Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
12-11-2021 18:04
211112-wnzb8aahhm 1019-11-2020 10:08
201119-rhwlt38jrx 1018-11-2020 17:26
201118-htd4fq29va 10Analysis
-
max time kernel
1311s -
max time network
1326s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-11-2020 10:08
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral8
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
OnlineInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
amtemu.v0.9.2.win-painter_edited.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
api.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
default.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
Behavioral task
behavioral28
Sample
good.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
infected dot net installer.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
oof.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
ou55sg33s_1.exe
Resource
win10v20201028
General
-
Target
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Score
8/10
Malware Config
Signatures
-
Creates new service(s) ⋅ 1 TTPs
TTPs:
-
Downloads MZ/PE file
-
Executes dropped EXE ⋅ 7 IoCs
Processes:
WCInstaller.exeWebCompanionInstaller.exeWebCompanion.exeLavasoft.WCAssistant.WinService.exeAd-Aware Web Companion.exeWebCompanion.exe349C.tmp.exepid process 3504 WCInstaller.exe 3480 WebCompanionInstaller.exe 1336 WebCompanion.exe 3176 Lavasoft.WCAssistant.WinService.exe 2596 Ad-Aware Web Companion.exe 3972 WebCompanion.exe 3496 349C.tmp.exe -
Loads dropped DLL ⋅ 64 IoCs
Processes:
WebCompanionInstaller.exeWebCompanion.exepid process 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 3480 WebCompanionInstaller.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe -
Reads user/profile data of web browsers ⋅ 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application ⋅ 2 TTPs 1 IoCs
Processes:
WebCompanion.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize " WebCompanion.exe -
Checks installed software on the system ⋅ 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
TTPs:
-
Drops desktop.ini file(s) ⋅ 2 IoCs
Processes:
WebCompanion.exedescription ioc process File created C:\Windows\assembly\Desktop.ini WebCompanion.exe File opened for modification C:\Windows\assembly\Desktop.ini WebCompanion.exe -
Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
TTPs:
-
Looks up external IP address via web service ⋅ 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
Drops file in System32 directory ⋅ 4 IoCs
Processes:
Lavasoft.WCAssistant.WinService.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2 Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2 Lavasoft.WCAssistant.WinService.exe -
Drops file in Program Files directory ⋅ 64 IoCs
Processes:
WebCompanionInstaller.exedescription ioc process File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionExtensionIE.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.pdb WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon_Pro.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.Shell32.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe -
Drops file in Windows directory ⋅ 7 IoCs
Processes:
WebCompanionInstaller.exeWebCompanion.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new WebCompanionInstaller.exe File opened for modification C:\Windows\assembly WebCompanion.exe File created C:\Windows\assembly\Desktop.ini WebCompanion.exe File opened for modification C:\Windows\assembly\Desktop.ini WebCompanion.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new WebCompanion.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new WebCompanion.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new WebCompanionInstaller.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
TTPs:
Processes:
WebCompanion.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ShowSearchSuggestions = "1" WebCompanion.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ShowTopResult = "1" WebCompanion.exe Key deleted \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} WebCompanion.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?pc=COS2&ptag=D111920-N0700AB91A1A2A71DC4AF78EF&form=CONBDF&conlogo=CT3331955&q={searchTerms}" WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\OSDFileURL = " " WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\TopResultURL = "http://www.bing.com/search?pc=COS2&ptag=D111920-N0700AB91A1A2A71DC4AF78EF&form=CONBDF&conlogo=CT3331955&q={searchTerms}" WebCompanion.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "https://www.bing.com/osjson.aspx?query={searchTerms}" WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\ProgramData\\Lavasoft\\Web Companion\\Icons\\bing.ico" WebCompanion.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" WebCompanion.exe -
Modifies Internet Explorer start page ⋅ 1 TTPs 1 IoCs
TTPs:
Processes:
WebCompanion.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.bing.com/?pc=COS2&ptag=D111920-AB91A1A2A71DC4AF78EF&form=CONMHP&conlogo=CT3331955" WebCompanion.exe -
Modifies data under HKEY_USERS ⋅ 54 IoCs
Processes:
Lavasoft.WCAssistant.WinService.exenetsh.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Lavasoft.WCAssistant.WinService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Lavasoft.WCAssistant.WinService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Lavasoft.WCAssistant.WinService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Lavasoft.WCAssistant.WinService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM netsh.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet netsh.exe -
Processes:
WebCompanionInstaller.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WebCompanionInstaller.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 15 IoCs
Processes:
Lavasoft.WCAssistant.WinService.exeWebCompanion.exeWebCompanion.exepid process 3176 Lavasoft.WCAssistant.WinService.exe 3176 Lavasoft.WCAssistant.WinService.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 1336 WebCompanion.exe 3972 WebCompanion.exe 3972 WebCompanion.exe 3972 WebCompanion.exe 3972 WebCompanion.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 15 IoCs
Processes:
WebCompanion.exeLavasoft.WCAssistant.WinService.exeWebCompanion.exedescription pid process Token: SeDebugPrivilege 1336 WebCompanion.exe Token: SeDebugPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeAssignPrimaryTokenPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeIncreaseQuotaPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeSecurityPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeTakeOwnershipPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeLoadDriverPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeSystemtimePrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeBackupPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeRestorePrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeShutdownPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeSystemEnvironmentPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeUndockPrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeManageVolumePrivilege 3176 Lavasoft.WCAssistant.WinService.exe Token: SeDebugPrivilege 3972 WebCompanion.exe -
Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
Processes:
WebCompanion.exepid process 3972 WebCompanion.exe -
Suspicious use of SendNotifyMessage ⋅ 1 IoCs
Processes:
WebCompanion.exepid process 3972 WebCompanion.exe -
Suspicious use of WriteProcessMemory ⋅ 53 IoCs
Processes:
Archive.zip__ccacaxs2tbz2t6ob3e.exeWCInstaller.exeWebCompanionInstaller.execmd.exeLavasoft.WCAssistant.WinService.execmd.exeWebCompanion.execsc.execsc.exeWebCompanion.execsc.exedescription pid process target process PID 8 wrote to memory of 3504 8 Archive.zip__ccacaxs2tbz2t6ob3e.exe WCInstaller.exe PID 8 wrote to memory of 3504 8 Archive.zip__ccacaxs2tbz2t6ob3e.exe WCInstaller.exe PID 8 wrote to memory of 3504 8 Archive.zip__ccacaxs2tbz2t6ob3e.exe WCInstaller.exe PID 3504 wrote to memory of 3480 3504 WCInstaller.exe WebCompanionInstaller.exe PID 3504 wrote to memory of 3480 3504 WCInstaller.exe WebCompanionInstaller.exe PID 3504 wrote to memory of 3480 3504 WCInstaller.exe WebCompanionInstaller.exe PID 3480 wrote to memory of 3632 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 3632 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 3632 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 3244 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 3244 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 3244 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 1524 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 1524 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 1524 3480 WebCompanionInstaller.exe sc.exe PID 3480 wrote to memory of 1876 3480 WebCompanionInstaller.exe cmd.exe PID 3480 wrote to memory of 1876 3480 WebCompanionInstaller.exe cmd.exe PID 3480 wrote to memory of 1876 3480 WebCompanionInstaller.exe cmd.exe PID 1876 wrote to memory of 1552 1876 cmd.exe netsh.exe PID 1876 wrote to memory of 1552 1876 cmd.exe netsh.exe PID 1876 wrote to memory of 1552 1876 cmd.exe netsh.exe PID 3480 wrote to memory of 1336 3480 WebCompanionInstaller.exe WebCompanion.exe PID 3480 wrote to memory of 1336 3480 WebCompanionInstaller.exe WebCompanion.exe PID 3480 wrote to memory of 1336 3480 WebCompanionInstaller.exe WebCompanion.exe PID 3176 wrote to memory of 3808 3176 Lavasoft.WCAssistant.WinService.exe cmd.exe PID 3176 wrote to memory of 3808 3176 Lavasoft.WCAssistant.WinService.exe cmd.exe PID 3808 wrote to memory of 3712 3808 cmd.exe netsh.exe PID 3808 wrote to memory of 3712 3808 cmd.exe netsh.exe PID 1336 wrote to memory of 1884 1336 WebCompanion.exe csc.exe PID 1336 wrote to memory of 1884 1336 WebCompanion.exe csc.exe PID 1336 wrote to memory of 1884 1336 WebCompanion.exe csc.exe PID 1884 wrote to memory of 4020 1884 csc.exe cvtres.exe PID 1884 wrote to memory of 4020 1884 csc.exe cvtres.exe PID 1884 wrote to memory of 4020 1884 csc.exe cvtres.exe PID 3176 wrote to memory of 996 3176 Lavasoft.WCAssistant.WinService.exe csc.exe PID 3176 wrote to memory of 996 3176 Lavasoft.WCAssistant.WinService.exe csc.exe PID 996 wrote to memory of 1044 996 csc.exe cvtres.exe PID 996 wrote to memory of 1044 996 csc.exe cvtres.exe PID 1336 wrote to memory of 2596 1336 WebCompanion.exe Ad-Aware Web Companion.exe PID 1336 wrote to memory of 2596 1336 WebCompanion.exe Ad-Aware Web Companion.exe PID 1336 wrote to memory of 2596 1336 WebCompanion.exe Ad-Aware Web Companion.exe PID 3480 wrote to memory of 3972 3480 WebCompanionInstaller.exe WebCompanion.exe PID 3480 wrote to memory of 3972 3480 WebCompanionInstaller.exe WebCompanion.exe PID 3480 wrote to memory of 3972 3480 WebCompanionInstaller.exe WebCompanion.exe PID 8 wrote to memory of 3496 8 Archive.zip__ccacaxs2tbz2t6ob3e.exe 349C.tmp.exe PID 8 wrote to memory of 3496 8 Archive.zip__ccacaxs2tbz2t6ob3e.exe 349C.tmp.exe PID 8 wrote to memory of 3496 8 Archive.zip__ccacaxs2tbz2t6ob3e.exe 349C.tmp.exe PID 3972 wrote to memory of 3824 3972 WebCompanion.exe csc.exe PID 3972 wrote to memory of 3824 3972 WebCompanion.exe csc.exe PID 3972 wrote to memory of 3824 3972 WebCompanion.exe csc.exe PID 3824 wrote to memory of 3896 3824 csc.exe cvtres.exe PID 3824 wrote to memory of 3896 3824 csc.exe cvtres.exe PID 3824 wrote to memory of 3896 3824 csc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exePID:8"C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exePID:3504C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292Executes dropped EXESuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exePID:3480.\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=7.0.2354.4185 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292Executes dropped EXELoads dropped DLLDrops file in Program Files directoryDrops file in Windows directoryModifies system certificate storeSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exePID:3632"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
-
C:\Windows\SysWOW64\sc.exePID:3244"sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
-
C:\Windows\SysWOW64\sc.exePID:1524"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
-
C:\Windows\SysWOW64\cmd.exePID:1876"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=EveryoneSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exePID:1552netsh http add urlacl url=http://+:9007/ user=Everyone
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exePID:1336"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=Executes dropped EXELoads dropped DLLAdds Run key to start applicationDrops desktop.ini file(s)Drops file in Windows directoryModifies Internet Explorer settingsModifies Internet Explorer start pageSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exePID:1884"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jd2_ow1z.cmdline"Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exePID:4020C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA49E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA49D.tmp"
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exePID:2596"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe" {0633EE93-D776-472f-A0FF-E1416B8B2E3A}Executes dropped EXE
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exePID:3972"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstallExecutes dropped EXESuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of FindShellTrayWindowSuspicious use of SendNotifyMessageSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exePID:3824"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rjgxmwqy.cmdline"Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exePID:3896C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA66B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA66A.tmp"
-
C:\Users\Admin\AppData\Local\Temp\349C.tmp.exePID:3496C:\Users\Admin\AppData\Local\Temp\349C.tmp.exeExecutes dropped EXE
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exePID:3176"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"Executes dropped EXEDrops file in System32 directoryModifies data under HKEY_USERSSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exePID:3808"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=EveryoneSuspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exePID:3712netsh http add urlacl url=http://+:9007/ user=EveryoneModifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exePID:996"C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\q-9f8yo_.cmdline"Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exePID:1044C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESBFA8.tmp" "c:\Windows\Temp\CSCBFA7.tmp"
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exePID:3080C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\VCRUNTIME140D.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
-
C:\ProgramData\Application Data\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
-
C:\ProgramData\Lavasoft\Web Companion\Logs\WindowsService\WCAssistantServiceLog.log
-
C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip
-
C:\ProgramData\Lavasoft\Web Companion\Options\EventSafeguard.txt
-
C:\ProgramData\Lavasoft\Web Companion\Options\Partner.txt
-
C:\ProgramData\Lavasoft\Web Companion\Options\ProfileInfo.txt
-
C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
-
C:\ProgramData\Lavasoft\Web Companion\Options\Statistics.txt
-
C:\ProgramData\Lavasoft\Web Companion\Options\UpdateServer.txt
-
C:\ProgramData\Lavasoft\Web Companion\Options\b_search.json
-
C:\ProgramData\Lavasoft\Web Companion\Options\install.txt
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2
-
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\7.0.2354.4185\user.config
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WebCompanion.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WebCompanion.exe.log
-
C:\Users\Admin\AppData\Local\Temp\349C.tmp.exe
-
C:\Users\Admin\AppData\Local\Temp\349C.tmp.exe
-
C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll
-
C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll
-
C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe
-
C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe
-
C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe.config
-
C:\Users\Admin\AppData\Local\Temp\RESA49E.tmp
-
C:\Users\Admin\AppData\Local\Temp\RESA66B.tmp
-
C:\Users\Admin\AppData\Local\Temp\Recover.txt
-
C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
-
C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
-
C:\Users\Admin\AppData\Local\Temp\jd2_ow1z.dll
-
C:\Users\Admin\AppData\Local\Temp\rjgxmwqy.dll
-
C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt
-
C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\IData.txt
-
C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release\prefs.js
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release\search.json.mozlz4
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
-
C:\Windows\TEMP\RESBFA8.tmp
-
C:\Windows\TEMP\q-9f8yo_.dll
-
\??\c:\Users\Admin\AppData\Local\Temp\CSCA49D.tmp
-
\??\c:\Users\Admin\AppData\Local\Temp\CSCA66A.tmp
-
\??\c:\Users\Admin\AppData\Local\Temp\jd2_ow1z.0.cs
-
\??\c:\Users\Admin\AppData\Local\Temp\jd2_ow1z.cmdline
-
\??\c:\Users\Admin\AppData\Local\Temp\rjgxmwqy.0.cs
-
\??\c:\Users\Admin\AppData\Local\Temp\rjgxmwqy.cmdline
-
\??\c:\Windows\Temp\CSCBFA7.tmp
-
\??\c:\Windows\Temp\q-9f8yo_.0.cs
-
\??\c:\Windows\Temp\q-9f8yo_.cmdline
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll
-
\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll
-
\Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll
-
memory/996-126-0x0000000000000000-mapping.dmp
-
memory/1044-129-0x0000000000000000-mapping.dmp
-
memory/1336-98-0x000000006F290000-0x000000006F97E000-memory.dmp
-
memory/1336-101-0x000000000AEE0000-0x000000000AEE1000-memory.dmp
-
memory/1336-23-0x0000000000000000-mapping.dmp
-
memory/1336-146-0x0000000007640000-0x0000000007650000-memory.dmp
-
memory/1524-20-0x0000000000000000-mapping.dmp
-
memory/1552-22-0x0000000000000000-mapping.dmp
-
memory/1876-21-0x0000000000000000-mapping.dmp
-
memory/1884-112-0x0000000000000000-mapping.dmp
-
memory/2596-134-0x0000000000000000-mapping.dmp
-
memory/3080-226-0x00007FFE6C0E0000-0x00007FFE6CA80000-memory.dmp
-
memory/3176-107-0x00007FFE6C0E0000-0x00007FFE6CA80000-memory.dmp
-
memory/3244-19-0x0000000000000000-mapping.dmp
-
memory/3480-3-0x0000000000000000-mapping.dmp
-
memory/3496-229-0x0000000000000000-mapping.dmp
-
memory/3504-0-0x0000000000000000-mapping.dmp
-
memory/3632-18-0x0000000000000000-mapping.dmp
-
memory/3712-111-0x0000000000000000-mapping.dmp
-
memory/3808-110-0x0000000000000000-mapping.dmp
-
memory/3824-238-0x0000000000000000-mapping.dmp
-
memory/3896-241-0x0000000000000000-mapping.dmp
-
memory/3972-154-0x0000000000000000-mapping.dmp
-
memory/3972-210-0x000000000D550000-0x000000000D551000-memory.dmp
-
memory/3972-207-0x000000006F610000-0x000000006FCFE000-memory.dmp
-
memory/4020-115-0x0000000000000000-mapping.dmp
Loading data