File name:

WaveInstaller.exe

Full analysis: https://app.any.run/tasks/859ef3d4-7260-4f50-a1bd-3738365f3673
Verdict: Malicious activity
Analysis date: July 14, 2024, 18:28:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

8AD8B6593C91D7960DAD476D6D4AF34F

SHA1:

0A95F110C8264CDE7768A3FD76DB5687FDA830EA

SHA256:

43E6AE7E38488E95741B1CAD60843E7CE49419889285433EB4E697C175A153AB

SSDEEP:

98304:z+ihAY+vt5gt+iG2KBUdM2CWOaIgJVGmcctOw6bmkH01ZRdzoxPg/7SzHKJFZ8YL:lgfW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WaveInstaller.exe (PID: 5908)
      • WaveWindows.exe (PID: 7124)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6844)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)
      • msiexec.exe (PID: 5896)

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • Bloxstrap.exe (PID: 6628)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)

    • Executable content was dropped or overwritten

      • WaveInstaller.exe (PID: 5908)
      • WaveWindows.exe (PID: 7124)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6844)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

    • Process drops legitimate windows executable

      • WaveInstaller.exe (PID: 5908)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6844)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)
      • msiexec.exe (PID: 5896)

    • Reads the date of Windows installation

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

    • Searches for installed software

      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

    • Starts itself from another location

      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 5896)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5896)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 5896)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 5896)

  • INFO

    • Reads the computer name

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • Bloxstrap.exe (PID: 6628)
      • identity_helper.exe (PID: 6664)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • msiexec.exe (PID: 5896)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)
      • msiexec.exe (PID: 2860)
      • msiexec.exe (PID: 6312)
      • msiexec.exe (PID: 6160)
      • msiexec.exe (PID: 7024)

    • Creates files in the program directory

      • WaveInstaller.exe (PID: 5908)
      • WaveWindows.exe (PID: 7124)
      • WaveBootstrapper.exe (PID: 5592)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

    • Checks supported languages

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • node.exe (PID: 3584)
      • Bloxstrap.exe (PID: 6628)
      • identity_helper.exe (PID: 6664)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6844)
      • msiexec.exe (PID: 5896)
      • msiexec.exe (PID: 2860)
      • msiexec.exe (PID: 6160)
      • msiexec.exe (PID: 6312)
      • msiexec.exe (PID: 7024)

    • Reads Environment values

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • node.exe (PID: 3584)
      • WaveWindows.exe (PID: 7124)

    • Reads the machine GUID from the registry

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)
      • msiexec.exe (PID: 5896)

    • Disables trace logs

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)

    • Checks proxy server information

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)

    • Creates files or folders in the user directory

      • WaveInstaller.exe (PID: 5908)
      • WaveWindows.exe (PID: 7124)

    • Reads the software policy settings

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • msiexec.exe (PID: 5896)

    • Process checks computer location settings

      • WaveInstaller.exe (PID: 5908)
      • WaveBootstrapper.exe (PID: 5592)
      • WaveWindows.exe (PID: 7124)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)

    • Checks for the presence of KasperskyLab

      • WaveWindows.exe (PID: 7124)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 2652)
      • Bloxstrap.exe (PID: 6628)
      • msedge.exe (PID: 1160)

    • Application launched itself

      • msedge.exe (PID: 2652)
      • msedge.exe (PID: 1160)

    • The process uses the downloaded file

      • msedge.exe (PID: 7080)
      • msedge.exe (PID: 1160)

    • Manual execution by a user

      • msedge.exe (PID: 1160)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 1160)
      • msedge.exe (PID: 5532)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1160)
      • msiexec.exe (PID: 5896)

    • Reads product name

      • node.exe (PID: 3584)

    • Create files in a temporary directory

      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6844)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6904)
      • windowsdesktop-runtime-6.0.32-win-x64.exe (PID: 6380)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2079:10:28 04:47:33+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 2167296
InitializedDataSize: 210944
UninitializedDataSize: -
EntryPoint: 0x21300e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: WaveInstaller
FileVersion: 1.0.0.0
InternalName: WaveInstaller.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: WaveInstaller.exe
ProductName: WaveInstaller
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
213
Monitored processes
71
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start waveinstaller.exe wavebootstrapper.exe wavewindows.exe node.exe no specs conhost.exe no specs bloxstrap.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs windowsdesktop-runtime-6.0.32-win-x64.exe windowsdesktop-runtime-6.0.32-win-x64.exe windowsdesktop-runtime-6.0.32-win-x64.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs waveinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=8152 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.30&gui=trueC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6620 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6408 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5648 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1544"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5444 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1852"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3600 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1852"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6936 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1888"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x264,0x268,0x26c,0x260,0x280,0x7ffd9dda5fd8,0x7ffd9dda5fe4,0x7ffd9dda5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1908"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7580 --field-trial-handle=2448,i,15562451270643467415,16931835118565319218,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
47 693
Read events
46 541
Write events
1 104
Delete events
48

Modification events

(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5908) WaveInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WaveInstaller_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
556
Suspicious files
439
Text files
147
Unknown types
9

Dropped files

PID
Process
Filename
Type
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\chromiumembeddedframework.runtime.win-x86.124.3.8.nupkg —
MD5:—
SHA256:—
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Luau Language Server\Luau-x64.rar —
MD5:—
SHA256:—
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\Wave-x64.rar —
MD5:—
SHA256:—
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\runtimes\win-x86\native\libcef.dll —
MD5:—
SHA256:—
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\runtimes\win-x86\native\resources.pak —
MD5:—
SHA256:—
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\runtimes\win-x86\native\icudtl.dat —
MD5:—
SHA256:—
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\CefSharp.Common.124.3.8.rarcompressed
MD5:7635BDB75C04DE33E487C01AFCC5566B
SHA256:2579C7795A5EA6D9BB29D93C4B11F858E2670B7EBDC20C8F6C47BEE078D6A2A3
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\_rels\.relsxml
MD5:29E0FDCBF57612C324A89835569D6350
SHA256:53F01ACEB2C7F2F00AFB1135598338BCDF8D3A432D89607EFF29EB4EADA2005A
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\CefSharp.Wpf.124.3.8.rarcompressed
MD5:8E68D61995C7811C02FB6405BD0A4AB1
SHA256:6B1A0007444DDAF6A31562C4CF8221BA54591C653AD1D9E8AC38737004B00EA7
5908WaveInstaller.exeC:\Users\admin\AppData\Local\Wave\WaveWindows.exeexecutable
MD5:B8631BBD78D3935042E47B672C19CCC3
SHA256:9CFDA541D595DC20A55DF5422001DFB58DEBD401DF3ABFF21B1EEE8EDE28451C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
135
DNS requests
105
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2204
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2204
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4636
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2248
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6968
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6968
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
1160
msedge.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
1160
msedge.exe
GET
200
2.16.164.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2252
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
104.126.37.184:443
www.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2204
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2204
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4636
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.184
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.130
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.136
  • 2.19.96.10
  • 2.19.96.35
  • 2.19.96.48
  • 2.19.96.40
  • 2.19.96.42
  • 2.19.96.34
  • 2.19.96.25
  • 2.19.96.8
  • 2.19.96.26
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.189
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.187
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 2.16.164.107
  • 2.16.164.81
  • 2.16.164.82
  • 2.16.164.32
  • 2.16.164.18
  • 2.16.164.106
  • 2.16.164.114
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
  • 88.221.169.152
whitelisted
google.com
  • 142.250.184.206
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.14
whitelisted
www.nuget.org
  • 52.240.159.111
whitelisted

Threats

PID
Process
Class
Message
2168
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
Process
Message
Bloxstrap.exe
You must install .NET to run this application. App: C:\Users\admin\AppData\Local\Bloxstrap\Bloxstrap.exe Architecture: x64 App host version: 6.0.30 .NET location: Not found Learn about runtime installation: https://aka.ms/dotnet/app-launch-failed Download the .NET runtime: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.30
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WaveInstaller.exe