Downloads.rar

General
Target

Archive.zip__ccacaxs2tbz2t6ob3e.exe

Filesize

139MB

Completed

19-11-2020 10:40

Score
8 /10
Malware Config
Signatures 23

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Creates new service(s)

    TTPs

    New Service
  • Executes dropped EXE
    WCInstaller.exeWebCompanionInstaller.exeWebCompanion.exeLavasoft.WCAssistant.WinService.exeAd-Aware Web Companion.exeWebCompanion.exe349C.tmp.exe

    Reported IOCs

    pidprocess
    3504WCInstaller.exe
    3480WebCompanionInstaller.exe
    1336WebCompanion.exe
    3176Lavasoft.WCAssistant.WinService.exe
    2596Ad-Aware Web Companion.exe
    3972WebCompanion.exe
    3496349C.tmp.exe
  • Loads dropped DLL
    WebCompanionInstaller.exeWebCompanion.exe

    Reported IOCs

    pidprocess
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    3480WebCompanionInstaller.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    WebCompanion.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "WebCompanion.exe
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Drops desktop.ini file(s)
    WebCompanion.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\assembly\Desktop.iniWebCompanion.exe
    File opened for modificationC:\Windows\assembly\Desktop.iniWebCompanion.exe
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    18ip-api.com
  • Drops file in System32 directory
    Lavasoft.WCAssistant.WinService.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CELavasoft.WCAssistant.WinService.exe
    File opened for modificationC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CELavasoft.WCAssistant.WinService.exe
    File opened for modificationC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2Lavasoft.WCAssistant.WinService.exe
    File opened for modificationC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2Lavasoft.WCAssistant.WinService.exe
  • Drops file in Program Files directory
    WebCompanionInstaller.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.Shell32.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebcompaionReimageIcon.icoWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon_Pro.icoWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exeWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Microsoft.mshtml.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe.configWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Extension\@wcextensionff.xpiWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.SHDocVw.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exeWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.configWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exeWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.configWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exeWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe.configWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.pdbWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\LZ4.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exeWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUSDK.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dllWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exeWebCompanionInstaller.exe
    File createdC:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dllWebCompanionInstaller.exe
  • Drops file in Windows directory
    WebCompanionInstaller.exeWebCompanion.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.newWebCompanionInstaller.exe
    File createdC:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.newWebCompanionInstaller.exe
    File opened for modificationC:\Windows\assemblyWebCompanion.exe
    File createdC:\Windows\assembly\Desktop.iniWebCompanion.exe
    File opened for modificationC:\Windows\assembly\Desktop.iniWebCompanion.exe
    File createdC:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.newWebCompanion.exe
    File createdC:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.newWebCompanion.exe
  • Launches sc.exe

    Description

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies Internet Explorer settings
    WebCompanion.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\ProgramData\\Lavasoft\\Web Companion\\Icons\\bing.ico"WebCompanion.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"WebCompanion.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ShowSearchSuggestions = "1"WebCompanion.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\TopResultURL = "http://www.bing.com/search?pc=COS2&ptag=D111920-N0700AB91A1A2A71DC4AF78EF&form=CONBDF&conlogo=CT3331955&q={searchTerms}"WebCompanion.exe
    Key created\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}WebCompanion.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "https://www.bing.com/osjson.aspx?query={searchTerms}"WebCompanion.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?pc=COS2&ptag=D111920-N0700AB91A1A2A71DC4AF78EF&form=CONBDF&conlogo=CT3331955&q={searchTerms}"WebCompanion.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\OSDFileURL = " "WebCompanion.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ShowTopResult = "1"WebCompanion.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"WebCompanion.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}WebCompanion.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"WebCompanion.exe
  • Modifies Internet Explorer start page
    WebCompanion.exe

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.bing.com/?pc=COS2&ptag=D111920-AB91A1A2A71DC4AF78EF&form=CONMHP&conlogo=CT3331955"WebCompanion.exe
  • Modifies data under HKEY_USERS
    Lavasoft.WCAssistant.WinService.exenetsh.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeopleLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLsLavasoft.WCAssistant.WinService.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000Lavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLsLavasoft.WCAssistant.WinService.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"Lavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\System\CurrentControlSetnetsh.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CALavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trustLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRootLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLsLavasoft.WCAssistant.WinService.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"Lavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\SYSTEMnetsh.exe
    Key created\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Controlnetsh.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeopleLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\RootLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Sessionnetsh.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\DisallowedLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLsLavasoft.WCAssistant.WinService.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"Lavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CALavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software PublishingLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CertificatesLavasoft.WCAssistant.WinService.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"Lavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\DisallowedLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Lavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTracenetsh.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CertificatesLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLsLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trustLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCacheLavasoft.WCAssistant.WinService.exe
    Key created\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTracenetsh.exe
  • Modifies system certificate store
    WebCompanionInstaller.exe

    TTPs

    Install Root CertificateModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43WebCompanionInstaller.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2WebCompanionInstaller.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2WebCompanionInstaller.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2WebCompanionInstaller.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2WebCompanionInstaller.exe
  • Suspicious behavior: EnumeratesProcesses
    Lavasoft.WCAssistant.WinService.exeWebCompanion.exeWebCompanion.exe

    Reported IOCs

    pidprocess
    3176Lavasoft.WCAssistant.WinService.exe
    3176Lavasoft.WCAssistant.WinService.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    1336WebCompanion.exe
    3972WebCompanion.exe
    3972WebCompanion.exe
    3972WebCompanion.exe
    3972WebCompanion.exe
  • Suspicious use of AdjustPrivilegeToken
    WebCompanion.exeLavasoft.WCAssistant.WinService.exeWebCompanion.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1336WebCompanion.exe
    Token: SeDebugPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeAssignPrimaryTokenPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeIncreaseQuotaPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeSecurityPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeTakeOwnershipPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeLoadDriverPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeSystemtimePrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeBackupPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeRestorePrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeShutdownPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeSystemEnvironmentPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeUndockPrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeManageVolumePrivilege3176Lavasoft.WCAssistant.WinService.exe
    Token: SeDebugPrivilege3972WebCompanion.exe
  • Suspicious use of FindShellTrayWindow
    WebCompanion.exe

    Reported IOCs

    pidprocess
    3972WebCompanion.exe
  • Suspicious use of SendNotifyMessage
    WebCompanion.exe

    Reported IOCs

    pidprocess
    3972WebCompanion.exe
  • Suspicious use of WriteProcessMemory
    Archive.zip__ccacaxs2tbz2t6ob3e.exeWCInstaller.exeWebCompanionInstaller.execmd.exeLavasoft.WCAssistant.WinService.execmd.exeWebCompanion.execsc.execsc.exeWebCompanion.execsc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 8 wrote to memory of 35048Archive.zip__ccacaxs2tbz2t6ob3e.exeWCInstaller.exe
    PID 8 wrote to memory of 35048Archive.zip__ccacaxs2tbz2t6ob3e.exeWCInstaller.exe
    PID 8 wrote to memory of 35048Archive.zip__ccacaxs2tbz2t6ob3e.exeWCInstaller.exe
    PID 3504 wrote to memory of 34803504WCInstaller.exeWebCompanionInstaller.exe
    PID 3504 wrote to memory of 34803504WCInstaller.exeWebCompanionInstaller.exe
    PID 3504 wrote to memory of 34803504WCInstaller.exeWebCompanionInstaller.exe
    PID 3480 wrote to memory of 36323480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 36323480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 36323480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 32443480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 32443480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 32443480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 15243480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 15243480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 15243480WebCompanionInstaller.exesc.exe
    PID 3480 wrote to memory of 18763480WebCompanionInstaller.execmd.exe
    PID 3480 wrote to memory of 18763480WebCompanionInstaller.execmd.exe
    PID 3480 wrote to memory of 18763480WebCompanionInstaller.execmd.exe
    PID 1876 wrote to memory of 15521876cmd.exenetsh.exe
    PID 1876 wrote to memory of 15521876cmd.exenetsh.exe
    PID 1876 wrote to memory of 15521876cmd.exenetsh.exe
    PID 3480 wrote to memory of 13363480WebCompanionInstaller.exeWebCompanion.exe
    PID 3480 wrote to memory of 13363480WebCompanionInstaller.exeWebCompanion.exe
    PID 3480 wrote to memory of 13363480WebCompanionInstaller.exeWebCompanion.exe
    PID 3176 wrote to memory of 38083176Lavasoft.WCAssistant.WinService.execmd.exe
    PID 3176 wrote to memory of 38083176Lavasoft.WCAssistant.WinService.execmd.exe
    PID 3808 wrote to memory of 37123808cmd.exenetsh.exe
    PID 3808 wrote to memory of 37123808cmd.exenetsh.exe
    PID 1336 wrote to memory of 18841336WebCompanion.execsc.exe
    PID 1336 wrote to memory of 18841336WebCompanion.execsc.exe
    PID 1336 wrote to memory of 18841336WebCompanion.execsc.exe
    PID 1884 wrote to memory of 40201884csc.execvtres.exe
    PID 1884 wrote to memory of 40201884csc.execvtres.exe
    PID 1884 wrote to memory of 40201884csc.execvtres.exe
    PID 3176 wrote to memory of 9963176Lavasoft.WCAssistant.WinService.execsc.exe
    PID 3176 wrote to memory of 9963176Lavasoft.WCAssistant.WinService.execsc.exe
    PID 996 wrote to memory of 1044996csc.execvtres.exe
    PID 996 wrote to memory of 1044996csc.execvtres.exe
    PID 1336 wrote to memory of 25961336WebCompanion.exeAd-Aware Web Companion.exe
    PID 1336 wrote to memory of 25961336WebCompanion.exeAd-Aware Web Companion.exe
    PID 1336 wrote to memory of 25961336WebCompanion.exeAd-Aware Web Companion.exe
    PID 3480 wrote to memory of 39723480WebCompanionInstaller.exeWebCompanion.exe
    PID 3480 wrote to memory of 39723480WebCompanionInstaller.exeWebCompanion.exe
    PID 3480 wrote to memory of 39723480WebCompanionInstaller.exeWebCompanion.exe
    PID 8 wrote to memory of 34968Archive.zip__ccacaxs2tbz2t6ob3e.exe349C.tmp.exe
    PID 8 wrote to memory of 34968Archive.zip__ccacaxs2tbz2t6ob3e.exe349C.tmp.exe
    PID 8 wrote to memory of 34968Archive.zip__ccacaxs2tbz2t6ob3e.exe349C.tmp.exe
    PID 3972 wrote to memory of 38243972WebCompanion.execsc.exe
    PID 3972 wrote to memory of 38243972WebCompanion.execsc.exe
    PID 3972 wrote to memory of 38243972WebCompanion.execsc.exe
    PID 3824 wrote to memory of 38963824csc.execvtres.exe
    PID 3824 wrote to memory of 38963824csc.execvtres.exe
    PID 3824 wrote to memory of 38963824csc.execvtres.exe
Processes 22
  • C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
    "C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
    Suspicious use of WriteProcessMemory
    PID:8
    • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe
        .\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=7.0.2354.4185 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
          PID:3632
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
          PID:3244
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
          PID:1524
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
          Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Windows\SysWOW64\netsh.exe
            netsh http add urlacl url=http://+:9007/ user=Everyone
            PID:1552
        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
          "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
          Executes dropped EXE
          Loads dropped DLL
          Adds Run key to start application
          Drops desktop.ini file(s)
          Drops file in Windows directory
          Modifies Internet Explorer settings
          Modifies Internet Explorer start page
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:1336
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jd2_ow1z.cmdline"
            Suspicious use of WriteProcessMemory
            PID:1884
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA49E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA49D.tmp"
              PID:4020
          • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe
            "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe" {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
            Executes dropped EXE
            PID:2596
        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
          "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of FindShellTrayWindow
          Suspicious use of SendNotifyMessage
          Suspicious use of WriteProcessMemory
          PID:3972
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rjgxmwqy.cmdline"
            Suspicious use of WriteProcessMemory
            PID:3824
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA66B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA66A.tmp"
              PID:3896
    • C:\Users\Admin\AppData\Local\Temp\349C.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\349C.tmp.exe
      Executes dropped EXE
      PID:3496
  • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
    "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
    Executes dropped EXE
    Drops file in System32 directory
    Modifies data under HKEY_USERS
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
      Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\system32\netsh.exe
        netsh http add urlacl url=http://+:9007/ user=Everyone
        Modifies data under HKEY_USERS
        PID:3712
    • C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\q-9f8yo_.cmdline"
      Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESBFA8.tmp" "c:\Windows\Temp\CSCBFA7.tmp"
        PID:1044
  • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    PID:3080
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe

                  MD5

                  02e9fd240b8a8dedbd51fc7e873043e3

                  SHA1

                  4eeefea404228d227f23757bd26dc7b899839169

                  SHA256

                  fef5d5b3c94361ad17a2628643547301aaa25843e4d5b745eb3665944979524e

                  SHA512

                  7452b1aaa851ea3043f492bfff664b4857a6165a9603fc1f397226f05089b31f6c99c6ea1eee13882fc5a38a512bc64ae297b445b23d6d8d8b10792526c1fed7

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe

                  MD5

                  02e9fd240b8a8dedbd51fc7e873043e3

                  SHA1

                  4eeefea404228d227f23757bd26dc7b899839169

                  SHA256

                  fef5d5b3c94361ad17a2628643547301aaa25843e4d5b745eb3665944979524e

                  SHA512

                  7452b1aaa851ea3043f492bfff664b4857a6165a9603fc1f397226f05089b31f6c99c6ea1eee13882fc5a38a512bc64ae297b445b23d6d8d8b10792526c1fed7

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

                  MD5

                  2886b136e336555167231b19897133a7

                  SHA1

                  54f6628386e7f984eccc482331f68ddd1c729630

                  SHA256

                  75d47819a4a1fb39a1c9d1c3c2a35d53bd901cfe376b6ccfd073f076659e6a6a

                  SHA512

                  e5479ad1719ef42a29f8f236c9c8ca21af663e3f2c7a5ad138773de8fcbb33db915d8353220a431e20b2c4cf508b409ef01083b0b49763a4c370a6aaeffd2816

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll

                  MD5

                  1f4193411d89839aa7ff77807e3fd3b5

                  SHA1

                  a0f88db9d6c38bbb1e7898e70f6a03593c38f817

                  SHA256

                  a47f07884e4ea3aa50ae31cd9070dd1c2ccd00f5121262b586d4bbf312ff5bb3

                  SHA512

                  89139e4fc656127fb7a87e0f46a8cf5e57110cdc3895defeffd24643f0c6967c35580e0c207ae47170284ca71b2e3e36712d4d932fc9d98fcccf4fb25d568bd4

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll

                  MD5

                  5d60ad3296504ed5eac20af2c93142f1

                  SHA1

                  2b6675310d4e27d5863dce9362e7eb2c24ae1b9a

                  SHA256

                  b696401efc2398f3525899676aff10697f78468179cb83da6c5f767139ab3c9a

                  SHA512

                  a7018fa8c93c820fbb43bcfabaa16dfd25162cf75d4dc591999be0339f306ccb45b3c9a41b1a6faa8a13f7a984e48614c92e7afdcf767aac9825e2a8ed709cc9

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll

                  MD5

                  1251fe09116ff1eb2870aa90058b2f37

                  SHA1

                  1711f9c4dc3e541a645a9d48038c8dda1bbd0277

                  SHA256

                  52cd32026695df516bc96ad67dd0ff1ab1aa5c48be7e2d8b268c6aee5fba612d

                  SHA512

                  f5527711ef2b3233a4b373862ca9acdc9f19e98236638ff38b70fbe06f90c133388a68098ce22709f7df59d89b451902d10d76fe3de12b209df892a3a2fefc21

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll

                  MD5

                  822aeb0ef8c4b215e4afc61c5f266d9f

                  SHA1

                  ed5c60447002caeccce58c6e0d5c9a66d30849a9

                  SHA256

                  570196388a5a84371fb84cd711373e4825f3e02fade65e2f5fa0eb72bd159748

                  SHA512

                  a8451e85fcc99fe52eea7df5064c88a1fab63de1a10df10ccbac79a513ebcdc29fffbd37db3220ee3a657fe20589b379648acc28e089be2aa9bd41a9cbe0d688

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

                  MD5

                  6974c555a16d2fa82f242840a586c17f

                  SHA1

                  8d04bae9cd54f94fa2750e5e5f9ef3bbc60f9ecf

                  SHA256

                  90ddde4fd7be47c9d859c9a70b5792f0d728a0431f26faf0efbc8cf077f0e5d9

                  SHA512

                  afd2bf30bc9217f78e34c6a107b5077ac0c757b7d71ba7dfe05be6cf8816aa7d4ae7cc015c0d1b4730277183971940f01674314f9f49f9b908646975fd97681e

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

                  MD5

                  6974c555a16d2fa82f242840a586c17f

                  SHA1

                  8d04bae9cd54f94fa2750e5e5f9ef3bbc60f9ecf

                  SHA256

                  90ddde4fd7be47c9d859c9a70b5792f0d728a0431f26faf0efbc8cf077f0e5d9

                  SHA512

                  afd2bf30bc9217f78e34c6a107b5077ac0c757b7d71ba7dfe05be6cf8816aa7d4ae7cc015c0d1b4730277183971940f01674314f9f49f9b908646975fd97681e

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config

                  MD5

                  aed25c4bb45d63f367ac309da2d91716

                  SHA1

                  295f9441ce64d87bc5489f2d5609e7704e302827

                  SHA256

                  534ff170605c383fa723b662e49daf7683c560727fd71211b28799c5a6af11af

                  SHA512

                  ad144c6152bd8fabcc89ff502595281298c3857a8f2193f6b391ed7e137fa4b2a9e0ffccd17c9c4fd5a691407d32339b4348b5faf260dcdb5d2d0e6a63b5fddd

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

                  MD5

                  043729fab50a9d6586a221f933141ae8

                  SHA1

                  a67d6a09d459a8cf987527f1fc623e14320f3f0a

                  SHA256

                  c0fc7e12ce776379fbb95c00d22c0463532d3a29d8daac073e1011c96f99acb4

                  SHA512

                  dc2abf2e6b99424436da19d9ddc00583add4dd120bd3ca570599a45fc769f22185eccedb5b9beff9c730e34260f55c983c69d7671f94d419a56506a68eabc326

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\VCRUNTIME140D.dll

                  MD5

                  6ae236d224b824d0acd49b4df3f2de66

                  SHA1

                  420c4b34950d9dadc33642ab27cd0bb8fd6d5e83

                  SHA256

                  10f746b2bec955d1640b1caaf6e242e4a1b25c02754667a9e9783b5cdc1b1d2e

                  SHA512

                  3465f3a706e5b452e0ea485a2f44ff91324091ec46a4b5dfd9cce8604693decb85c0164d3db14eec2874e6c9ac8d3a56da5694f24452ed2e2fdf40aa18f8f1b2

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

                  MD5

                  74adc34bd86c6bb013850136eb097456

                  SHA1

                  ad2a9a0544b48d1f42e7115eed1f24c6bc411913

                  SHA256

                  17850159d4cdb54ebd044b10ae62886a0e878576e6eb529e17e4750eacd99fd8

                  SHA512

                  d96f659f88b1ac6fc9501a4a71d26c02069c79d9edaa555c9c85b717c130e8eb3be9c656224e188f5ab7b991aec1f4e2008f1e86c5b52b18d4a0dfaca3bb9b80

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

                  MD5

                  74adc34bd86c6bb013850136eb097456

                  SHA1

                  ad2a9a0544b48d1f42e7115eed1f24c6bc411913

                  SHA256

                  17850159d4cdb54ebd044b10ae62886a0e878576e6eb529e17e4750eacd99fd8

                  SHA512

                  d96f659f88b1ac6fc9501a4a71d26c02069c79d9edaa555c9c85b717c130e8eb3be9c656224e188f5ab7b991aec1f4e2008f1e86c5b52b18d4a0dfaca3bb9b80

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

                  MD5

                  74adc34bd86c6bb013850136eb097456

                  SHA1

                  ad2a9a0544b48d1f42e7115eed1f24c6bc411913

                  SHA256

                  17850159d4cdb54ebd044b10ae62886a0e878576e6eb529e17e4750eacd99fd8

                  SHA512

                  d96f659f88b1ac6fc9501a4a71d26c02069c79d9edaa555c9c85b717c130e8eb3be9c656224e188f5ab7b991aec1f4e2008f1e86c5b52b18d4a0dfaca3bb9b80

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config

                  MD5

                  8a41e1820d9ffd37491c51b331b379ec

                  SHA1

                  f2e32cccc16fa110d76da596b34908869f855d16

                  SHA256

                  c3dc39ae81e9d1b01e3a9adac090a98f79e976e00550f5b047427f5eae958d00

                  SHA512

                  d2ab76d2278152d4031fc5251b7e897a1e0b02a510b495644b704c58f0bce7b253a6b1d236a77f97551077f60559257dd11d55273c89342e7f7ee3a2a1e89c5e

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico

                  MD5

                  1dd04466644e96e0ad308d1e637e9621

                  SHA1

                  0c7f688ca482fcd1fc9aa7d7518a5bc844875cff

                  SHA256

                  9733ed5e1e2caeb0986f1d46a052b2d4bd8cd6b041b9f57216f12410605e8455

                  SHA512

                  a92ff0a1b92b5b689bfc36a807f02d79b8dc3dd99971b3528aafceb8c1fc2dbc67bd170990723b34b26ac4ee7516efa6b218c2ed1d422a422ede7cf5fb9a3da1

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

                  MD5

                  77a4887a8fd764206848aa8dc7c78c4c

                  SHA1

                  5b2fd76639811a08f21f44c7f391be52c494df4d

                  SHA256

                  da0a2f7704f1340a9eb43fc47572e61a72b09fbd21dc5cf0a7e976baa8f18144

                  SHA512

                  3377331bdc9beff6c9af55673533fd81874c06ac16c87d4ddadbc11103237ddbd9e8cb048db25cf4270d4111913805f73dafe64369147ad732e636256eda91e6

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll

                  MD5

                  2cdf09227f553cead3bd4a82b3488163

                  SHA1

                  e5a2ccac77fa8ac38f5ad959f0983241e7b896f1

                  SHA256

                  e43eadd6a1a85c87c38ff8a389fb811098cadea335b5307c8ffe15e8bad8617d

                  SHA512

                  c0a0911eeeba38612b48173ce30bab35dab107355b6b49699239bbb2533ae5495f6ab6546c9adc51d91793c75db532cf2339d5cfd884625a6e1991522aee9294

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll

                  MD5

                  e73ac02aa5bdb381ae3a6f6864b959d6

                  SHA1

                  d18d6ebbdb818e208dcc2a465f98ddc4a0c20612

                  SHA256

                  cd0f806e16c749f9dfb3fa5288790bfdb5220eb6e261e86fbe20070ba1e2f81d

                  SHA512

                  62c7d746d48108a0b0fdcf25ad2570a15801b4401559057c0944573abac3b41bfa9708cb2836c6891221f265591b458ac6c69022303a73a09686b8109346a31f

                • C:\ProgramData\Application Data\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

                  MD5

                  c0302fa9a6bc83039ac79650df842a14

                  SHA1

                  c05b82a23bb776725d3bd6cb23232449e1c1fb7a

                  SHA256

                  a3fcae30626bdd0fcc400db602d66be5a20b7e35a62edd79307acfd29f737d27

                  SHA512

                  6f4a5198ffdcd7254f2621d51bb5fdff302755e6cf54cceae1bab70e0540dbb67d0a8823b98d0ca961704ab5c6db46756ae5eb194770ddb2664c27ea5bc2c442

                • C:\ProgramData\Lavasoft\Web Companion\Logs\WindowsService\WCAssistantServiceLog.log

                  MD5

                  56071857d58546cf8a59d072a4ebb4a7

                  SHA1

                  17c343d24a75647be861bf277a774d773c56cf97

                  SHA256

                  a76ceaf4b57f768a68632eba2b53ad37d5693fd76ddf43349bf2ad039cd5051d

                  SHA512

                  33268084a2c2dfad6ee8e16824297e638cd78353080acc258281e996af09cb5143d964c421119bf06f27b8debeb756e43adea59405b6c417b9be87ce5f9ec561

                • C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\ProgramData\Lavasoft\Web Companion\Options\EventSafeguard.txt

                  MD5

                  81051bcc2cf1bedf378224b0a93e2877

                  SHA1

                  ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                  SHA256

                  7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                  SHA512

                  1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                • C:\ProgramData\Lavasoft\Web Companion\Options\Partner.txt

                  MD5

                  45a70d140009ac215d82dfbabbdd67fe

                  SHA1

                  181cc4691dc09735acdacabd272c4f366639f595

                  SHA256

                  bec9c22f95c27d962ad2c8892602f7ba8bd10c5a6a1d94b5cc2bf0bafa81ff19

                  SHA512

                  b86d450776b4e17e830ad10d5915a91ff4d80cb3f0f7733905790291d9b237d54293b94782fa9d6899a479e0055d5f60e55b9beac225705717a081d5f1e55041

                • C:\ProgramData\Lavasoft\Web Companion\Options\ProfileInfo.txt

                  MD5

                  c31231fe73b8b3696a5a864d040e4eca

                  SHA1

                  cd5b40a0b3d7e86de72fd6166b08ed32cfb949b2

                  SHA256

                  4be2a0ab08623f2fa8cc246e972030d22405319080fb240d53d5e82de47e4182

                  SHA512

                  9d32f93a2e82062852d85aa7fb7f23b1f8f903da980faab7df6da0eec7e17b9b5db1419a172c0ae9465b22c388d3d98185378eb0884ecf0de2cf043ee2f40cea

                • C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt

                  MD5

                  ef69199769b42c35299eb35fbaaf5e96

                  SHA1

                  64752952f65b824f6cd4e44e05916d5630cf1a7c

                  SHA256

                  dd4828f1de5aa213f477ccffcea126b32f5af82bbaebf95abae26381f67f7914

                  SHA512

                  60c4310142132c6631f91b41ef9bf5c43ac606cae5a6ada4b11bed667c3805ca4ec784e5e461b86b9dd3f87b052f503db3acf9890eea4f52dbcd5a4e4674966a

                • C:\ProgramData\Lavasoft\Web Companion\Options\Statistics.txt

                  MD5

                  b709e63cbc1f21ffb70d97dd90e61108

                  SHA1

                  dbc3ecda40d6d57702e79342f5fb47281bd6c987

                  SHA256

                  b20c32f3a0b13940aecc0c3136d9161d3c92e389f645a0daeff03d27cf705b7f

                  SHA512

                  04a07cddff91473523cae80f44c323be0d047fd772c4db69da54adcf91c12717b45bef10eff5e7d8f58cea7b8124d2aae55e03368696a7094572ee957a12ce97

                • C:\ProgramData\Lavasoft\Web Companion\Options\UpdateServer.txt

                  MD5

                  cf85989b75515ff6cbaaa6dd23d3882a

                  SHA1

                  3fbbecbcc28e2d4de5764388bc544db47ae9957d

                  SHA256

                  50e3bd90035ca49b3c57050681449c20953f4efe5711bf4e02e23f2b63968388

                  SHA512

                  77ac3fa88b08c136c29b907cb1c9b096ee7f97bde3ec8d6c9382ca9e74060a065ef9aefc488a5319e9d1570522056584250be7abd5ed582e8b4d16f4143e7527

                • C:\ProgramData\Lavasoft\Web Companion\Options\b_search.json

                  MD5

                  4087d92e9598542d9d24b68ff575002f

                  SHA1

                  75cb65ae6863bfad6b906d1d887b0fe259e2c3cb

                  SHA256

                  499c2fa2107713b651597b860be368af806b4aeaf80b3826d275b5fb6b0ae573

                  SHA512

                  23b430376a5148b685b46b8271d3f6c3d39fa14f9b41565b8cf2e686ddfbac31b287046f2c723a05470753e88999fa66c500cc0cb4dba2f903b7aa81fdf5148f

                • C:\ProgramData\Lavasoft\Web Companion\Options\install.txt

                  MD5

                  3ca1cfa3e7fecbd3a3a49f70c4a6861c

                  SHA1

                  fc5be61b006870337b226f4142add47300ff608a

                  SHA256

                  4951e2cac9cffe384ec3ca07538c879683461ec632a1b3cf67b1c31f73800c25

                  SHA512

                  6531fd15b5d21144ce52186b96dab2e8374b57338f58f6a423a0b67decbafe6ab70b4ef3750fe2bba5de1d1b3327326c3d4b4f7414307cf445b57a427b116bee

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

                  MD5

                  d34f22e6c38b0c1001c438d540521dfe

                  SHA1

                  611b3943c4ea76d0fbd4389b9b9cf6752e6cf559

                  SHA256

                  718ed9d7a7f5388d9b7dab44997e735c15d4bd942eca01927ffd3f4191bec70c

                  SHA512

                  d212af023dc059a0d736d844e2c55018088272245e6bb36c4a7994998b1efcb68ccc6e926cbffa607cbd034ff59671acfec9de6c141ff6533cd7691b176dfc8d

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2

                  MD5

                  ec700ec141114aff995111e6d06f0774

                  SHA1

                  1559e795625f3982563a8a1f47ff0980de30104e

                  SHA256

                  e0bd8a0df47052d478c5a0714e5ed927bf5abe03252c24c6f2cba5f7618b6a81

                  SHA512

                  02566472ff24183362fab1fa515f354da6b6066fd9147680d2936b67f4e6db4e161db897b909549d0a0d7365549cb7ddbd99704a347f69d225622afdad8173fd

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

                  MD5

                  6372548ea35db1ee4679604e168b1d52

                  SHA1

                  8d96b3b0826e590cf6cd0a51b850d6ba17d48111

                  SHA256

                  6a1c53fb2bb615e8fad83d46e2d8aeaf20f3cdd636e29ed3b355b52fce0f5f06

                  SHA512

                  a45027ab0a0568531a17d3851cac26f94fa07c5feb9bb025a645bdecfa4bf9ca2a871dc74db69c2b2fc9df0b7f4a4e6871026e3e6e6ec59915a19404a7ba87e9

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2

                  MD5

                  c4a0e62770b1c8f55d30aa01e8fc8373

                  SHA1

                  5991f4d875e4b1906abee41b9947fbebd34f55f8

                  SHA256

                  09ee6967508240c3e4d90460679c140f2444c80a94faa482a4a9b1005d258eaf

                  SHA512

                  8f91d7aed6d023238597590f914931f955a2b45421d2a907de45584ae0417a99cc640ed2785bde42deea294c76fb80ded1bc3dc3d8e77697a53dd3c31785349b

                • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\7.0.2354.4185\user.config

                  MD5

                  bd686bea7a1cb3473cf4b21a620f8b2c

                  SHA1

                  e6089e64a69e09fca1df7900e13cec83d04fd6c5

                  SHA256

                  907a97355493b72edc3bf31cb85bad65b13e0b01b9534ff209c53b388c5b5f9b

                  SHA512

                  32e3b03cccd3c1d32c827bbc2cf77b53a93b7d21d00d34f67e51c56b48dbd2996de5e8d4e7ef07c54e49d39d61c7686a5fd6b6a0a799cd090ebb26b0aa0aa7ce

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WebCompanion.exe.log

                  MD5

                  e965acc4a4da72816eecd355d74cf2fa

                  SHA1

                  18f286663b02c158d89c372934ec0ee4458173d5

                  SHA256

                  86a249faa90fb73edfe2b07606299f05855d8e3e786242c62f0b32d142625f00

                  SHA512

                  fb4880f83c167e6a1441769242400cbcddad20675435479f22288bbbf7125505b7833abd19d5d0b68c4dbe5e6ac17b8e0968aba5d6156f8798f29895044f00fd

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WebCompanion.exe.log

                  MD5

                  957779c42144282d8cd83192b8fbc7cf

                  SHA1

                  de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

                  SHA256

                  0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

                  SHA512

                  f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

                • C:\Users\Admin\AppData\Local\Temp\349C.tmp.exe

                  MD5

                  060404f288040959694844afbd102966

                  SHA1

                  e0525e9ef6713fd7f269a669335ce3ddaab4b6a1

                  SHA256

                  40517e822f3442a2f389a50e905f40a6a2c4930077c865e3ea7b1929405f760a

                  SHA512

                  ddf8c53e1e1888084fa5422f297cc3ba9d97f7576c36f6b633ce67ca789127f7e259e9fb374fcbced66f883dadde0717d81ecce9776770bf07d8cf3b94b1a43f

                • C:\Users\Admin\AppData\Local\Temp\349C.tmp.exe

                  MD5

                  060404f288040959694844afbd102966

                  SHA1

                  e0525e9ef6713fd7f269a669335ce3ddaab4b6a1

                  SHA256

                  40517e822f3442a2f389a50e905f40a6a2c4930077c865e3ea7b1929405f760a

                  SHA512

                  ddf8c53e1e1888084fa5422f297cc3ba9d97f7576c36f6b633ce67ca789127f7e259e9fb374fcbced66f883dadde0717d81ecce9776770bf07d8cf3b94b1a43f

                • C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll

                  MD5

                  5a8ee1e57a63d4c6afd0b09eeb860219

                  SHA1

                  231ede81f741cb3d736f360dc5d5bfb2ac44ba12

                  SHA256

                  dc009d4ebdb578c98e4edc752ed7dcd46fc3ffa199ecaccbec5542dd3b34eaa6

                  SHA512

                  1beed12d412c6b2d62ade03888a0f31b1b4735e6f93270d0a3a5a91773f0084efe0ae4494f4b7969b37d07ca8c1266582725becbb34958e91b64d9bc6be9bb74

                • C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll

                  MD5

                  5d06e0b95f7e4128194a6f517125bede

                  SHA1

                  a78d45faffbc3628f2fc3243485e59fbd429721e

                  SHA256

                  530b79ff0f7dcfeceb0d369f7aa4ff9e0ee97b7c604cf8932c27dcbe29198b2c

                  SHA512

                  5de8b691f012454044c9737730b9b06239fdbdbb343407d299e1c5c58cd8cc63f12ba0c9520d695a4ac55eee239fd354d92e57d68b24a29c0494a3fa0730c861

                • C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe

                  MD5

                  86f911c125a0750b159990af56f524f6

                  SHA1

                  baedde9e161f5f5cbe470fe147978f1845dbdbc9

                  SHA256

                  0063bc6e62666112f32273e4175c62f78c9ad9c75e1fd8c6dbd2c56cf68a961c

                  SHA512

                  4c2cfcdb64df5b749aa5e448e12fafad3d9bf47b61f3b9c2423af1651acee373379338f4a0c52898fcd4dc6a9cb96c19b081eea5c9165d1ea90128e01053fbf3

                • C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe

                  MD5

                  86f911c125a0750b159990af56f524f6

                  SHA1

                  baedde9e161f5f5cbe470fe147978f1845dbdbc9

                  SHA256

                  0063bc6e62666112f32273e4175c62f78c9ad9c75e1fd8c6dbd2c56cf68a961c

                  SHA512

                  4c2cfcdb64df5b749aa5e448e12fafad3d9bf47b61f3b9c2423af1651acee373379338f4a0c52898fcd4dc6a9cb96c19b081eea5c9165d1ea90128e01053fbf3

                • C:\Users\Admin\AppData\Local\Temp\7zS0BD36935\WebCompanionInstaller.exe.config

                  MD5

                  0d86e732c7d385b99b69eb1ec27af0a3

                  SHA1

                  f5ff2bfc03b4b7704f5c2add6f7efcd7e177006e

                  SHA256

                  b33e2cb24a9641d16dab02ba41564b7b3a6cfd9c81843878d04f93b4a6ea875e

                  SHA512

                  87b8a4de11c14b9d0f3b93b26f8bab47c53feae3a00d4d11da7a1ff4dd3fd4408ffb9a2157752608800f0a0beaba15fb4dadaaa0d16db28c6604ca400979c36b

                • C:\Users\Admin\AppData\Local\Temp\RESA49E.tmp

                  MD5

                  7f7467cad2ff3209af82de8f796dadec

                  SHA1

                  2f5c09d526ae4000e1033ea79fbe1d13e3bdb7af

                  SHA256

                  ea893e38ae4c83a0006eaf6689e364f057f5f16645dfe283286d6da09d7e392b

                  SHA512

                  398092a6a4c72699df7856b0c7f8eacc8c9f716f0a0aa0b30182126956970c3c510aed36fc59a266ad3e17b1d228c50220d90350ff795f027c03c671ebc2ece1

                • C:\Users\Admin\AppData\Local\Temp\RESA66B.tmp

                  MD5

                  eda1c349d40efd928150a8090a38c8cb

                  SHA1

                  238f563337fc9b10f5eaf81286b596567d4dedbe

                  SHA256

                  f4644805233b27f2b222f4795ed6cb334fdc74e246e7adbbf36f4127b561ca88

                  SHA512

                  da913162778740e3cd7930c1d6bdde527e1f2b696d0fdaf83af7aed5d15c35ae8172a78020d69052efb9c26323e892e38162a19f16e6ca348704c9ebd49033a6

                • C:\Users\Admin\AppData\Local\Temp\Recover.txt

                  MD5

                  cfcd208495d565ef66e7dff9f98764da

                  SHA1

                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                  SHA256

                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                  SHA512

                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe

                  MD5

                  d3541b516a76755a3da9c5fe5d06940c

                  SHA1

                  c28f4c4ebf1fa7a94415ebf41776c65b2de7eee9

                  SHA256

                  ddba9a0e5ec5829c79b4c81100fd8bd7f6e5f5f854e7be6b27287d846424d719

                  SHA512

                  dccaf71a8fa6d9b87d7480e2a7d32f7b741e45fec875feb39be8d6fd44979469db48cccbd029e65765b7f28bdf908152cbe9da620d4c1e3d00bd653cd9e5af25

                • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe

                  MD5

                  d3541b516a76755a3da9c5fe5d06940c

                  SHA1

                  c28f4c4ebf1fa7a94415ebf41776c65b2de7eee9

                  SHA256

                  ddba9a0e5ec5829c79b4c81100fd8bd7f6e5f5f854e7be6b27287d846424d719

                  SHA512

                  dccaf71a8fa6d9b87d7480e2a7d32f7b741e45fec875feb39be8d6fd44979469db48cccbd029e65765b7f28bdf908152cbe9da620d4c1e3d00bd653cd9e5af25

                • C:\Users\Admin\AppData\Local\Temp\jd2_ow1z.dll

                  MD5

                  30a31b9767a00fe49f8ab72aa0dcbc95

                  SHA1

                  cf78f4ca17281da48e921f5cb122241755f42941

                  SHA256

                  d4f2d51bfb4ae56cc76a29dde7c2f70c4a60760fa7933f305760afec3f1e7af6

                  SHA512

                  d94711b610cd9913bf9641941ea450ade92c1b0fb4d0b9b4e63e2ad9f09f38170fe5abf18809d4bf9eac99ad599406f2959282a40e6bfa16f693cc3303d10237

                • C:\Users\Admin\AppData\Local\Temp\rjgxmwqy.dll

                  MD5

                  d531d1a620af92bd743fdd9da6caf2cc

                  SHA1

                  4af223911600c10db401886dcfc2d4469bdf9b9d

                  SHA256

                  76286eee5888844e08eae01c820fa24070c6df387be2fe90ed9d58343713c3c2

                  SHA512

                  dfa4ea7e7ed89c0a7ea686c75c67c64775897011ae0f82a3805958934b151d4d161936caa5e5e3a21c570079f7125f1b05b236aeb2e5951360535d482f205ccf

                • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt

                  MD5

                  b12cc2338e10144cb668ce0d9b86c4a8

                  SHA1

                  76099b430b7fcb4598d210d837b0938097e178d8

                  SHA256

                  713b8851672c4c2503c2ac656938ff1d400cc5ddb4ea60d10e4d4c5ad504e2d4

                  SHA512

                  f453ee0d7e8cc702a185f50176ec88104307109de998bf13265b156665fa9e1600be120f4ffeedd84891abcd50d890f418b02cbb9815567ef647bb7d6ab3deb8

                • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\IData.txt

                  MD5

                  729a2dc4b083458e2d356c2111da7fe1

                  SHA1

                  67db126bd6786faedb12e650be0ee11161269e43

                  SHA256

                  3348bca360353010e648401f795be19f6b25b7e7585ac217f5f67ebcfeb3ff6e

                  SHA512

                  a8e651b1748aa07c46fef3ca3fe82332c206598afca185ce6b42465b9799f86f33c045fabac22fb5607264a99362d392a59e0a0fb24a3ce0ce69170bbec7df92

                • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt

                  MD5

                  3e682eb51baee9f27b0775287510ac6e

                  SHA1

                  0c62c14b2d05af414cdc225db43b60e79ec7b280

                  SHA256

                  05a960000c74ca2f31fac1800e5156e2e4d04a78873f005218aeeb8fbacbbff6

                  SHA512

                  885ffe4359bf0fd7793b304312c7c6c3e36e767490d0ee542be5b41a74e8c4a2567c4929bb0c4bf8021a3f07ed97cf05f3feac224b79bd76a0aac9f3b1bd3a06

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release\prefs.js

                  MD5

                  546d941979e9f71255e89878502bbfee

                  SHA1

                  05d8a73ee49731092be39d5514a196c9fbf1dd27

                  SHA256

                  88218b58b77bc1369a3a2f784352889d0d7abb38abba5c62bb50af525099ea7e

                  SHA512

                  93e612f57192edb7c9af355d35f40e087372ca08f86fdcfa1f2ac167caa1107b617be30b42863cdbcf9eac500580950bae61c0c1a3e954a2f5e4acf0504414fb

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release\search.json.mozlz4

                  MD5

                  1c2ee09cceb397a25f1b6762b7756f6e

                  SHA1

                  18dd6b5d06f897bed1869d43dc29d2155856f4cc

                  SHA256

                  2a4640cc19aa2471740ae4d81535fb7e327bf962a0f776a5129625eba68d71a5

                  SHA512

                  bf3990f0dd4aa4687e6599d16427c7ae1e738a536b5ad86d91fb7d593079355808f0ad2166ee8e0ac863a898cb4fa76b98b27142622e721ae91ed68f55e8e923

                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

                  MD5

                  76c15749d42fd5722c68a96c14f9e19a

                  SHA1

                  829c351af39efda22fb6451bb0bf3faa4d169b30

                  SHA256

                  5b54a80d5a3f1aae3ef012b9259e440333fea618cafffcd46187a79e449401f4

                  SHA512

                  a7c196c9ef32c98a3178d1afe113b9b2fc4cb9906cd02ecbd3e6e01e7fd7052a24b4462fa62044e01dc5a49a8230d096475da571da7c37be1119543203122827

                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

                  MD5

                  76c15749d42fd5722c68a96c14f9e19a

                  SHA1

                  829c351af39efda22fb6451bb0bf3faa4d169b30

                  SHA256

                  5b54a80d5a3f1aae3ef012b9259e440333fea618cafffcd46187a79e449401f4

                  SHA512

                  a7c196c9ef32c98a3178d1afe113b9b2fc4cb9906cd02ecbd3e6e01e7fd7052a24b4462fa62044e01dc5a49a8230d096475da571da7c37be1119543203122827

                • C:\Windows\TEMP\RESBFA8.tmp

                  MD5

                  7215513b54af27725d3fc9dd3747f0ed

                  SHA1

                  751e3cc581882fba8f77d1b42ae59a614effc8e9

                  SHA256

                  e1515ec748b6165b21ef5b05e2f8542f7bb6aafc46369ca6a24f90e0e4e487b7

                  SHA512

                  f7fdf4d9851ad32c57fd05f1add70f0649e8eb67516916d2a22e35f2638bbde21bef6ea10d12fb6734c1f8b28eb2fd54e2648c56e37735d42d1c5902b6d1eab2

                • C:\Windows\TEMP\q-9f8yo_.dll

                  MD5

                  18bb3d707ee831de0c56e7c741c23285

                  SHA1

                  e92eb8eb68c39827232fd6a1402167f5130753b3

                  SHA256

                  089d78aead2d060b256ad0559ee932e7dd727155121eb7658413d2fab6100668

                  SHA512

                  ed76707ebace34c3d4c51e078247057435f46ca171d474e2b46201b58f475ff309c6108b314217f80b0f9c576329b9b0087a8947781ac1d27469f1e52f6ae137

                • \??\c:\Users\Admin\AppData\Local\Temp\CSCA49D.tmp

                  MD5

                  5ab715af351904160cf5d79c3eac8c0e

                  SHA1

                  76327cb16149b1fda59f5007b38b1bfa6ab9db79

                  SHA256

                  167655180e8fb60b4801ec1235dba666d604b32e2937187ec05ac3930e891ec6

                  SHA512

                  871d886d2b77cd86684e56e508bb70b39521282da6111da92899ce1085f1747fb966482eab3da695d72dc58536446242959d3668dc4b4d63558ef7366996d7a0

                • \??\c:\Users\Admin\AppData\Local\Temp\CSCA66A.tmp

                  MD5

                  a868a7050fcec8454a2e636404334a1d

                  SHA1

                  65ee380bb85f0df873ddbc2d99c6461eeeec7d99

                  SHA256

                  359fde7795973645f3486544df1685e5d7da7d220482b5c1a3320b8843be1c10

                  SHA512

                  922609a1913e73a44ea2379454c27082dc744e1c040c5c7ae6617330efae2d7efa7c7959425fe2109c3314490dd8f85b0aea2c601a92f2c52ccc566472f3d0ac

                • \??\c:\Users\Admin\AppData\Local\Temp\jd2_ow1z.0.cs

                  MD5

                  92f262c46ac01aa2ee0a0cc3d9855ec0

                  SHA1

                  7cc4ac43e60b2a446f10955d6c2f5926abddb512

                  SHA256

                  f56e564190f347a6c5d844f76cf424034e7275e93f6284e656d1e4aef4432ad4

                  SHA512

                  ccb2ce51a544096282faadbb49d936c0972c52e2569061335381f7e388c5de99712d92e307f2b786c38202646d631fc2f01aeeec622bea425b76ee3403d9d51c

                • \??\c:\Users\Admin\AppData\Local\Temp\jd2_ow1z.cmdline

                  MD5

                  95b972a5a95ca77f74a62351dfaa2662

                  SHA1

                  07438aa68d9cef208949a526c0fbb00b4952c532

                  SHA256

                  5a90d0dcdc8f00f4676e9b55f872083eb8df4654550e6575b6ccd940c7d78e0d

                  SHA512

                  1398b3e1754a0bc9f5bc73e479cfef00ce97a9cfc1bee40d07f127edbf9c2ede2101971e9b1dbfd1b9d835a96947ff3234f9e4135b48187053e6bad3e589dacf

                • \??\c:\Users\Admin\AppData\Local\Temp\rjgxmwqy.0.cs

                  MD5

                  8ec4fe3904ee19fb6f29ce9a94433000

                  SHA1

                  0fca1be29afb57b91bda394adc02e6ca027a195e

                  SHA256

                  4b7d660ea1cdfd8c968f1ec1b9abe2a463b3fac188cc3da9812807d6da1c140d

                  SHA512

                  3895e34cb63fd8a808fa119b3a2565632ee66657c958ae6b1f418c62c5d497cad702e19917799064f5b5e522baac6bab85bf7f0c4dc1c94dbfa12e80c31b4ff6

                • \??\c:\Users\Admin\AppData\Local\Temp\rjgxmwqy.cmdline

                  MD5

                  09618ecabfa21bacdc72ff1fc40bc965

                  SHA1

                  b86a212ba876b5b73f9b380960f67c4dd097c4ff

                  SHA256

                  b190ea8cf7f1aeb564014c0635a5d898914a6d807c63fa18e345f56ef42bbe8b

                  SHA512

                  ebd55ed0be201bff763f60bc8ced59eecfb03659bfe478b5d79d2a4badc273ad4ee7403d5d27227d1c1dde34a60e2dac003a1e870db9de6d4a171f16023292d9

                • \??\c:\Windows\Temp\CSCBFA7.tmp

                  MD5

                  b1238b21f6145b02fd773a3022c221ac

                  SHA1

                  310964d8baa6b867f555de66af2a37d0022629c1

                  SHA256

                  6da657a3655b811e1c3a4244a793499160cb7438d06821d94871a5eab379abe7

                  SHA512

                  7e6778f801f6343bb198bbff955bbb005b6c788b3e40eb30ecbc7107e81eabf45f594657990f25e2b7f2efdf2a7ca24e151826763775f2f53775761c6c2ee3c3

                • \??\c:\Windows\Temp\q-9f8yo_.0.cs

                  MD5

                  bd0a5df7e1b10538962995ed80f3cc45

                  SHA1

                  f5475822459276b10019dcddd222c589184045dd

                  SHA256

                  de9ea844887bbf99e7db1693ab15964071b28e08a5accae8974312f182ddc1d2

                  SHA512

                  97fb5723e14b59a172ee4a9fd7129e485e6caac8206033dd264a8d0440146f1b1764bac5a5a86a8e62e266d1598f244df32991d98f3e97cf05f03997b67f9cb3

                • \??\c:\Windows\Temp\q-9f8yo_.cmdline

                  MD5

                  80d3e56c029ca866ea87c5941c906164

                  SHA1

                  12b5a2886da4fc429277a4c00b464894b9fc95f5

                  SHA256

                  cb1553590d58e0b8016cd166adc7f65580949249695d7580891cb4d0429cd301

                  SHA512

                  35af9d951aa59cb278c0140a6cec18647b014f58a9e0b288930ce1b4590a0143af8589f0b3bc780ce98aed95ad8fd2e0924745cf61988d27787c2b6daa19476d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                  MD5

                  d06f52781f99a9bd5d4359ad83f34ddc

                  SHA1

                  5237e590f3b986f31518276a8f7f01ed63d7a960

                  SHA256

                  f909da051b30e2c7f13af27b43a910ce4ed45f8295ad8bb6decb9ac1c1710b82

                  SHA512

                  8a929f389c8367e981fd784f5a5e709aa3afd36f3a9c55edcc09174510e751c7ae4dc34d6abf4541edcfb98c59d87362bd72b6376dd768f2cb46c533a6ae7d7d

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

                  MD5

                  2886b136e336555167231b19897133a7

                  SHA1

                  54f6628386e7f984eccc482331f68ddd1c729630

                  SHA256

                  75d47819a4a1fb39a1c9d1c3c2a35d53bd901cfe376b6ccfd073f076659e6a6a

                  SHA512

                  e5479ad1719ef42a29f8f236c9c8ca21af663e3f2c7a5ad138773de8fcbb33db915d8353220a431e20b2c4cf508b409ef01083b0b49763a4c370a6aaeffd2816

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

                  MD5

                  2886b136e336555167231b19897133a7

                  SHA1

                  54f6628386e7f984eccc482331f68ddd1c729630

                  SHA256

                  75d47819a4a1fb39a1c9d1c3c2a35d53bd901cfe376b6ccfd073f076659e6a6a

                  SHA512

                  e5479ad1719ef42a29f8f236c9c8ca21af663e3f2c7a5ad138773de8fcbb33db915d8353220a431e20b2c4cf508b409ef01083b0b49763a4c370a6aaeffd2816

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

                  MD5

                  2886b136e336555167231b19897133a7

                  SHA1

                  54f6628386e7f984eccc482331f68ddd1c729630

                  SHA256

                  75d47819a4a1fb39a1c9d1c3c2a35d53bd901cfe376b6ccfd073f076659e6a6a

                  SHA512

                  e5479ad1719ef42a29f8f236c9c8ca21af663e3f2c7a5ad138773de8fcbb33db915d8353220a431e20b2c4cf508b409ef01083b0b49763a4c370a6aaeffd2816

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

                  MD5

                  2886b136e336555167231b19897133a7

                  SHA1

                  54f6628386e7f984eccc482331f68ddd1c729630

                  SHA256

                  75d47819a4a1fb39a1c9d1c3c2a35d53bd901cfe376b6ccfd073f076659e6a6a

                  SHA512

                  e5479ad1719ef42a29f8f236c9c8ca21af663e3f2c7a5ad138773de8fcbb33db915d8353220a431e20b2c4cf508b409ef01083b0b49763a4c370a6aaeffd2816

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll

                  MD5

                  e21e049a0faa5be7878538291f06d343

                  SHA1

                  98c623e0fde7936987709c14da9b134f2bef3c44

                  SHA256

                  c65b075c4a9fdf5e9e8753ffcb3d060780f0f7869ad07fa4240aa27300dfecb9

                  SHA512

                  f44b5885b91670fc20a1170608fd46f44b52c70eed1b90c3cd21efdd5abf0892b73601f2da0e5d5c8900ed676633905d249850e85c1fa7b11f06ebd9a058403c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                  MD5

                  1f9f4cb949a152385cdc133454548989

                  SHA1

                  11fa48d3954f4637208d28bcb05ea6e473c4c581

                  SHA256

                  f64c9676c878923e0cc7339005b2f383cd12e73b4e6763a9f99674bc82c30259

                  SHA512

                  e656814fa261282e73187578721c957fd52793e5f2d97f5654b4620e54ebbc16f0a6e4493f707053262156145efa444bd2c5e81b9bc3ac32928cae3a922e925f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll

                  MD5

                  1f4193411d89839aa7ff77807e3fd3b5

                  SHA1

                  a0f88db9d6c38bbb1e7898e70f6a03593c38f817

                  SHA256

                  a47f07884e4ea3aa50ae31cd9070dd1c2ccd00f5121262b586d4bbf312ff5bb3

                  SHA512

                  89139e4fc656127fb7a87e0f46a8cf5e57110cdc3895defeffd24643f0c6967c35580e0c207ae47170284ca71b2e3e36712d4d932fc9d98fcccf4fb25d568bd4

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll

                  MD5

                  1f4193411d89839aa7ff77807e3fd3b5

                  SHA1

                  a0f88db9d6c38bbb1e7898e70f6a03593c38f817

                  SHA256

                  a47f07884e4ea3aa50ae31cd9070dd1c2ccd00f5121262b586d4bbf312ff5bb3

                  SHA512

                  89139e4fc656127fb7a87e0f46a8cf5e57110cdc3895defeffd24643f0c6967c35580e0c207ae47170284ca71b2e3e36712d4d932fc9d98fcccf4fb25d568bd4

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll

                  MD5

                  1f4193411d89839aa7ff77807e3fd3b5

                  SHA1

                  a0f88db9d6c38bbb1e7898e70f6a03593c38f817

                  SHA256

                  a47f07884e4ea3aa50ae31cd9070dd1c2ccd00f5121262b586d4bbf312ff5bb3

                  SHA512

                  89139e4fc656127fb7a87e0f46a8cf5e57110cdc3895defeffd24643f0c6967c35580e0c207ae47170284ca71b2e3e36712d4d932fc9d98fcccf4fb25d568bd4

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll

                  MD5

                  1f4193411d89839aa7ff77807e3fd3b5

                  SHA1

                  a0f88db9d6c38bbb1e7898e70f6a03593c38f817

                  SHA256

                  a47f07884e4ea3aa50ae31cd9070dd1c2ccd00f5121262b586d4bbf312ff5bb3

                  SHA512

                  89139e4fc656127fb7a87e0f46a8cf5e57110cdc3895defeffd24643f0c6967c35580e0c207ae47170284ca71b2e3e36712d4d932fc9d98fcccf4fb25d568bd4

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

                  MD5

                  89bc991d89ae5ecb98683a097e1dc3ad

                  SHA1

                  9f4d6c6c366aee0e6f3c994d9874f2df7cd3125e

                  SHA256

                  fb370439d57c2e254d3412d5a3ec78b4cde29e6df138fc6b2f5ffa5f1f681d3c

                  SHA512

                  c63cc967a458f00ca302b3b64fb9d37254a05cb9f47888f1fe4c49209d8675f39957c80501d3136162774a7d371a13a8d93d484bd88b5421179c7db3b237c969

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll

                  MD5

                  d3201293063e5fd3f086d11834f632e1

                  SHA1

                  4081c5b3c67fe68ea0571bafb095706e5897663f

                  SHA256

                  e823471f65ac15d6fc0363ac269117a7cf84874e8bfe7873e1234fa6a96c64e3

                  SHA512

                  6ac28ba1ba7a8777f8fd90f9e12036ee752dcd835d92efcf6418ff2c505ee40edb3b76acadffe857bf970eb67e504a57ba08ff0438e38308a14da46120f68775

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                  MD5

                  1fd457055d4512450fe248218bc8a6f0

                  SHA1

                  abe8f827f93ff3274cd49938ab0c094928ba79e7

                  SHA256

                  8ff5e66bd3b60c535343340ece99d7b5142d4b0bd7d6b80cd847943a218776cf

                  SHA512

                  6d586aaf21c5fff84792a264bcb339d6b2e427b2ecd84b1511105128c1c1d50b9b055b9a3191b885382202d5eff70780ab6f126df3ca329877512ed5510a72bf

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                  MD5

                  853b3adcee4a9745a7752089cbeec2d5

                  SHA1

                  125cef014c8b270f93f2764597d45a92480e99bb

                  SHA256

                  b960595787121642b90de109373cacf9aa267dcc1c0861fb4046b8f66742e5bf

                  SHA512

                  c5e53b80f5ede16a3bc861b4048b598b68b02e4a5c9ef5134275d70ffa4ff3de54acb6485e5b9bc475a0de146aa0f087c6bf8b4ea6b48ecb433659fb421d3f40

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll

                  MD5

                  5d60ad3296504ed5eac20af2c93142f1

                  SHA1

                  2b6675310d4e27d5863dce9362e7eb2c24ae1b9a

                  SHA256

                  b696401efc2398f3525899676aff10697f78468179cb83da6c5f767139ab3c9a

                  SHA512

                  a7018fa8c93c820fbb43bcfabaa16dfd25162cf75d4dc591999be0339f306ccb45b3c9a41b1a6faa8a13f7a984e48614c92e7afdcf767aac9825e2a8ed709cc9

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll

                  MD5

                  5d60ad3296504ed5eac20af2c93142f1

                  SHA1

                  2b6675310d4e27d5863dce9362e7eb2c24ae1b9a

                  SHA256

                  b696401efc2398f3525899676aff10697f78468179cb83da6c5f767139ab3c9a

                  SHA512

                  a7018fa8c93c820fbb43bcfabaa16dfd25162cf75d4dc591999be0339f306ccb45b3c9a41b1a6faa8a13f7a984e48614c92e7afdcf767aac9825e2a8ed709cc9

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll

                  MD5

                  5d60ad3296504ed5eac20af2c93142f1

                  SHA1

                  2b6675310d4e27d5863dce9362e7eb2c24ae1b9a

                  SHA256

                  b696401efc2398f3525899676aff10697f78468179cb83da6c5f767139ab3c9a

                  SHA512

                  a7018fa8c93c820fbb43bcfabaa16dfd25162cf75d4dc591999be0339f306ccb45b3c9a41b1a6faa8a13f7a984e48614c92e7afdcf767aac9825e2a8ed709cc9

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll

                  MD5

                  5d60ad3296504ed5eac20af2c93142f1

                  SHA1

                  2b6675310d4e27d5863dce9362e7eb2c24ae1b9a

                  SHA256

                  b696401efc2398f3525899676aff10697f78468179cb83da6c5f767139ab3c9a

                  SHA512

                  a7018fa8c93c820fbb43bcfabaa16dfd25162cf75d4dc591999be0339f306ccb45b3c9a41b1a6faa8a13f7a984e48614c92e7afdcf767aac9825e2a8ed709cc9

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                  MD5

                  c5e8910240fbc9559867f6a468d0b73c

                  SHA1

                  6197750ee9c594b70e19b54419c38b190db782d4

                  SHA256

                  ababc4404776aae4aa6da74cefe8ac94b797da55427191a22ef99d371a665c1b

                  SHA512

                  d837943fb6ea7d028187eefaae4698c99ae4979cc88e5664f12b86f5a81bc4e1dfa6a5134bfa0049b9aceacc7abd3077aa7373f9583992645cbc730da5e97110

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                  MD5

                  09be7a81033352b26d64b9494b1f5e7c

                  SHA1

                  35affd80b31afbe264f84921e5eac85eced9da58

                  SHA256

                  006f7f76fa78bc45646d0633fb0a2b974976968da13b3480689f918809281f63

                  SHA512

                  a70b34d519f42d659099dad7a4171a38032455c865d7ecb030549a6a16a1e6056f91531a3d90e36b9fe751913bfe14cbf1a5084303907b35789bbf5566c0096f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

                  MD5

                  043729fab50a9d6586a221f933141ae8

                  SHA1

                  a67d6a09d459a8cf987527f1fc623e14320f3f0a

                  SHA256

                  c0fc7e12ce776379fbb95c00d22c0463532d3a29d8daac073e1011c96f99acb4

                  SHA512

                  dc2abf2e6b99424436da19d9ddc00583add4dd120bd3ca570599a45fc769f22185eccedb5b9beff9c730e34260f55c983c69d7671f94d419a56506a68eabc326

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

                  MD5

                  043729fab50a9d6586a221f933141ae8

                  SHA1

                  a67d6a09d459a8cf987527f1fc623e14320f3f0a

                  SHA256

                  c0fc7e12ce776379fbb95c00d22c0463532d3a29d8daac073e1011c96f99acb4

                  SHA512

                  dc2abf2e6b99424436da19d9ddc00583add4dd120bd3ca570599a45fc769f22185eccedb5b9beff9c730e34260f55c983c69d7671f94d419a56506a68eabc326

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

                  MD5

                  043729fab50a9d6586a221f933141ae8

                  SHA1

                  a67d6a09d459a8cf987527f1fc623e14320f3f0a

                  SHA256

                  c0fc7e12ce776379fbb95c00d22c0463532d3a29d8daac073e1011c96f99acb4

                  SHA512

                  dc2abf2e6b99424436da19d9ddc00583add4dd120bd3ca570599a45fc769f22185eccedb5b9beff9c730e34260f55c983c69d7671f94d419a56506a68eabc326

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

                  MD5

                  043729fab50a9d6586a221f933141ae8

                  SHA1

                  a67d6a09d459a8cf987527f1fc623e14320f3f0a

                  SHA256

                  c0fc7e12ce776379fbb95c00d22c0463532d3a29d8daac073e1011c96f99acb4

                  SHA512

                  dc2abf2e6b99424436da19d9ddc00583add4dd120bd3ca570599a45fc769f22185eccedb5b9beff9c730e34260f55c983c69d7671f94d419a56506a68eabc326

                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll

                  MD5

                  ea0ac36cbca632291080893620e21598

                  SHA1

                  1b98a3d4746a144739da534750c356247b833a10

                  SHA256

                  f7960bb868dab6fb0b59148352159318c23d921d5545aba894e4f6cf8af8cfa7

                  SHA512

                  9ecb6f105e31153b54217dd76f329e805da88aedd262624c101d8979ec9aa888d74c1fe06bafe3bf71f2c1be1885fe5b3974270470792524a732f8f1f0b69b6c

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                  MD5

                  b65e795d68500124618dbadbd5d9bf01

                  SHA1

                  fb76c81e92816eb38d7d56e9de7afa6cca573b71

                  SHA256

                  b420d81cd8a2e0bf4fa1d68c0042e0cb3e08826d68c7295c76d90b4772458ac9

                  SHA512

                  ae77b5498f534f4a81c9d25f5c85b81d424f0c3cf6f8d7771bed88d7568370ffd3dac2404139b79a1aba15d44caf1824420d54e66057e0f4e786cc65e3b52232

                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

                  MD5

                  77a4887a8fd764206848aa8dc7c78c4c

                  SHA1

                  5b2fd76639811a08f21f44c7f391be52c494df4d

                  SHA256

                  da0a2f7704f1340a9eb43fc47572e61a72b09fbd21dc5cf0a7e976baa8f18144

                  SHA512

                  3377331bdc9beff6c9af55673533fd81874c06ac16c87d4ddadbc11103237ddbd9e8cb048db25cf4270d4111913805f73dafe64369147ad732e636256eda91e6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

                  MD5

                  77a4887a8fd764206848aa8dc7c78c4c

                  SHA1

                  5b2fd76639811a08f21f44c7f391be52c494df4d

                  SHA256

                  da0a2f7704f1340a9eb43fc47572e61a72b09fbd21dc5cf0a7e976baa8f18144

                  SHA512

                  3377331bdc9beff6c9af55673533fd81874c06ac16c87d4ddadbc11103237ddbd9e8cb048db25cf4270d4111913805f73dafe64369147ad732e636256eda91e6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

                  MD5

                  77a4887a8fd764206848aa8dc7c78c4c

                  SHA1

                  5b2fd76639811a08f21f44c7f391be52c494df4d

                  SHA256

                  da0a2f7704f1340a9eb43fc47572e61a72b09fbd21dc5cf0a7e976baa8f18144

                  SHA512

                  3377331bdc9beff6c9af55673533fd81874c06ac16c87d4ddadbc11103237ddbd9e8cb048db25cf4270d4111913805f73dafe64369147ad732e636256eda91e6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

                  MD5

                  77a4887a8fd764206848aa8dc7c78c4c

                  SHA1

                  5b2fd76639811a08f21f44c7f391be52c494df4d

                  SHA256

                  da0a2f7704f1340a9eb43fc47572e61a72b09fbd21dc5cf0a7e976baa8f18144

                  SHA512

                  3377331bdc9beff6c9af55673533fd81874c06ac16c87d4ddadbc11103237ddbd9e8cb048db25cf4270d4111913805f73dafe64369147ad732e636256eda91e6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll

                  MD5

                  2cdf09227f553cead3bd4a82b3488163

                  SHA1

                  e5a2ccac77fa8ac38f5ad959f0983241e7b896f1

                  SHA256

                  e43eadd6a1a85c87c38ff8a389fb811098cadea335b5307c8ffe15e8bad8617d

                  SHA512

                  c0a0911eeeba38612b48173ce30bab35dab107355b6b49699239bbb2533ae5495f6ab6546c9adc51d91793c75db532cf2339d5cfd884625a6e1991522aee9294

                • \Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll

                  MD5

                  2cdf09227f553cead3bd4a82b3488163

                  SHA1

                  e5a2ccac77fa8ac38f5ad959f0983241e7b896f1

                  SHA256

                  e43eadd6a1a85c87c38ff8a389fb811098cadea335b5307c8ffe15e8bad8617d

                  SHA512

                  c0a0911eeeba38612b48173ce30bab35dab107355b6b49699239bbb2533ae5495f6ab6546c9adc51d91793c75db532cf2339d5cfd884625a6e1991522aee9294

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll

                  MD5

                  c6a5a2ee4a16239ddde73954b3296b75

                  SHA1

                  90956c1914d5be3ec1421b9338f149cc2ee0539f

                  SHA256

                  d6459984946fd2f94fca0ded35dd29aca22cbc2f1ba4d720e023f85eff7e82a2

                  SHA512

                  0f9756c88358d22a1ccc267ff94875203e07e96d40a29e5e813866288c41104aacb42b37a29e11dfe6d52fd7348b83c121748961a67b12e3b4967f6dc5aa7cb6

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll

                  MD5

                  e73ac02aa5bdb381ae3a6f6864b959d6

                  SHA1

                  d18d6ebbdb818e208dcc2a465f98ddc4a0c20612

                  SHA256

                  cd0f806e16c749f9dfb3fa5288790bfdb5220eb6e261e86fbe20070ba1e2f81d

                  SHA512

                  62c7d746d48108a0b0fdcf25ad2570a15801b4401559057c0944573abac3b41bfa9708cb2836c6891221f265591b458ac6c69022303a73a09686b8109346a31f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll

                  MD5

                  e73ac02aa5bdb381ae3a6f6864b959d6

                  SHA1

                  d18d6ebbdb818e208dcc2a465f98ddc4a0c20612

                  SHA256

                  cd0f806e16c749f9dfb3fa5288790bfdb5220eb6e261e86fbe20070ba1e2f81d

                  SHA512

                  62c7d746d48108a0b0fdcf25ad2570a15801b4401559057c0944573abac3b41bfa9708cb2836c6891221f265591b458ac6c69022303a73a09686b8109346a31f

                • \Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll

                  MD5

                  6ae236d224b824d0acd49b4df3f2de66

                  SHA1

                  420c4b34950d9dadc33642ab27cd0bb8fd6d5e83

                  SHA256

                  10f746b2bec955d1640b1caaf6e242e4a1b25c02754667a9e9783b5cdc1b1d2e

                  SHA512

                  3465f3a706e5b452e0ea485a2f44ff91324091ec46a4b5dfd9cce8604693decb85c0164d3db14eec2874e6c9ac8d3a56da5694f24452ed2e2fdf40aa18f8f1b2

                • \Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll

                  MD5

                  6ae236d224b824d0acd49b4df3f2de66

                  SHA1

                  420c4b34950d9dadc33642ab27cd0bb8fd6d5e83

                  SHA256

                  10f746b2bec955d1640b1caaf6e242e4a1b25c02754667a9e9783b5cdc1b1d2e

                  SHA512

                  3465f3a706e5b452e0ea485a2f44ff91324091ec46a4b5dfd9cce8604693decb85c0164d3db14eec2874e6c9ac8d3a56da5694f24452ed2e2fdf40aa18f8f1b2

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll

                  MD5

                  5a8ee1e57a63d4c6afd0b09eeb860219

                  SHA1

                  231ede81f741cb3d736f360dc5d5bfb2ac44ba12

                  SHA256

                  dc009d4ebdb578c98e4edc752ed7dcd46fc3ffa199ecaccbec5542dd3b34eaa6

                  SHA512

                  1beed12d412c6b2d62ade03888a0f31b1b4735e6f93270d0a3a5a91773f0084efe0ae4494f4b7969b37d07ca8c1266582725becbb34958e91b64d9bc6be9bb74

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll

                  MD5

                  5a8ee1e57a63d4c6afd0b09eeb860219

                  SHA1

                  231ede81f741cb3d736f360dc5d5bfb2ac44ba12

                  SHA256

                  dc009d4ebdb578c98e4edc752ed7dcd46fc3ffa199ecaccbec5542dd3b34eaa6

                  SHA512

                  1beed12d412c6b2d62ade03888a0f31b1b4735e6f93270d0a3a5a91773f0084efe0ae4494f4b7969b37d07ca8c1266582725becbb34958e91b64d9bc6be9bb74

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll

                  MD5

                  5a8ee1e57a63d4c6afd0b09eeb860219

                  SHA1

                  231ede81f741cb3d736f360dc5d5bfb2ac44ba12

                  SHA256

                  dc009d4ebdb578c98e4edc752ed7dcd46fc3ffa199ecaccbec5542dd3b34eaa6

                  SHA512

                  1beed12d412c6b2d62ade03888a0f31b1b4735e6f93270d0a3a5a91773f0084efe0ae4494f4b7969b37d07ca8c1266582725becbb34958e91b64d9bc6be9bb74

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\ICSharpCode.SharpZipLib.dll

                  MD5

                  5a8ee1e57a63d4c6afd0b09eeb860219

                  SHA1

                  231ede81f741cb3d736f360dc5d5bfb2ac44ba12

                  SHA256

                  dc009d4ebdb578c98e4edc752ed7dcd46fc3ffa199ecaccbec5542dd3b34eaa6

                  SHA512

                  1beed12d412c6b2d62ade03888a0f31b1b4735e6f93270d0a3a5a91773f0084efe0ae4494f4b7969b37d07ca8c1266582725becbb34958e91b64d9bc6be9bb74

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll

                  MD5

                  5d06e0b95f7e4128194a6f517125bede

                  SHA1

                  a78d45faffbc3628f2fc3243485e59fbd429721e

                  SHA256

                  530b79ff0f7dcfeceb0d369f7aa4ff9e0ee97b7c604cf8932c27dcbe29198b2c

                  SHA512

                  5de8b691f012454044c9737730b9b06239fdbdbb343407d299e1c5c58cd8cc63f12ba0c9520d695a4ac55eee239fd354d92e57d68b24a29c0494a3fa0730c861

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll

                  MD5

                  5d06e0b95f7e4128194a6f517125bede

                  SHA1

                  a78d45faffbc3628f2fc3243485e59fbd429721e

                  SHA256

                  530b79ff0f7dcfeceb0d369f7aa4ff9e0ee97b7c604cf8932c27dcbe29198b2c

                  SHA512

                  5de8b691f012454044c9737730b9b06239fdbdbb343407d299e1c5c58cd8cc63f12ba0c9520d695a4ac55eee239fd354d92e57d68b24a29c0494a3fa0730c861

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll

                  MD5

                  5d06e0b95f7e4128194a6f517125bede

                  SHA1

                  a78d45faffbc3628f2fc3243485e59fbd429721e

                  SHA256

                  530b79ff0f7dcfeceb0d369f7aa4ff9e0ee97b7c604cf8932c27dcbe29198b2c

                  SHA512

                  5de8b691f012454044c9737730b9b06239fdbdbb343407d299e1c5c58cd8cc63f12ba0c9520d695a4ac55eee239fd354d92e57d68b24a29c0494a3fa0730c861

                • \Users\Admin\AppData\Local\Temp\7zS0BD36935\Newtonsoft.Json.dll

                  MD5

                  5d06e0b95f7e4128194a6f517125bede

                  SHA1

                  a78d45faffbc3628f2fc3243485e59fbd429721e

                  SHA256

                  530b79ff0f7dcfeceb0d369f7aa4ff9e0ee97b7c604cf8932c27dcbe29198b2c

                  SHA512

                  5de8b691f012454044c9737730b9b06239fdbdbb343407d299e1c5c58cd8cc63f12ba0c9520d695a4ac55eee239fd354d92e57d68b24a29c0494a3fa0730c861

                • memory/996-126-0x0000000000000000-mapping.dmp

                • memory/1044-129-0x0000000000000000-mapping.dmp

                • memory/1336-98-0x000000006F290000-0x000000006F97E000-memory.dmp

                • memory/1336-101-0x000000000AEE0000-0x000000000AEE1000-memory.dmp

                • memory/1336-146-0x0000000007640000-0x0000000007650000-memory.dmp

                • memory/1336-23-0x0000000000000000-mapping.dmp

                • memory/1524-20-0x0000000000000000-mapping.dmp

                • memory/1552-22-0x0000000000000000-mapping.dmp

                • memory/1876-21-0x0000000000000000-mapping.dmp

                • memory/1884-112-0x0000000000000000-mapping.dmp

                • memory/2596-134-0x0000000000000000-mapping.dmp

                • memory/3080-226-0x00007FFE6C0E0000-0x00007FFE6CA80000-memory.dmp

                • memory/3176-107-0x00007FFE6C0E0000-0x00007FFE6CA80000-memory.dmp

                • memory/3244-19-0x0000000000000000-mapping.dmp

                • memory/3480-3-0x0000000000000000-mapping.dmp

                • memory/3496-229-0x0000000000000000-mapping.dmp

                • memory/3504-0-0x0000000000000000-mapping.dmp

                • memory/3632-18-0x0000000000000000-mapping.dmp

                • memory/3712-111-0x0000000000000000-mapping.dmp

                • memory/3808-110-0x0000000000000000-mapping.dmp

                • memory/3824-238-0x0000000000000000-mapping.dmp

                • memory/3896-241-0x0000000000000000-mapping.dmp

                • memory/3972-210-0x000000000D550000-0x000000000D551000-memory.dmp

                • memory/3972-207-0x000000006F610000-0x000000006FCFE000-memory.dmp

                • memory/3972-154-0x0000000000000000-mapping.dmp

                • memory/4020-115-0x0000000000000000-mapping.dmp