PID: 5092)
      • wavebrowser.exe (PID: 2212)
      • wavebrowser.exe (PID: 6276)
      • wavebrowser.exe (PID: 1984)
      • wavebrowser.exe (PID: 1688)

    • Creates files or folders in the user directory

      • setup.exe (PID: 6364)
      • setup.exe (PID: 6052)
      • wavebrowser.exe (PID: 840)
      • wavebrowser.exe (PID: 5980)
      • wavebrowser.exe (PID: 7020)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 6364)
      • wavebrowser.exe (PID: 5980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2055:07:27 05:22:29+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 1087488
InitializedDataSize: 177152
UninitializedDataSize: -
EntryPoint: 0x10b64e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.17.2
ProductVersionNumber: 1.3.17.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WaveBrowser
CompanyName: Wavesor Software
FileDescription: WaveBrowser
FileVersion: 1.3.17.2
InternalName: Wave Browser.exe
LegalCopyright: Copyright 2024 Wavesor Software. All rights reserved.
LegalTrademarks: -
OriginalFileName: Wave Browser.exe
ProductName: WaveBrowser
ProductVersion: 1.3.17.2
AssemblyVersion: 1.3.17.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
73
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe swupdatersetup.exe swupdater.exe swupdater.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdatercomregistershell64.exe no specs swupdater.exe swupdater.exe no specs swupdater.exe waveinstaller-v1.5.18.2.exe setup.exe setup.exe no specs setup.exe setup.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs swupdater.exe wavebrowser.exe wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs wavebrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4976,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5716 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
320"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3176 /prefetch:2C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
788"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3924,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6424 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Exit code:
0
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
840"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\WaveBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.18.2 --initial-client-data=0x150,0x154,0x158,0x10c,0x15c,0x7fffdd92ccf0,0x7fffdd92ccfc,0x7fffdd92cd08C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
888"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3900,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3916 /prefetch:8C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe
wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
WaveBrowser
Exit code:
0
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
1688"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4800,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5328 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1700"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9IntFQkMxNTRDRi1DMzJELTQxMjMtOEU0Ny04NkFDNjhFNTRGNjh9IiB1c2VyaWQ9Ins1YzYxNTIzYi1iMmM2LTRkZTAtYjg4OC02NmNlZjNiMjQwZWF9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezYxRkQ0NDNGLTA1NzEtNDcxQS1CRkY1LTE4ODA2NjVGQ0MyQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iODI4Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe
SWUpdater.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
Wavesor SWUpdater
Exit code:
0
Version:
1.3.133.0
Modules
Images
c:\users\admin\wavesor software\swupdater\swupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1928"C:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe" /regserverC:\Users\admin\Wavesor Software\SWUpdater\SWUpdater.exe—SWUpdater.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
MEDIUM
Description:
Wavesor SWUpdater
Exit code:
0
Version:
1.3.133.0
Modules
Images
c:\users\admin\wavesor software\swupdater\swupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1984"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4784,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5112 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2212"C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4864,i,1223220588725722133,15610945366180034791,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5600 /prefetch:1C:\Users\admin\Wavesor Software\WaveBrowser\wavebrowser.exe—wavebrowser.exe
User:
admin
Company:
Wavesor Software
Integrity Level:
LOW
Description:
WaveBrowser
Version:
1.5.18.2
Modules
Images
c:\users\admin\wavesor software\wavebrowser\wavebrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\wavesor software\wavebrowser\1.5.18.2\wavebrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
61 676
Read events
57 778
Write events
3 829
Delete events
69

Modification events

(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6576) 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
36
Suspicious files
123
Text files
162
Unknown types
0

Dropped files

PID
Process
Filename
Type
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\psmachine.dllexecutable
MD5:B10F0939BCE18AD24102C03769DDAB9B
SHA256:442AF0A1A403E17B5E5676CB49973D9E3AE067CFE9EFB8B669BF413F7B5A2E1D
2228SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\1.3.133.0\psuser.dllexecutable
MD5:71DD0ABC865C9D8873E93478707A16D8
SHA256:A0439F5455EF696B70A230AB76C15F4BC3D7571AD4FBC32FDA95247789AA5822
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\swupdater.dllexecutable
MD5:D388D67A1861F9D0CC4F6EDFA97861B4
SHA256:B21F99F14B4CCC78C5E01C269A8EBA83AE0C5912B46D8C1554F329A1076A7617
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterBroker.exeexecutable
MD5:558A3FA51457575EA29F9B041729EE8B
SHA256:74BD216198FF11F08542473AAA7E5A619B50574E344BA8E8CA2C19FF497BF284
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterCore.exeexecutable
MD5:D40BD627BFB2BA39C5452A71A450EABD
SHA256:8AF504DDA28DA0896CB0E17273878D285D8CC1F912D304B21A49940FB577A0A5
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterComRegisterShell64.exeexecutable
MD5:10B82DC9D9A29BC4AF224981F0E1C6FE
SHA256:00CD644354032257A39FF710DDD03E9FB98348F5323DEC31CA670C903D68274C
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\SWUpdaterOnDemand.exeexecutable
MD5:29B0571D015318EDB1C292AEA8011179
SHA256:CEA433E8FEA8DCF1705016545ABD150A2891291AE122A776CD66DDB802A17587
5292SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.5.18.2\WaveInstaller-v1.5.18.2.exe —
MD5:—
SHA256:—
5292SWUpdater.exeC:\Users\admin\Wavesor Software\SWUpdater\Install\{9EA4593C-24A2-4EA0-815C-D3BCF4CDD4D1}\WaveInstaller-v1.5.18.2.exe —
MD5:—
SHA256:—
7112SWUpdaterSetup.exeC:\Users\admin\AppData\Local\Temp\GUM8865.tmp\psmachine_64.dllexecutable
MD5:19E105E099B7653CF60FF5783EC59453
SHA256:7E05780AFFFB2834EC4E2E1D67C9031616C13394CCFEB3A3C678415F19BA1104
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
29
DNS requests
18
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
18.245.86.84:443
https://cdn.swupdater.com/build/WaveBrowser/stable/win/1120987643906/64/WaveInstaller-v1.5.18.2.exe
unknown
—
—
—
—
—
GET
200
18.207.34.87:443
https://api.wavebrowserbase.com/inst/0/status/chr_stub_started?id=&v=1.3.17.2
unknown
binary
53 b
—
—
—
GET
200
174.129.220.5:443
https://api.wavebrowserbase.com/inst/15/status/chr_offer_accepted?id=&v=1.3.17.2&format=ini
unknown
text
75 b
—
—
—
GET
200
3.220.179.139:443
https://api.wavebrowserbase.com/inst/15/status/chr_swupd_started?id=&v=1.3.17.2
unknown
binary
53 b
—
—
—
GET
200
54.91.66.17:443
https://dct.wavebrowser.co/dct?ad=0&pk=KZQKElCWkaxXx7yn9UE%2BeHkd%2BLNgUQyU3hooEMN6rio%3D&ct=okca7h6QEoEAtlCptUWL84n4RorD7PJrjJIPrHYVKX5924RCpgE2SEwv6UDMbQ2fADALCPKKDEk5asYa2trLGyWK5KfH2gx%2BmL4%2FxC5jxanOTjmGGXeJ3LHjudQpS%2FGHgMMHUMYuOO9U
unknown
text
100 b
—
—
—
GET
200
18.245.86.68:443
https://cdn.swupdater.com/build/WaveBrowser/stable/win/1120987643906/64/WaveInstaller-v1.5.18.2.exe
unknown
executable
101 Mb
—
—
—
POST
200
54.204.63.98:443
https://swupdater.com/service/update2?cup2key=1:1866142310&cup2hreq=b44ef27e1c0f5fd787705fce9e9ac690e77a21b1d2373035728e35574c590ade
unknown
xml
2.48 Kb
—
—
—
GET
200
174.129.220.5:443
https://dct.wavebrowser.co/dct?ad=0&pk=G6ucrtPqhsO77o2j2%2BgbWuAX0HhQHxELqzgV8TqEUTQ%3D&ct=%2Fj7caiLeEmoGTxg84CjtVEu4U0YeXO5WUVQSvmJ%2B8Rd4dbdHgQQuP4TW0e3n8wO3nbRzOXd491xHGVNGe30LhyT8Zb5ZGOOfBOZsnO2PJGqARWA0BuIzJkTVlKKNNdWWvckw1BC7LQ1HARL%2BluLr458AFGXwcxi%2B4eZCGC1ufaBuqoAJjEbdKcmB4UEKow%3D%3D
unknown
text
212 b
—
—
—
GET
200
18.207.34.87:443
https://dct.wavebrowser.co/dct?ad=0&pk=GxWl4rpaACqQUQTTv8zYoi4DJjH1tgFdUdDvbaV49R4%3D&ct=znSgnMibjzsjDOq9fGZLw1zZibB8sGwrZdE82y64XgkGa8xX0d3iJqasGuPTDR5Z0ZjzRIHfKr3Eg%2BtEil%2Bxeno1odmQN9t6%2BvlOkNTb32dkBN31Ue5qyuYWGsjuUf2ML4gSR%2FQc686UDuZTD1eoVNcHl1%2B5OojFLnqLSX%2B6V0kmwZEcQA%2F5bMczuOuESw%3D%3D
unknown
text
212 b
—
—
—
GET
200
44.212.212.255:443
https://api.mywavehome.net/cnvt/getsupportedfileformats
unknown
text
3.32 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3980
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6576
4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe
18.207.34.87:443
api.wavebrowserbase.com
AMAZON-AES
US
unknown
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3980
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4324
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
api.wavebrowserbase.com
  • 18.207.34.87
  • 3.217.70.1
  • 54.91.66.17
  • 44.212.212.255
  • 3.220.179.139
  • 174.129.220.5
unknown
swupdater.com
  • 52.1.211.99
  • 54.204.63.98
unknown
cdn.swupdater.com
  • 18.245.86.84
  • 18.245.86.129
  • 18.245.86.68
  • 18.245.86.19
unknown
dct.wavebrowser.co
  • 18.207.34.87
  • 54.91.66.17
  • 3.220.179.139
  • 174.129.220.5
  • 3.217.70.1
  • 44.212.212.255
unknown
accounts.google.com
  • 108.177.127.84
whitelisted
s2.googleusercontent.com
  • 142.250.186.33
whitelisted
api.mywavehome.net
  • 54.91.66.17
  • 3.217.70.1
  • 18.207.34.87
  • 3.220.179.139
  • 44.212.212.255
  • 174.129.220.5
unknown
api.wavebrowser.net
  • 18.207.34.87
  • 44.212.212.255
  • 174.129.220.5
  • 3.220.179.139
  • 3.217.70.1
  • 54.91.66.17
unknown

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA STREAM suspected RST injection
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe