Analysis

  • max time kernel
    1798s
  • max time network
    1810s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    Archive.zip__ccacaxs2tbz2t6ob3e.exe

Malware Config

Signatures

  • Creates new service(s) ⋅ 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 7 IoCs
  • Loads dropped DLL ⋅ 64 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) ⋅ 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory ⋅ 4 IoCs
  • Drops file in Program Files directory ⋅ 64 IoCs
  • Drops file in Windows directory ⋅ 7 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 12 IoCs
  • Modifies Internet Explorer start page ⋅ 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS ⋅ 54 IoCs
  • Modifies system certificate store ⋅ 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 15 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 15 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
    "C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
    Modifies system certificate store
    Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Users\Admin\AppData\Local\Temp\7zS40E87735\WebCompanionInstaller.exe
        .\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=7.0.2354.4185 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
          PID:3024
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
          PID:3960
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
          PID:1660
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
          Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Windows\SysWOW64\netsh.exe
            netsh http add urlacl url=http://+:9007/ user=Everyone
            PID:2356
        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
          "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
          Executes dropped EXE
          Loads dropped DLL
          Adds Run key to start application
          Drops desktop.ini file(s)
          Drops file in Windows directory
          Modifies Internet Explorer settings
          Modifies Internet Explorer start page
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:204
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8g0uqmxw.cmdline"
            Suspicious use of WriteProcessMemory
            PID:3472
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE2F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCE2E.tmp"
              PID:4000
          • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe
            "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe" {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
            Executes dropped EXE
            PID:3272
        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
          "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of FindShellTrayWindow
          Suspicious use of SendNotifyMessage
          Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xrqiljnr.cmdline"
            Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE067.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE066.tmp"
              PID:3956
    • C:\Users\Admin\AppData\Local\Temp\6ACF.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\6ACF.tmp.exe
      Executes dropped EXE
      PID:2680
  • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
    "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
    Executes dropped EXE
    Drops file in System32 directory
    Modifies data under HKEY_USERS
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
      Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\netsh.exe
        netsh http add urlacl url=http://+:9007/ user=Everyone
        Modifies data under HKEY_USERS
        PID:3368
    • C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\ic1y0db6.cmdline"
      Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESF520.tmp" "c:\Windows\Temp\CSCF51F.tmp"
        PID:3176
  • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    PID:1452

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Replay Monitor

                00:00 00:00

                Downloads

                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\VCRUNTIME140D.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
                • C:\ProgramData\Application Data\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
                • C:\ProgramData\Lavasoft\Web Companion\Logs\WindowsService\WCAssistantServiceLog.log
                • C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip
                • C:\ProgramData\Lavasoft\Web Companion\Options\EventSafeguard.txt
                • C:\ProgramData\Lavasoft\Web Companion\Options\Partner.txt
                • C:\ProgramData\Lavasoft\Web Companion\Options\ProfileInfo.txt
                • C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
                • C:\ProgramData\Lavasoft\Web Companion\Options\Statistics.txt
                • C:\ProgramData\Lavasoft\Web Companion\Options\UpdateServer.txt
                • C:\ProgramData\Lavasoft\Web Companion\Options\b_search.json
                • C:\ProgramData\Lavasoft\Web Companion\Options\install.txt
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2
                • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\7.0.2354.4185\user.config
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WebCompanion.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WebCompanion.exe.log
                • C:\Users\Admin\AppData\Local\Temp\6ACF.tmp.exe
                • C:\Users\Admin\AppData\Local\Temp\6ACF.tmp.exe
                • C:\Users\Admin\AppData\Local\Temp\7zS40E87735\ICSharpCode.SharpZipLib.dll
                • C:\Users\Admin\AppData\Local\Temp\7zS40E87735\Newtonsoft.Json.dll
                • C:\Users\Admin\AppData\Local\Temp\7zS40E87735\WebCompanionInstaller.exe
                • C:\Users\Admin\AppData\Local\Temp\7zS40E87735\WebCompanionInstaller.exe
                • C:\Users\Admin\AppData\Local\Temp\7zS40E87735\WebCompanionInstaller.exe.config
                • C:\Users\Admin\AppData\Local\Temp\8g0uqmxw.dll
                • C:\Users\Admin\AppData\Local\Temp\RESCE2F.tmp
                • C:\Users\Admin\AppData\Local\Temp\RESE067.tmp
                • C:\Users\Admin\AppData\Local\Temp\Recover.txt
                • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
                • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
                • C:\Users\Admin\AppData\Local\Temp\xrqiljnr.dll
                • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt
                • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\IData.txt
                • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt
                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release\prefs.js
                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release\search.json.mozlz4
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
                • C:\Windows\TEMP\RESF520.tmp
                • C:\Windows\TEMP\ic1y0db6.dll
                • \??\c:\Users\Admin\AppData\Local\Temp\8g0uqmxw.0.cs
                • \??\c:\Users\Admin\AppData\Local\Temp\8g0uqmxw.cmdline
                • \??\c:\Users\Admin\AppData\Local\Temp\CSCCE2E.tmp
                • \??\c:\Users\Admin\AppData\Local\Temp\CSCE066.tmp
                • \??\c:\Users\Admin\AppData\Local\Temp\xrqiljnr.0.cs
                • \??\c:\Users\Admin\AppData\Local\Temp\xrqiljnr.cmdline
                • \??\c:\Windows\Temp\CSCF51F.tmp
                • \??\c:\Windows\Temp\ic1y0db6.0.cs
                • \??\c:\Windows\Temp\ic1y0db6.cmdline
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll
                • \Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\ICSharpCode.SharpZipLib.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\ICSharpCode.SharpZipLib.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\ICSharpCode.SharpZipLib.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\ICSharpCode.SharpZipLib.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\Newtonsoft.Json.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\Newtonsoft.Json.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\Newtonsoft.Json.dll
                • \Users\Admin\AppData\Local\Temp\7zS40E87735\Newtonsoft.Json.dll
                • memory/204-100-0x000000000D3B0000-0x000000000D3B1000-memory.dmp
                • memory/204-97-0x00000000700E0000-0x00000000707CE000-memory.dmp
                • memory/204-22-0x0000000000000000-mapping.dmp
                • memory/852-106-0x00007FF98B060000-0x00007FF98BA00000-memory.dmp
                • memory/1400-217-0x000000000A330000-0x000000000A340000-memory.dmp
                • memory/1400-241-0x0000000014AF0000-0x0000000014AF1000-memory.dmp
                • memory/1400-232-0x000000000D5C0000-0x000000000D5C1000-memory.dmp
                • memory/1400-229-0x000000006F7C0000-0x000000006FEAE000-memory.dmp
                • memory/1400-145-0x0000000000000000-mapping.dmp
                • memory/1452-196-0x00007FF98B060000-0x00007FF98BA00000-memory.dmp
                • memory/1660-19-0x0000000000000000-mapping.dmp
                • memory/2128-125-0x0000000000000000-mapping.dmp
                • memory/2312-3-0x0000000000000000-mapping.dmp
                • memory/2356-21-0x0000000000000000-mapping.dmp
                • memory/2680-199-0x0000000000000000-mapping.dmp
                • memory/2912-109-0x0000000000000000-mapping.dmp
                • memory/3024-17-0x0000000000000000-mapping.dmp
                • memory/3176-128-0x0000000000000000-mapping.dmp
                • memory/3272-133-0x0000000000000000-mapping.dmp
                • memory/3368-110-0x0000000000000000-mapping.dmp
                • memory/3472-111-0x0000000000000000-mapping.dmp
                • memory/3588-0-0x0000000000000000-mapping.dmp
                • memory/3956-211-0x0000000000000000-mapping.dmp
                • memory/3960-18-0x0000000000000000-mapping.dmp
                • memory/4000-114-0x0000000000000000-mapping.dmp
                • memory/4088-20-0x0000000000000000-mapping.dmp
                • memory/4092-208-0x0000000000000000-mapping.dmp