Analysis
-
max time kernel
219s -
max time network
1793s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/07/2024, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
WaveInstaller.exe
Resource
win10v2004-20240709-en
General
-
Target
WaveInstaller.exe
-
Size
2.4MB
-
MD5
089dd964c48674b3b4f6a763e6d6ce87
-
SHA1
b47510e2c8cf4445c6c7d18ac1d7e470c9c16c2d
-
SHA256
77a7db0fbc13dea55b22b02fec1df3a7000f1850a92bc6d251def80526b8b1d6
-
SHA512
450b21e7dec87f580837f27f393dc4ead02941b68667cdaa52adf0f1a4c239756f7e26a2d42ab2869badac84e16d55096a5c61d09a5a219f529ea72bbf226370
-
SSDEEP
49152:1inbTKfysiSSCA7w8hL9IM8xMg+YLplcHJTizTSMbUlg/BFiif/MlXm:1in6JG/7t19X8x/PEHJaVUlgC/c
Malware Config
Extracted
xworm
email-champions.gl.at.ply.gg:50458
-
Install_directory
%Temp%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot6814850214:AAGtrnkhUh3vMq-wH7W5cvNuSWLdcy7mtis/sendMessage?chat_id=7094837950
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x000500000002aabb-5.dat family_xworm behavioral2/memory/2856-14-0x0000000000900000-0x000000000091A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4820 Process not Found 1956 Process not Found 1560 Process not Found 1792 Process not Found 2164 Process not Found 2572 Process not Found 4756 Process not Found 2500 Process not Found 4244 Process not Found 2532 Process not Found 1540 Process not Found 4464 Process not Found 1620 Process not Found 2968 Process not Found 2000 Process not Found 2600 Process not Found 3560 Process not Found 1552 Process not Found 3924 Process not Found 3748 Process not Found 476 Process not Found 3896 powershell.exe 2880 powershell.exe 2804 Process not Found 4976 Process not Found 3840 Process not Found 1892 Process not Found 876 Process not Found 1264 Process not Found 5024 Process not Found 1540 Process not Found 1748 Process not Found 1448 Process not Found 3444 Process not Found 3056 Process not Found 5084 Process not Found 2020 powershell.exe 3132 powershell.exe 3272 Process not Found 2260 Process not Found 1080 Process not Found 2940 Process not Found 3116 powershell.exe 2128 Process not Found 1332 Process not Found 2416 Process not Found 4224 Process not Found 3864 Process not Found 492 Process not Found 1544 Process not Found 2428 Process not Found 3580 Process not Found 1076 Process not Found 2920 Process not Found 2132 Process not Found 4440 powershell.exe 2504 powershell.exe 380 Process not Found 2832 Process not Found 1368 Process not Found 1868 Process not Found 3224 powershell.exe 848 Process not Found 3572 Process not Found -
Executes dropped EXE 64 IoCs
pid Process 2416 WaveInstaller.exe 2856 WaveInstall5r.exe 2404 WaveInstaller.exe 3224 WaveInstall5r.exe 2860 WaveInstaller.exe 2596 WaveInstall5r.exe 2844 WaveInstaller.exe 1400 WaveInstall5r.exe 3876 WaveInstaller.exe 4952 WaveInstall5r.exe 4160 WaveInstaller.exe 1396 WaveInstall5r.exe 1588 WaveInstaller.exe 1004 WaveInstall5r.exe 5064 WaveInstaller.exe 1504 WaveInstall5r.exe 1852 WaveInstaller.exe 2164 WaveInstall5r.exe 752 WaveInstaller.exe 2984 WaveInstall5r.exe 1136 WaveInstaller.exe 1688 WaveInstall5r.exe 3776 WaveInstaller.exe 2608 WaveInstall5r.exe 912 WaveInstaller.exe 2300 WaveInstall5r.exe 3744 WaveInstaller.exe 2788 WaveInstall5r.exe 2936 WaveInstaller.exe 1076 WaveInstall5r.exe 3568 WaveInstaller.exe 3512 WaveInstall5r.exe 3272 WaveInstaller.exe 1680 WaveInstall5r.exe 4956 WaveInstaller.exe 4276 WaveInstall5r.exe 1028 WaveInstaller.exe 2848 WaveInstall5r.exe 4824 WaveInstaller.exe 4800 WaveInstall5r.exe 2872 WaveInstaller.exe 540 WaveInstall5r.exe 464 WaveInstaller.exe 2276 WaveInstall5r.exe 276 WaveInstaller.exe 4648 WaveInstall5r.exe 404 WaveInstaller.exe 392 WaveInstall5r.exe 2448 WaveInstaller.exe 3260 WaveInstall5r.exe 752 WaveInstaller.exe 1736 WaveInstall5r.exe 3776 WaveInstall5r.exe 1544 WaveInstaller.exe 2496 WaveInstaller.exe 4676 WaveInstall5r.exe 2060 WaveInstaller.exe 2824 WaveInstall5r.exe 4816 WaveInstaller.exe 4660 WaveInstall5r.exe 3960 WaveInstaller.exe 656 WaveInstall5r.exe 5064 WaveInstaller.exe 244 WaveInstall5r.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 15 IoCs
pid Process 4464 Process not Found 4696 Process not Found 1640 Process not Found 1008 Process not Found 1792 Process not Found 2344 Process not Found 5116 Process not Found 1240 Process not Found 392 Process not Found 476 Process not Found 112 Process not Found 3688 Process not Found 1784 Process not Found 2820 Process not Found 5052 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1476 Process not Found 2844 Process not Found 2144 Process not Found 4876 Process not Found 660 schtasks.exe 1656 schtasks.exe 1176 Process not Found 2252 Process not Found 4888 Process not Found 2176 Process not Found 960 Process not Found 2892 Process not Found 1432 Process not Found 3108 Process not Found 1320 Process not Found 112 Process not Found 3596 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2020 powershell.exe 2020 powershell.exe 2020 powershell.exe 3132 powershell.exe 3132 powershell.exe 3132 powershell.exe 3896 powershell.exe 3896 powershell.exe 3896 powershell.exe 3224 powershell.exe 3224 powershell.exe 3224 powershell.exe 2856 WaveInstall5r.exe 2856 WaveInstall5r.exe 4440 powershell.exe 4440 powershell.exe 4440 powershell.exe 2880 powershell.exe 2880 powershell.exe 2880 powershell.exe 3116 powershell.exe 3116 powershell.exe 3116 powershell.exe 2504 powershell.exe 2504 powershell.exe 2504 powershell.exe 1116 WaveInstall5r.exe 1116 WaveInstall5r.exe 3272 Process not Found 3272 Process not Found 3272 Process not Found 848 Process not Found 848 Process not Found 848 Process not Found 2532 Process not Found 2532 Process not Found 2532 Process not Found 3924 Process not Found 3924 Process not Found 3924 Process not Found 3152 Process not Found 3152 Process not Found 3572 Process not Found 3572 Process not Found 3572 Process not Found 5076 Process not Found 5076 Process not Found 5076 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 2000 Process not Found 2000 Process not Found 2000 Process not Found 276 Process not Found 276 Process not Found 2128 Process not Found 2128 Process not Found 2128 Process not Found 5024 Process not Found 5024 Process not Found 5024 Process not Found 2260 Process not Found 2260 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2856 WaveInstall5r.exe Token: SeDebugPrivilege 3224 WaveInstall5r.exe Token: SeDebugPrivilege 2596 WaveInstall5r.exe Token: SeDebugPrivilege 1400 WaveInstall5r.exe Token: SeDebugPrivilege 4952 WaveInstall5r.exe Token: SeDebugPrivilege 1396 WaveInstall5r.exe Token: SeDebugPrivilege 1004 WaveInstall5r.exe Token: SeDebugPrivilege 1504 WaveInstall5r.exe Token: SeDebugPrivilege 2164 WaveInstall5r.exe Token: SeDebugPrivilege 2984 WaveInstall5r.exe Token: SeDebugPrivilege 1688 WaveInstall5r.exe Token: SeDebugPrivilege 2608 WaveInstall5r.exe Token: SeDebugPrivilege 2300 WaveInstall5r.exe Token: SeDebugPrivilege 2788 WaveInstall5r.exe Token: SeDebugPrivilege 1076 WaveInstall5r.exe Token: SeDebugPrivilege 3512 WaveInstall5r.exe Token: SeDebugPrivilege 1680 WaveInstall5r.exe Token: SeDebugPrivilege 4276 WaveInstall5r.exe Token: SeDebugPrivilege 2848 WaveInstall5r.exe Token: SeDebugPrivilege 4800 WaveInstall5r.exe Token: SeDebugPrivilege 540 WaveInstall5r.exe Token: SeDebugPrivilege 2276 WaveInstall5r.exe Token: SeDebugPrivilege 4648 WaveInstall5r.exe Token: SeDebugPrivilege 392 WaveInstall5r.exe Token: SeDebugPrivilege 3260 WaveInstall5r.exe Token: SeDebugPrivilege 1736 WaveInstall5r.exe Token: SeDebugPrivilege 3776 WaveInstall5r.exe Token: SeDebugPrivilege 4676 WaveInstall5r.exe Token: SeDebugPrivilege 2824 WaveInstall5r.exe Token: SeDebugPrivilege 2020 powershell.exe Token: SeDebugPrivilege 4660 WaveInstall5r.exe Token: SeDebugPrivilege 656 WaveInstall5r.exe Token: SeDebugPrivilege 244 WaveInstall5r.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeDebugPrivilege 3060 WaveInstall5r.exe Token: SeDebugPrivilege 1544 WaveInstall5r.exe Token: SeDebugPrivilege 772 WaveInstall5r.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 2164 WaveInstall5r.exe Token: SeDebugPrivilege 2172 WaveInstall5r.exe Token: SeDebugPrivilege 3140 WaveInstall5r.exe Token: SeDebugPrivilege 2156 WaveInstall5r.exe Token: SeDebugPrivilege 3224 powershell.exe Token: SeDebugPrivilege 1992 WaveInstall5r.exe Token: SeDebugPrivilege 4140 WaveInstall5r.exe Token: SeDebugPrivilege 4220 WaveInstall5r.exe Token: SeDebugPrivilege 2984 WaveInstall5r.exe Token: SeDebugPrivilege 3756 WaveInstall5r.exe Token: SeDebugPrivilege 2324 WaveInstall5r.exe Token: SeDebugPrivilege 2596 WaveInstall5r.exe Token: SeDebugPrivilege 1548 WaveInstall5r.exe Token: SeDebugPrivilege 1080 WaveInstall5r.exe Token: SeDebugPrivilege 2980 WaveInstall5r.exe Token: SeDebugPrivilege 1392 WaveInstall5r.exe Token: SeDebugPrivilege 5064 WaveInstall5r.exe Token: SeDebugPrivilege 2856 WaveInstall5r.exe Token: SeDebugPrivilege 4552 WaveInstall5r.exe Token: SeDebugPrivilege 4832 WaveInstall5r.exe Token: SeDebugPrivilege 1680 WaveInstall5r.exe Token: SeDebugPrivilege 2748 WaveInstall5r.exe Token: SeDebugPrivilege 1492 WaveInstall5r.exe Token: SeDebugPrivilege 3532 WaveInstall5r.exe Token: SeDebugPrivilege 3872 WaveInstall5r.exe Token: SeDebugPrivilege 3112 WaveInstall5r.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2856 WaveInstall5r.exe 1116 WaveInstall5r.exe 3152 Process not Found 276 Process not Found 4644 Process not Found 400 Process not Found 4876 Process not Found 4936 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 2416 4444 WaveInstaller.exe 82 PID 4444 wrote to memory of 2416 4444 WaveInstaller.exe 82 PID 4444 wrote to memory of 2416 4444 WaveInstaller.exe 82 PID 4444 wrote to memory of 2856 4444 WaveInstaller.exe 83 PID 4444 wrote to memory of 2856 4444 WaveInstaller.exe 83 PID 2416 wrote to memory of 2404 2416 WaveInstaller.exe 84 PID 2416 wrote to memory of 2404 2416 WaveInstaller.exe 84 PID 2416 wrote to memory of 2404 2416 WaveInstaller.exe 84 PID 2416 wrote to memory of 3224 2416 WaveInstaller.exe 85 PID 2416 wrote to memory of 3224 2416 WaveInstaller.exe 85 PID 2404 wrote to memory of 2860 2404 WaveInstaller.exe 86 PID 2404 wrote to memory of 2860 2404 WaveInstaller.exe 86 PID 2404 wrote to memory of 2860 2404 WaveInstaller.exe 86 PID 2404 wrote to memory of 2596 2404 WaveInstaller.exe 87 PID 2404 wrote to memory of 2596 2404 WaveInstaller.exe 87 PID 2860 wrote to memory of 2844 2860 WaveInstaller.exe 88 PID 2860 wrote to memory of 2844 2860 WaveInstaller.exe 88 PID 2860 wrote to memory of 2844 2860 WaveInstaller.exe 88 PID 2860 wrote to memory of 1400 2860 WaveInstaller.exe 89 PID 2860 wrote to memory of 1400 2860 WaveInstaller.exe 89 PID 2844 wrote to memory of 3876 2844 WaveInstaller.exe 161 PID 2844 wrote to memory of 3876 2844 WaveInstaller.exe 161 PID 2844 wrote to memory of 3876 2844 WaveInstaller.exe 161 PID 2844 wrote to memory of 4952 2844 WaveInstaller.exe 91 PID 2844 wrote to memory of 4952 2844 WaveInstaller.exe 91 PID 3876 wrote to memory of 4160 3876 WaveInstaller.exe 92 PID 3876 wrote to memory of 4160 3876 WaveInstaller.exe 92 PID 3876 wrote to memory of 4160 3876 WaveInstaller.exe 92 PID 3876 wrote to memory of 1396 3876 WaveInstaller.exe 93 PID 3876 wrote to memory of 1396 3876 WaveInstaller.exe 93 PID 4160 wrote to memory of 1588 4160 WaveInstaller.exe 94 PID 4160 wrote to memory of 1588 4160 WaveInstaller.exe 94 PID 4160 wrote to memory of 1588 4160 WaveInstaller.exe 94 PID 4160 wrote to memory of 1004 4160 WaveInstaller.exe 95 PID 4160 wrote to memory of 1004 4160 WaveInstaller.exe 95 PID 1588 wrote to memory of 5064 1588 WaveInstaller.exe 194 PID 1588 wrote to memory of 5064 1588 WaveInstaller.exe 194 PID 1588 wrote to memory of 5064 1588 WaveInstaller.exe 194 PID 1588 wrote to memory of 1504 1588 WaveInstaller.exe 97 PID 1588 wrote to memory of 1504 1588 WaveInstaller.exe 97 PID 5064 wrote to memory of 1852 5064 WaveInstaller.exe 98 PID 5064 wrote to memory of 1852 5064 WaveInstaller.exe 98 PID 5064 wrote to memory of 1852 5064 WaveInstaller.exe 98 PID 5064 wrote to memory of 2164 5064 WaveInstaller.exe 230 PID 5064 wrote to memory of 2164 5064 WaveInstaller.exe 230 PID 1852 wrote to memory of 752 1852 WaveInstaller.exe 133 PID 1852 wrote to memory of 752 1852 WaveInstaller.exe 133 PID 1852 wrote to memory of 752 1852 WaveInstaller.exe 133 PID 1852 wrote to memory of 2984 1852 WaveInstaller.exe 176 PID 1852 wrote to memory of 2984 1852 WaveInstaller.exe 176 PID 752 wrote to memory of 1136 752 WaveInstaller.exe 102 PID 752 wrote to memory of 1136 752 WaveInstaller.exe 102 PID 752 wrote to memory of 1136 752 WaveInstaller.exe 102 PID 752 wrote to memory of 1688 752 WaveInstaller.exe 103 PID 752 wrote to memory of 1688 752 WaveInstaller.exe 103 PID 1136 wrote to memory of 3776 1136 WaveInstaller.exe 312 PID 1136 wrote to memory of 3776 1136 WaveInstaller.exe 312 PID 1136 wrote to memory of 3776 1136 WaveInstaller.exe 312 PID 1136 wrote to memory of 2608 1136 WaveInstaller.exe 193 PID 1136 wrote to memory of 2608 1136 WaveInstaller.exe 193 PID 3776 wrote to memory of 912 3776 WaveInstaller.exe 106 PID 3776 wrote to memory of 912 3776 WaveInstaller.exe 106 PID 3776 wrote to memory of 912 3776 WaveInstaller.exe 106 PID 3776 wrote to memory of 2300 3776 WaveInstaller.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"14⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"15⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"16⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"17⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"18⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"19⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"20⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"21⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"22⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"23⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"24⤵
- Executes dropped EXE
PID:276 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"25⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"26⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"27⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"28⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"29⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"30⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"31⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"32⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"33⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"34⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"35⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"36⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"37⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"38⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"39⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"40⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"41⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"42⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"43⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"44⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"45⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"46⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"47⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"48⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"49⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"50⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"51⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"52⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"53⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"54⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"55⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"56⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"57⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"58⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"59⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"60⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"61⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"62⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"63⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"64⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"65⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"66⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"67⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"68⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"69⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"70⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"71⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"72⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"73⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"74⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"75⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"76⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"77⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"78⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"79⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"80⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"81⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"82⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"83⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"84⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"85⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"86⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"87⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"88⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"89⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"90⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"91⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"92⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"93⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"94⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"95⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"96⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"97⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"98⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"99⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"100⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"102⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"103⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"104⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"105⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"106⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"107⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"108⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"109⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"110⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"111⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"112⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"113⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"114⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"115⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"116⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"117⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"118⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"119⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"120⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"121⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"122⤵PID:1072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-