Analysis

  • max time kernel
    1s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 10:08

General

  • Target

    Setup.exe

  • Size

    566KB

  • MD5

    fd978d1c3b06f1192e2c62a879907ac1

  • SHA1

    9981d18c364a3ccacdaf9c420baa1a6070869ccd

  • SHA256

    fd04848c975c4e738b90bb58089c74916b3b1ab49be4416faa0fe8c486835522

  • SHA512

    d29313d43497a8baab41b6f5eae770e18004382edca5fc0a1ba71441cd8c12dda4389123bbdf89f7a75eb1f7f11b7105d8f620fb2d95af679b66758a6985e118

  • SSDEEP

    12288:rG5knZfFKer46pW21Cg/f35Q5911xbBBKTYGXYm4FYoZHYtI6c:rG50ZfFKUTw21XX3EN3K3J4DgI6c

Score
4/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\WebCompanion-Installer.exe
      .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tych --campaign --version=11.908.5.907
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3984
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
        3⤵
          PID:836
          • C:\Windows\SysWOW64\netsh.exe
            netsh http add urlacl url=http://+:9007/ user=Everyone
            4⤵
              PID:1152
          • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
            "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
            3⤵
              PID:4968
            • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall
              3⤵
                PID:4584
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN220101&campaign=&
                3⤵
                  PID:1072
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaadbe9758,0x7ffaadbe9768,0x7ffaadbe9778
                    4⤵
                      PID:2168
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:1
                      4⤵
                        PID:2668
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:1
                        4⤵
                          PID:1656
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:8
                          4⤵
                            PID:920
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:8
                            4⤵
                              PID:4816
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=560 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:2
                              4⤵
                                PID:2544
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:8
                                4⤵
                                  PID:4504
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:8
                                  4⤵
                                    PID:3420
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1892,i,1705512464538169046,11325489757529970083,131072 /prefetch:8
                                    4⤵
                                      PID:1820
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:2476
                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                  1⤵
                                    PID:2252

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          456B

                                          MD5

                                          8f3aac5c59a8641f6d4c7cc5b506c4ce

                                          SHA1

                                          a7bcd68caaeff3edc1020305874801d3184caf9d

                                          SHA256

                                          fa333d98c12acd4fbdc53fa8634cfbf714e40dc5aca8ca8dffe6ae4822adb0d7

                                          SHA512

                                          f9f921c44cbe86deb0cc7be94091c8625da77192e51ae00512c31ac673a4751c7af297cb9bbca9acd8022e64d2d44c4f8f9ddaf1ac91847b7fe22154e468b6df

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          4KB

                                          MD5

                                          746cda17eec59796930fb0feb778388a

                                          SHA1

                                          aaac6cdc3ad7e4f5aeb31955537899edef79182a

                                          SHA256

                                          021d5d59aa61ac0943cd9c2a6c5034cedded74b928a65e9e3397c6957d6d48f9

                                          SHA512

                                          b8cf1488619fbee39dc7288c13140ce8c2884dc816456819e547f52a6491b34378f43182f4878eb7bfe287f1f4857e750244f596aaad57e6a0fade304900ef1f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          1KB

                                          MD5

                                          b25da43e97f1f9100d91946322e212e7

                                          SHA1

                                          7273bc817a0ae27da43c1a7cdbdc9d3b9bcf025d

                                          SHA256

                                          13613e1e6f3d51df7423f6adf5acf29b02afa2757bcefa84f3929824dd0ce64c

                                          SHA512

                                          36d8b5a5523d1da38ac68c836479d57a8a9c977556887ff8ae580b0f3a6a0b3ee90f4ecc7c27d75be4cea578e235000b0a47f499735aa670d4137fe8f82e1f01

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          cece3fd101f11800f77fdff14cde18c5

                                          SHA1

                                          832aa8f6ca5577c76ae1a6497b57ac01387465a9

                                          SHA256

                                          85cf54b329dbd746c0d035bbff7e07b080ac7c828984d5a9a6f8d7b7007e1b42

                                          SHA512

                                          1c92a1ce4720d6243724efa97d6fcf796981539457f204cd32bd3b195c1d492e56a3e254bc330d9991637d825b4c7e1be8005ce653fe63e0aa0dde77058912e1

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          9KB

                                          MD5

                                          7e67d7f48420a25366c2d28434a87fe0

                                          SHA1

                                          b07f1454b66aacf5b3c754ca9df1253de42ef61c

                                          SHA256

                                          760a39e27ebd315016e1b8fd2345db1c46874414e77d5ac50d9dbf3a7312a333

                                          SHA512

                                          8a18edecfdcaf8d1c5b2bc3ad5771a7383c1d19588dc087f244f152f4f9aec2b13b930a8038b5de1a685ffefdeb269b292b89694e122c6b9826df20b413274be

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          67KB

                                          MD5

                                          9ad707037b1f991c4452369cb212a3c4

                                          SHA1

                                          0236db742198a8b58d9d52767e6afcef6af2df02

                                          SHA256

                                          fa445ebe164f5a5f4c2227b1b9955d92dbec6554408ec06354c868df8832771a

                                          SHA512

                                          6c98b961a15c55df49b4366e2fd49ddb70b0a3187b114be7510b7e44aace442d2ab679820de5439c3903e69c81992234ce30b89ec49738fb0e203e91e2e494fb

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                          Filesize

                                          2B

                                          MD5

                                          99914b932bd37a50b983c5e7c90ae93b

                                          SHA1

                                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                          SHA256

                                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                          SHA512

                                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                        • C:\Users\Admin\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

                                          Filesize

                                          4KB

                                          MD5

                                          c58f2414e26b942dce35865b439b3c60

                                          SHA1

                                          730dab23aeae9cd27828478cb5ffa15f9a36e4e7

                                          SHA256

                                          10d30dbf02d35ab27339158c398897cfcc6276a095bf5bdb3f7f1439d7494bd2

                                          SHA512

                                          b793a687f4a626c3eb7d033cccd49be22a36316b3ab277968e397d4a6afac51bdd555ca432d9317af85c687e19b5fcd44ed695fc3cbfccd7e88981186fbd787f

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\1uxdthlj.newcfg

                                          Filesize

                                          2KB

                                          MD5

                                          0a53de80e65931e950aea75609233d8e

                                          SHA1

                                          8a7d8a6030485954c3c663c7dd2aa846dc4e2494

                                          SHA256

                                          3cc3f91d80ec155a2eb43dbb41edbfe991361921bcb409966bd3139d72a4eb97

                                          SHA512

                                          4f121e08a0d1c6d5cbbb3b3f133f911192941dbbfefc24fe55ee1acae002c5ad4957c1094918c89b092c3c64dac1bd75a8f9cce978613555681e5cd903b7fe32

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\2sa2xpb5.newcfg

                                          Filesize

                                          1KB

                                          MD5

                                          2f7d270201d270d33cd17b5a3a4caded

                                          SHA1

                                          9893b5bc7faef80545d4b4fc52ef548f15372733

                                          SHA256

                                          98c7d7bf48ea0f512cc43aa0be0e7babc51fa25530664e2dc3db902961fefa66

                                          SHA512

                                          f68508c5e74c536e8b5c06243612d2ff750e4d5cf20bcc8323b1890a174807577de3f5295f6ca5fd0a2bc4b99d7be4a43f5d53e20338585a956728167f63cf29

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\dx54lrle.newcfg

                                          Filesize

                                          3KB

                                          MD5

                                          96e908be070e88fe4e0a7a4359d3d981

                                          SHA1

                                          41e5869d15e9f22ba6ec326dd6cb404a7c9b660a

                                          SHA256

                                          2007781188e502c13e5e17e8ffa0b61046774afa3157451c49238f4342c60b87

                                          SHA512

                                          59dbe48c8c3b5466e8e9e526e14ae7f080920bca5c59a48ddf0c15cb0149534e73cc0056981871d18223d0e2055f21ccda2e8ad7cbd485c312c1b81a8ca27e10

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\flyft1te.newcfg

                                          Filesize

                                          2KB

                                          MD5

                                          ac273df9c324775570a44714b7478697

                                          SHA1

                                          23611021f305fc230fd15de6c09f7db077d1c282

                                          SHA256

                                          abb3f7ce957a47f8918a3bea2a17395a6103d999a7a23b95076582ffe1a71737

                                          SHA512

                                          8ddc8a0ad57fe8f1cf91729371d6c6231f36d01b385f086a9d7f6b0cf6dbcd4a03f16fc939be4b17ae9f73ff48660f0b6273f08d2d759f663e6d8e00eb545459

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\g1ynfu4e.newcfg

                                          Filesize

                                          591B

                                          MD5

                                          963dcd99da76646b65592825ed298904

                                          SHA1

                                          72563836bd826df54aeb37b28e3f74b1138d6cf0

                                          SHA256

                                          90afc7d1e4994d44ecdb9e6a3d39d3f8b7459e5e748e4d63aebf19b633ad4734

                                          SHA512

                                          cf091dfff3fd91d71866fcaf54cfda9a61b7c5eed3975ffc4fb23c8bee30aa5e3f932e5677482b0c6a437bd3d0195a68875714172c52d4be330289c6a8a5b482

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\kdg4nj1o.newcfg

                                          Filesize

                                          2KB

                                          MD5

                                          c36f3418e270ee5dc46f329bffb35105

                                          SHA1

                                          c1efea68e899e3b5f28f2eac0341aa5b123fc121

                                          SHA256

                                          1cbc935ce627804e379c5cc56cb3f3ca0c1a12d2192d25abaa729a98b37d46a2

                                          SHA512

                                          cccc1dbc2f16308f4de98c90e77f4bf677efe514b45fcbfcb0a8d7fbdbb4ae87d18499d30b482007187482b3ef59825c903d57eadcdb65d11159d89e3df54099

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\lbjdnfpe.newcfg

                                          Filesize

                                          4KB

                                          MD5

                                          9f2a5d312a0625e708576c1b267e5804

                                          SHA1

                                          9270185afa844d686aaa67fec4a5586b5c41fb3e

                                          SHA256

                                          2600fca99403c0206a081f987ab33e0eb79bdaed9cc892692d9aa17d60d2ad74

                                          SHA512

                                          2a771b37cb7d73a2898f4f7b7f81a5a6a82df02d24c83300e6319ac39c7595bcd744f5370900b9c487853f6606447fa65a894f5592e53cc34aad2b93a919d6d4

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\lgq1xbrg.newcfg

                                          Filesize

                                          4KB

                                          MD5

                                          a07d83897de3abda80c9138ffaea1bbd

                                          SHA1

                                          f73f21ba2f917a4ef6a772e795a4a0dd57f5e229

                                          SHA256

                                          5fb8507df90af31c8d338b8ef1757debc446ffda0ae1f9b95ed91258d89ddc99

                                          SHA512

                                          59a55b471eec021182044ebfab7f1e18d0188553566e25bdef81abe84b14dc81e584a84ff5c179a3837ace8fd3c7c157d7312cea79dfb6ae7398e949215e7641

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\mk312ion.newcfg

                                          Filesize

                                          4KB

                                          MD5

                                          cbb9e180cd3b34a6b94fbcffae15c48b

                                          SHA1

                                          f5c60d21b1bfb80434625e769b909de2c1ba400a

                                          SHA256

                                          81bc90892a494190961a62f9678041bd9ac36fe605ad6bbbbc39080c6c291380

                                          SHA512

                                          59493350ff5eec816546807ffab628d9a741054f7c6140f0fde8a009a5eb8f2acbe03a14967b1b6b4d4d2845956aff02251adc15a5662443a2c4040b8f46913c

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\p2av4olw.newcfg

                                          Filesize

                                          3KB

                                          MD5

                                          5a85f24741ec61f2995578650c1c00d3

                                          SHA1

                                          8cdacc8d6211b231ab2f0e00cf87ed175e6d749d

                                          SHA256

                                          a62a9554a9654b774d97c389feb7ba781163e58f79e470547e3fd992a1316ac2

                                          SHA512

                                          36139ece0bd3e08e6fefddc1e931b82a9f81b01c3cfde5ba9c5413d6683b6904b70080892847c3830dd3f43d2f12cde1aaa854340853d8fe466dd90b98656934

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\pjbcvn4g.newcfg

                                          Filesize

                                          4KB

                                          MD5

                                          9a8a63b8c647db7b77f46361c438757b

                                          SHA1

                                          222c1e47f551ad1e9a23b5aeabed7512537a5a90

                                          SHA256

                                          6dc6668ffdf3619e9e2f5650c51d4ef2f0a83afc127cae5d2bb17fd092e75363

                                          SHA512

                                          0ec6d40ef0d4f0dfa0d5e8d430d52c84e23be36bf3399c8a8cf41c0b3c42185374a51d0a5fa2e65bd5f198b215998ecf2729918a89655f935f866f23f42d974b

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\svbikjfp.newcfg

                                          Filesize

                                          4KB

                                          MD5

                                          d94cd229d9d66eb26dbfa32f3bf5833a

                                          SHA1

                                          ea76fb60946d21dd73a83d6c969bedef06d5bad4

                                          SHA256

                                          a7f32d76f023e23bd3e921faa4c6d48ec75c4dea5fc2518e98d6638b00453fc4

                                          SHA512

                                          3cc7185c93fc05c0439912d7a032ce501e65d3045fcda83b2c797c9f163a5645ae177a9a33109db10c18dfd936787bb6897c76c10d8d704464b62f7de9f7c678

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\user.config

                                          Filesize

                                          330B

                                          MD5

                                          335d8b10a6988eb38995ef38644b1552

                                          SHA1

                                          6e7f535cfa1e3ba2a2117a5a0801a00c6ec1e523

                                          SHA256

                                          aa0da1dc9950d1e0ef36e6429976cd1388561b5320aefef1f3f99a1a7b05c1dd

                                          SHA512

                                          f5060a2e0f2d5d5bba229a8a34442efe0b5334b41c9b76fd52f09325efcf6efc599f87e59f3a904ee299fbc9eb6519843559d539396ac25039a4696f045bb3ba

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\user.config

                                          Filesize

                                          462B

                                          MD5

                                          6c7428ee170827af95a42c36eea3c79b

                                          SHA1

                                          0f3c9a3ed6b8ddb27afe69932de2b96a5ec2a84a

                                          SHA256

                                          acb6dd2a0049c987baaa2d46c6fcd6de74cc90aa79f3b5a5713454fceb299a46

                                          SHA512

                                          e4fe547e171e2d90a48876592dbfcd688ac61d63ff2c69fca4ab9bd4935600f362bf18ebcee1d7b2e2a8c16f15695627c28133d55e79be18d48c27c63c2e5b54

                                        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\11.908.5.907\vp0erfgw.newcfg

                                          Filesize

                                          2KB

                                          MD5

                                          242915cd672c99a95341df9952314ddb

                                          SHA1

                                          5a79c10f0d7442e60e0c8ce53e4076038141ade3

                                          SHA256

                                          78bf82194ee9c0a0b5ad52b56eda120c5077b27508ed5bdc799d514a0609a394

                                          SHA512

                                          484f6322f838f8b42c02743f9b574f6cb725d55cc0591760c811b22adba084d99cc38435620bf7ddaf95fb63edaa454ffef59e8ded71d5a81eca208b2a1a910c

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\ICSharpCode.SharpZipLib.dll

                                          Filesize

                                          72KB

                                          MD5

                                          f5f3197cf5652cc93bb1e613d9cc0060

                                          SHA1

                                          7a6eadd5ec36e914662b325c022369eb0a7ab6dd

                                          SHA256

                                          b9d6aa8407cefb2dc8a05f565d5638d69bcfe1eee1d1df255fd909dfad776919

                                          SHA512

                                          a4f1cfcdddbad8ee8c1715dcb2455d6792d1a215a776620a72df150348c57a0f7ceb30fe6933fec4a135c83acaee8155076ee0715c1a680fde434f5ebd21ef49

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\ICSharpCode.SharpZipLib.dll

                                          Filesize

                                          64KB

                                          MD5

                                          d59738fca944214d059d8e9a7f662d4c

                                          SHA1

                                          6bc549360e298362379364ec43e4fd8e9b1f2fc4

                                          SHA256

                                          7f00a27a44b7ad3715d711dc5ab64bbee4265501aa29a62a6fc89dea745d6cb3

                                          SHA512

                                          32937996a4262b8c0f612f3767828d62364d6a135ef43cd05d89f24e0cd0dc39e7ce95274e9558a3e224124e34a84a619ea38418186d2229bdf999c297ce6792

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\ICSharpCode.SharpZipLib.dll

                                          Filesize

                                          74KB

                                          MD5

                                          3c442c0ea14878af20573ae06f8dfb96

                                          SHA1

                                          d6c7589c730538771cdbaaf07b22c3768704b0d7

                                          SHA256

                                          96400c0c999695ddf0b47a61b4166a3a883e3b4e0e3b7128121c9bb06e9ec9d6

                                          SHA512

                                          fcf5e4c3ded23ff206f83dc6d9718d889e8e118709fc42f6af6481bf2f64fb17a8fd837dd1f98a7367ae400ddf8a9614dd45c072d2e38023e1033bb8e65f574b

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\Newtonsoft.Json.dll

                                          Filesize

                                          14KB

                                          MD5

                                          b621b72255ee4e0cf5c630a13e2dc158

                                          SHA1

                                          9aaa27bbffdb1040160ab019e17e8096af904b8f

                                          SHA256

                                          7cdaac96cda0e0a8477774083b865ef609b993903eecb8818acab7b12115067e

                                          SHA512

                                          c09c815dff1ccd9ccddcf213b9a57505df2aa33b6a00cc023a9c1fee34691b9909ee2ea2b5a1aabccaca876844e41f3d4b5138864b0d2e94894afabd5804dcc8

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\Newtonsoft.Json.dll

                                          Filesize

                                          5KB

                                          MD5

                                          a741972fadc48dc2f068473d74698fe8

                                          SHA1

                                          a3e6c3a2f096c68f5c820730edd6b8cf3e44a2d7

                                          SHA256

                                          637e6bcc2032d9f221f1c28580a5cd817217caa15e567a8b1fbe98b39b89bba1

                                          SHA512

                                          bab561894247887e1406a4f93c46feb08ea543e394fb22f4b4a3b4fa31eed22c59a5456089590320664356ce866ef60b58d9470d2fe4dd53fa4b4214fc5396fa

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\Newtonsoft.Json.dll

                                          Filesize

                                          6KB

                                          MD5

                                          d7d3f9d0ebf9900b893ec31ce00a6f15

                                          SHA1

                                          04565fcfbe26323f3cbf4955fbad3e29399cf538

                                          SHA256

                                          c9c3845b6a708fc9a4cfd7b14df04f4314fd723adaa182669f1dd4f38275c4d4

                                          SHA512

                                          f1a888a2c6626f1179553c91c9b7e6131056a1a4377688b531bb1d3ca6e45c47608b2e0f7da4a75422189e99091e43cb285ee1b9bb8a3b4d4653378bb42cfc13

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\WebCompanion-Installer.exe

                                          Filesize

                                          104KB

                                          MD5

                                          5e9654f23dbd5198e8183159db5c2317

                                          SHA1

                                          eba04cdf5130a6bc65206af93180a1a7038eaaac

                                          SHA256

                                          d5593f4d8c604710675ee73be6a9838eb02e5b4f903b417038d5fb0a64bd9f2d

                                          SHA512

                                          326c1dfcff54aad53ce8ba8bdcf252815e39d7b808eddc9ea1532984f920333fa6beffbd2bfd3c829267e39830e3fa2121c8b0e77e37c77e5f387610b046ea91

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\WebCompanion-Installer.exe

                                          Filesize

                                          66KB

                                          MD5

                                          c68e619e9039c3cf941be96eb14d661d

                                          SHA1

                                          f06113a37e2a1b7ab2b7ed954de60b8cfd5b9a96

                                          SHA256

                                          589f95c12aac9d12525bc9e8cfd8955153a4e960cc28bdd206003978059b1a10

                                          SHA512

                                          b953ad3cbadfca264f18b74c6b335da970880f05640460102da41b6bd1cb4c7d82ca6beda81e3f656e2d23ab72a37a9f38fcc2dddd2479a5c5c391d48ec96d5e

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\WebCompanion-Installer.exe.config

                                          Filesize

                                          2KB

                                          MD5

                                          795c7fe69d7d105b5fe997366a4ea7ce

                                          SHA1

                                          3ec7607ac9a316289b87b12ef55c434ddefdd8a0

                                          SHA256

                                          16c8c66e265f4120f8507e2df0fe0545a5284a905bbbdb1029a5af8f27017417

                                          SHA512

                                          28693db597a73bcb153aadda682c1fe87dd0fbc0943fc157cdec64aa74057853d86cfd730d9350b85ff2581b481945779ad9fcd69867a5fd9b0a6b696f844380

                                        • C:\Users\Admin\AppData\Local\Temp\7zS8023AE47\en-US\WebCompanion-Installer.resources.dll

                                          Filesize

                                          9KB

                                          MD5

                                          3c753f7d9afb1053c3ee7e74699fafca

                                          SHA1

                                          a05192283d8f54c1da4588d7d8865da11f26b027

                                          SHA256

                                          f0990c39872a1f2c4b4ad6bc3194b56ad7caa1423d1160ba05e31294fd25dd7d

                                          SHA512

                                          5a2b080c9333cb89cbedbcc4b3613d6ed36c115bbd956602b8b77baa293a19f456ec881a7f302250be186b8fbe01aa495ffafabac8b9528de95c2872e5818bd6

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll

                                          Filesize

                                          139KB

                                          MD5

                                          8ec2b63f3ea3b8f019fc15aea409d090

                                          SHA1

                                          60512078fd04ebcdaad203bca33379231362bb0b

                                          SHA256

                                          b28bbc15da808905b4c9c76aecba5852023b6d051bed682c39d341e037481d38

                                          SHA512

                                          1d8e95ebd4a46a6deab3431581211c03dd50e43137d2bb2e0d93e8f8446a7dda66f2e5ebb8f5c382efd27e036655faef0103f41955b08fe7a525ce733f372f33

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll

                                          Filesize

                                          30KB

                                          MD5

                                          c58af15e9175c66a6983180895e9b663

                                          SHA1

                                          237a01ce053541ef711d50b389b2c1c0db273410

                                          SHA256

                                          4df25313d0f379fdd454d1f87b06af04143dd97f111f0b97336bbd561016aa78

                                          SHA512

                                          76eea003dc697b68b03160c8f7bccbec4582eaac0cd65d2c7cf6ab1e0bf15d101977ecccd6cd1938083b4c029d975cd0bc2e799a45c6ea2711f7dddcde326f7c

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll

                                          Filesize

                                          46KB

                                          MD5

                                          60499522bb78c3b14c2f44a11cc288e9

                                          SHA1

                                          8128b8e2f13da6c591b54fd9da158f2c58a973e6

                                          SHA256

                                          f2cc730918a997eaccf5a1d90f70b987cada4b9ad41cf52650b08ab7f26c8718

                                          SHA512

                                          3948afaf6ad8f7f311e5b1249785b9b42aeb36412a7f35a29f5447d5fd82d61b8cde1c37b6870065d8fb506199a07931151cae6e67bd4d2ffee559916086fbf7

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                                          Filesize

                                          32KB

                                          MD5

                                          2a61011460a9acb743aa407954767dbf

                                          SHA1

                                          e0034f85d5efb971b246779ed0180d221d44cc95

                                          SHA256

                                          1d61a11f379a5c4ae20f81585ffa3d219723b645ddc18ff06b375dced7f9937b

                                          SHA512

                                          07fa8c141c63e1d043d2595370ef39ae6889eaa90a56ccda5fa9fb259bf7de4f2199aced3caab64aea283446c9a7f15e8289e053f3dd22f6e3fa3f4e881b6e3e

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                                          Filesize

                                          45KB

                                          MD5

                                          033089ebd1becc7ee0bde1f384d48fe5

                                          SHA1

                                          ccf713e8c2570afa0f47db67a2af51dcbc36f4fb

                                          SHA256

                                          fcab29e28739c3fc2ad9ffcec2ccdba0d0539f5bdaaadf22edfb1b9bb4c7d920

                                          SHA512

                                          ee0d6c9a67d9d756be16d7b52c57456cffeeed04881a99dbc7c09e5ad6a6848713e33eefe5a7e727c2ee65bb82e741fba08273f446b5f7dc7082823039028d78

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

                                          Filesize

                                          8KB

                                          MD5

                                          db5ee1c54eb464adc034689788577e0f

                                          SHA1

                                          65f54110f8a6b74b39cd766093ddf1596b6df6e6

                                          SHA256

                                          81dec7b691b5c350d681c7abd9847495712fd277d1838c784c69e77268f02e39

                                          SHA512

                                          feaf7ab516f2e752574695e3bfcc883ffde56aed587e01037ded35f55eed4e1ebb4ff8044d84b526c4f3ffda79104733d948b7747dbe30ec584d401934486e8b

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll

                                          Filesize

                                          8KB

                                          MD5

                                          2f70b7ae8bbc35e6d104e12bed1dcc05

                                          SHA1

                                          9968291deeddc33a737924c16c5b832edd7aeaa8

                                          SHA256

                                          18d583b2c607de97e08843ee8528d8dd24f317e31a24f632267f902c9e274635

                                          SHA512

                                          174f94daa37c7794b2e9102d6044f971a11d16bf7dca7b0eb6cc4d6df10857390ff065f8463d4b5e10215c5b9fd069a9460b34fb78fcc5aad72581c5cb6cd82f

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll

                                          Filesize

                                          1KB

                                          MD5

                                          6f492d9ebb7a01edf69e877197a7e94f

                                          SHA1

                                          0374de55c36801693365810659422c66e13f072a

                                          SHA256

                                          cf7172e0d0199335f1738fe1f556894dd2e69f722828e2cee385f33d4db3e4b8

                                          SHA512

                                          9531e36429024c77376967925a2967297b8a57ec4379f1b5c0f824ec91fb0898d29a642ed6d75a254dfcb0993b2627311c9db2d9c76f6e99f895e75c410159d1

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                                          Filesize

                                          20KB

                                          MD5

                                          a56cbb02a001cc948ba2754cbc93b0b0

                                          SHA1

                                          b60351510013db98e2ddb22e722b0732646499d6

                                          SHA256

                                          a62d0e5938f461921a6ed5c2929957851f3bf86ff21a5b3b8d9b908a53a63278

                                          SHA512

                                          8c6cd9acca530a58f29e5938bfa058bee043c653b098a74524e93b37f66038630a397492d51410c55cc67534237c9143692f9c4e026884b1ffafd8084170a2ff

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                                          Filesize

                                          31KB

                                          MD5

                                          c429dec02e73d0d2ea56b9d500953682

                                          SHA1

                                          9c341213a8e79518eca7aee2bb5b4f0131a0b242

                                          SHA256

                                          a9f07c77e2e0b3ea3d7de30f1a661bdb38e614ac2d33f54aee365ef21ac52132

                                          SHA512

                                          fdb2f4ec6a41516e8c9ef3277c901e668fcfc63d774a11a3bab99bb9672e7007a3f1eb47a79800a2ce24c5033e5508ac3dac4fd636dd884210d7130a3766e54d

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

                                          Filesize

                                          9KB

                                          MD5

                                          9b04dde498c126bedc2d1b40098ac878

                                          SHA1

                                          026f8673dd98e6772428014b672dc21fed23a10a

                                          SHA256

                                          a551b5d6a8ac2aaf3bf1fdedef4e1e1c00f6e64958904cf6797b2aee0858c2df

                                          SHA512

                                          754ccf91e8885cd8e7505cce15f2fd0780d4d7cc802b71fa487a9467c28568997f68fbb7f516054afa8f83bec6efcfe063d0920cf15d89ea19dac5c8f75453d3

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                                          Filesize

                                          13KB

                                          MD5

                                          89d5e646ac50346aece142b959db2d8d

                                          SHA1

                                          1d535e9b8d4224ac5e91dd9791e7f2badf38cb83

                                          SHA256

                                          1d5ee763dc1e60114766997914f63ef0a251116d4990577dc33b166ee7fed3dc

                                          SHA512

                                          ae13bc2d08182f58fcfc2da962c1a91a9bc1dce7b6b4840d794c3bd1e35749585445d310a685295f64965cae17aa9bcf1cb14af9132225058b142614537017f6

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                                          Filesize

                                          31KB

                                          MD5

                                          73a8a8fbbdef94d8313170ebbbd0cb67

                                          SHA1

                                          6fd3b13d0daed9622ef2c889873bb0885e82e0c6

                                          SHA256

                                          a61b847a8cb87c25d7feb7b5ad78175fcb3fce9b66d4faefc9df77fdaa21b51f

                                          SHA512

                                          cadd611e5b8968bd3748697bf025467abd727b98137f1360545286fb9af9871c57de6dcb2ac4492cc8b37bcf1a164c2b84698dbd1b1df340a149f45c23643229

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

                                          Filesize

                                          59KB

                                          MD5

                                          58915cd6c8108bb886994ab093ab2319

                                          SHA1

                                          234a531efafe6f44fc69ef04ee6e54046d580b81

                                          SHA256

                                          6a3c736c2d1a5473c5a176ff197efefe9e63685c731eeffbdad16ce28fcc7596

                                          SHA512

                                          29fbb2ad29c722aa60397fd4fedd19a87083c97420664656b392be50035381d35a2df52eea0be5eb9427ad554d3c09068ee9b8e2724e7d6f32e79e5358612575

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                                          Filesize

                                          43KB

                                          MD5

                                          ab1aac3c6e780f0990b1beac9fb3e734

                                          SHA1

                                          1c569d81d0db75e503751001ccd3b4248026a704

                                          SHA256

                                          c3b5ead5d02c91cbb66b79803122c4aa56cf24d348d5d13dc9ccd7067e25e2e1

                                          SHA512

                                          1614b26377a5e4f59304a304c8b23f33d31338ae74975a251ee319636cbea994d2d255fdcaad1a2176c29d6bd0828d7f300f56becd357ab9a6aaab1ee25c8fc9

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                                          Filesize

                                          39KB

                                          MD5

                                          d7e3cd8af99dbebc628a0885ff424bbe

                                          SHA1

                                          7aef7a3693b9ae4de1e9c3adeb30789e3f23af25

                                          SHA256

                                          8c96d0ec4829124be668d8b8f0c99ed4814b977e1ae59b3601c3a4d5de0c1dc7

                                          SHA512

                                          679b54c6afac3abd98da62c39450de6f633a41859d226a8c7a405c61b783a4e2ebf4ea859162c92a47496cf7fac833311c402b45c00209c32aded2461bfbf095

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

                                          Filesize

                                          1KB

                                          MD5

                                          eafc68b85ee5f5952e359bcfac62ef9c

                                          SHA1

                                          d248b27ec73cc480966c33e5298799e8d5acbe98

                                          SHA256

                                          cd98f33cda0827470e9a325647d8cb200472bf4b8ea84e04ee8ba7be76ed106f

                                          SHA512

                                          3841124985b0763f594b7c8a2501311fac7d2fda9a3f72b9d049f3714fbea728368e9b851d93d7f819fc1c5f658c1d1ed0dde388b5234d736223b229ebc7c59d

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                                          Filesize

                                          7KB

                                          MD5

                                          c588318c55de8b6c1915dca92a8419c7

                                          SHA1

                                          0c1cd04fb6b84054c537d4db437f6bb81e27b51b

                                          SHA256

                                          fdc71934f80946b230fc9521de6ada756be551c87047b7feefff5e40df28c24d

                                          SHA512

                                          2e22d51ec232bc3f058848e16d5f4692c9b27b3f397736e7fc2ae34c529cc3fd00867bfa8f7986a57acbc26e2fb056a5d8d60c924935d89c08ed8423d3fc3968

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

                                          Filesize

                                          17KB

                                          MD5

                                          4615bfbba7af4381494988e730b449e0

                                          SHA1

                                          ca8ed05fcff4fa77887ebe8bd5b9ca834a6a21ca

                                          SHA256

                                          1512cd0094d4973c6d467d90a07bde688b4890f32a8e3af01c85a266d029b3f5

                                          SHA512

                                          eca85ccee6c2020268154f0d169d82d0b6c7260fed582f406278f7e89a29344dd4180d28bb2b43475f4abcef959f400ffae6f9c3c20509488c59203b7136b464

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll

                                          Filesize

                                          22KB

                                          MD5

                                          1c00f92264abb2c000abde46d09b5772

                                          SHA1

                                          0de55971d880028c30bee3204bc2c849ada168c8

                                          SHA256

                                          b644b6311b9aae25ea5583719c3186682858ca0ae137bba9a647b05bf6aa2f43

                                          SHA512

                                          35cbb421ef9ac31c96fe4c59da2ca5251a6ef2c2211dca7e3c674605eff7aae13f2c12dd4e56923406a2dd9c9fdb16972e286454f33808bc5b4aa57ec9b7fed1

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                                          Filesize

                                          73KB

                                          MD5

                                          ae384402acc69a70195783a39d9ec20a

                                          SHA1

                                          ef3b85a3a0f0ff156ff12086e9d47fd7a668a4ad

                                          SHA256

                                          1355d84b3fe2602764ab9c0db165b6fe18add99c9eeaaba2b7475f186818de74

                                          SHA512

                                          2925fdb33001bc1f6ecef536669fdf8f5043f2a384a8b2fa2e6cc36656cd6bc6cb26f16a5af45debd4419c802a826fcf3680d5251ab2eb3d498b61d0a667eeec

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                                          Filesize

                                          53KB

                                          MD5

                                          54a71dce37c47d860558771df12693b4

                                          SHA1

                                          03546bc8a64fa7dce3d5acc934bff489e956e1fc

                                          SHA256

                                          0f9e9a715138bdfbedd5d54af67d4d40ed7eaafbc2462dbbfe0ecc59e9bea9b2

                                          SHA512

                                          706630f9c93c1af31e56dfe63724cc9a92877a3e461c2b1afc3e9f941adbe68faed6756b5d5909e7dbd322a9aabda880a452f75521a10766c5597fc020599c99

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

                                          Filesize

                                          112KB

                                          MD5

                                          77534c166c314fca9dc4b213ae1426e5

                                          SHA1

                                          535ec87689744bc2d5ff182fc8dd7853b3203928

                                          SHA256

                                          fe28f7eb6b3531f917735481bc91333bde9afbce22b456e9abfae367eda23e48

                                          SHA512

                                          3137c3839ffe8beed99f4b1da5c18fa460feff06a09e0dae02ad4c71f3a4f16a14ecf479991a90d04c7e020bc630f78474962cd36214d1ee838f49d8fc6f6326

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll

                                          Filesize

                                          65KB

                                          MD5

                                          bb705104e17d45996db273415526e3d5

                                          SHA1

                                          ed908e5fc0b43d9a6474e4dc9688db5f4c52dcc2

                                          SHA256

                                          c5d5e7e5a854198a5c648c6465954e314225165899566499752c31fa8cf2924b

                                          SHA512

                                          5cb041db83d339dd1d3fb520ca29536f26559cba0890ddc68663b58dabcbd0d25168c883fd60d060df26e3063739f4367d2692581e99ee19db5e89c26b31cdce

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll

                                          Filesize

                                          54KB

                                          MD5

                                          29300bd417ddefdb789914d6b81de68c

                                          SHA1

                                          cf56c5c5c8311a2e6d6364d7777adfbb944b30da

                                          SHA256

                                          7b5270a89424b4b6d34656f0a15fd22f98206b7f55e3aafd8a21e4a943adc856

                                          SHA512

                                          6174bb9c11b40681081b6e17a4169a7b9ce3d027631a7314337ca1626f6a4357f27da062f6913b54b85daa801a1ebd8c0afe5188299c30ad36e0bd51dec403bc

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll

                                          Filesize

                                          1KB

                                          MD5

                                          009229ed8fcbbe258892090b61a18abb

                                          SHA1

                                          d807d144a899e4538aca0dd5ee33f69f06a3a9d3

                                          SHA256

                                          131800d29ba32d5f0969bbca716f126c8b770432f883a69f51500dfff2e9d388

                                          SHA512

                                          a26df3c3ab5402ab57aa884fb044956bd5e6182d29121189bbe961ec16e09f8ffbc32ae7b8a9ea129ba1873a359cd48ecbf46a1c50935d04b4bdeaf9bb56a1a3

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                                          Filesize

                                          101KB

                                          MD5

                                          f969151cb4dc8976b218aee4b3baced7

                                          SHA1

                                          54d8d61c1c2d0fbf09b015736677ceef6e769a20

                                          SHA256

                                          e44da003a6e6cce22367d45f2fdc375788c66ef3477fa4968c2ad46c7d5f2929

                                          SHA512

                                          d1c719a005eaf95e979060975d446fcae97d41a01207d2f27b1009d6e30e73336d2094dd55f4bc61818200286751c2528a248e9e58d26ef7b244886ead164e13

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                                          Filesize

                                          75KB

                                          MD5

                                          aace029faaa7c28479a245816ac267a1

                                          SHA1

                                          8730513e9fbe9aba855d218a01484cb51b5cfea9

                                          SHA256

                                          9f990b1d495d1ea1d58e4d5c818056d8b753e1a359d8d459539421a11a175abf

                                          SHA512

                                          fe6b11e1ecc1e7a695c8b580dc261d43180d957bacdb6727025c3208636799b51e899fc871f1fc3c7dc380fc65df88ba54e8409f0934d47236ba307946c71e0d

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

                                          Filesize

                                          67KB

                                          MD5

                                          5cdb9699f08ce170c9cbe1a61f02f4ad

                                          SHA1

                                          c6ec73e19bc0cc61ce9df662e7a939b8a6cd46d4

                                          SHA256

                                          2a5fdb9dd23ff6e75026d143fe1a3869987d4ae3ad8db41f72a2e6ad75e10cad

                                          SHA512

                                          7d4fcfa1d599c3ecfefd919b1f66a8903774445b4d6ffa34eacf9812bbedd70939e8d1347da9352461a40bcb8927faa0fe618416aa552bedb127fa1963a18398

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll

                                          Filesize

                                          78KB

                                          MD5

                                          b03b0fbf6673987a2e8150379efdb94a

                                          SHA1

                                          89b192276ef86b94fcd652dc9173331843f5de08

                                          SHA256

                                          515d0253e4eda722953adf9b0ce15491f4391b0a5fa5d24a4704e6a140e8f42b

                                          SHA512

                                          0b76e652f7b321c3784120c45bf645aac78cb1f91863e5f20453e8b830154b12ee4d4826c40a30abbdb421b9719ecbbfa807bb3b4973f7a256442a44ad16d221

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll

                                          Filesize

                                          118KB

                                          MD5

                                          dec9b35d6bc9384a24aa546654d377ae

                                          SHA1

                                          45e213f2cd721313d7fb7ec9275f0c03c9445222

                                          SHA256

                                          971d504befb82bd1c7d25ebfac37bb36242cb1ffa647d8a3697917e768dffbce

                                          SHA512

                                          ca02fc5531d56ff05a42b2876c0149de36d436b8e58f3eb8b9b03fc01c2a2d59719a8a3bb512067e469b48e5935aa58188918ca6214fc3f7b6beae525d856fb0

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll

                                          Filesize

                                          28KB

                                          MD5

                                          4902ce5868830b6e1d230a8dee18035e

                                          SHA1

                                          9c8d4b943b29e95f6666ba279ce731902afdab96

                                          SHA256

                                          9c2a5669fed30556363341be12bb6bf9b94c00f1dc79625c4cf09fc23d0bba97

                                          SHA512

                                          2486dd6b2268138cf2ec0ebfa37186ec254e8cfc7ba89ec92d7e6f136b1a6749225de10c54a37eb8bce56b65ddd6b64115d8ee7eb29c30f45cf72710b18eb612

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\VCRUNTIME140D.dll

                                          Filesize

                                          72KB

                                          MD5

                                          ef25e4e4c43d89c4d0455e57cf94c7d5

                                          SHA1

                                          ca5d357046ad69998cb452b62dd815e78496b949

                                          SHA256

                                          942b49eac95fd1176758da27463ddd40545084e93c6202dbe558492568e7f1e6

                                          SHA512

                                          760e7568b01f240d701d917a97871b00cdf36538e2a950a56a27430d4bd0f9a8e91a20e36340adf2230f36fbc654726e7099084881a23c1cd9cf4169255c1018

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

                                          Filesize

                                          17KB

                                          MD5

                                          bfe0690ba2e30803de37092a818bdefc

                                          SHA1

                                          9c0e41883192071cd34a17a9dbdbb9d0979b1252

                                          SHA256

                                          323dd3e50dbf47d6e3bd75f81072019b13e1906882fc4072dc667d07ec968a4a

                                          SHA512

                                          9d4644420d23e1c49aed22c8b188de8966633bda7c081bdf7d152cacc6161ac3aa6f8c5735570611c941fe2786d094ecd3fe4460b30920bdf0ead038372d01ba

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

                                          Filesize

                                          46KB

                                          MD5

                                          1ea5a7aef339c9bc2717c6699fd8dbe9

                                          SHA1

                                          29d4edda90351988990d89a0f6415d57afee1f49

                                          SHA256

                                          8f4a143fe719ef3eefb6319ea6362534a0524ae65f189f48748062930ba27101

                                          SHA512

                                          241a17a247dfee953150abc3fba2081270d397f011fcacd3adec70d1ba127be8e565258adbeec25263499ee53abd5f195ab8abc44de5512cd653d2478ea413a0

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe.config

                                          Filesize

                                          15KB

                                          MD5

                                          cc1a2f94902b1191d5fd995b4745b45d

                                          SHA1

                                          e5f0c77e480a3d6f89925e3fd16c03508cc3fa93

                                          SHA256

                                          d457acc416ca08482ecb231090026c8dccd7ac73fc26a9c6280c2084e7e522a5

                                          SHA512

                                          583e294ac10403f0c661b67220a141502c1fb4c33546164a73c54a9df33621bf45e356f5dbada2a4ad939b347ad871cbb538ea25da0e8eff6ce07b1031c37e55

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll

                                          Filesize

                                          35KB

                                          MD5

                                          2bf3fbd83d72a977db11ba412225b095

                                          SHA1

                                          8fad4b875bca2d079e27929e5a6ec7efa32ac23b

                                          SHA256

                                          28d15c1ef706daf5fb9164447a7bc07065ec9b6875b42189926565d703be7b93

                                          SHA512

                                          760cc92859f411b1b93acfa2c682cd1d662ae49e27ea7d4638272b083065ca3a4af2a8794a2cb91b74effd6ead86391bf19189e09e70ee4ebfa226308573e547

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll

                                          Filesize

                                          35KB

                                          MD5

                                          c56be3326516d2da36ce8cddb7a83f86

                                          SHA1

                                          da63aab96d1424a7034b4ec0820ad09869a6a6f8

                                          SHA256

                                          0df78871c2fe6dd6c56018fe0f97e284a2c5f8d5413f61b8d5f4305df57637e3

                                          SHA512

                                          5cc9297e43e37d978e5a80184a531ab93f64d15bff4b12076bf1dfc9036988e430240debb0909b2011d08dbe4305e8485e11ba6d5ed80be7c16e678dba99f518

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll

                                          Filesize

                                          105KB

                                          MD5

                                          ecdf21e2df32674e045eccf17d0dbb0b

                                          SHA1

                                          7c26693f7b8bdc54fb528ae7f8834f3b979dcf58

                                          SHA256

                                          f76ee09cd47a041270fde93d7252962b402e9bb98b6c47b4022fa6afdaeb8da4

                                          SHA512

                                          351f27441857f0aba869112dfd7aa5b7b199050da1c16c6ff1a903e7253f31120827356c69583b952d427f260edb37af453af846da1fd4e2cecc8a43caf98378

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll

                                          Filesize

                                          52KB

                                          MD5

                                          8a9166274ad843ae18282c6867e43b0f

                                          SHA1

                                          553d3986bdc5f4c8abdd62e75823f4cd2b6f71f7

                                          SHA256

                                          8992daa7c4c0ea14a53233d21ad69c02a6cd6fd4937c7c06103e9729119ae281

                                          SHA512

                                          f7222e7604471ae65e6a42da4a0c33cf6150b19fa4efcd6244df176cf1017029da1cc14bbfbc1540d3e3d6f997f1b9158ba59e8485d9cd40f1dab927b639a6dc

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll

                                          Filesize

                                          26KB

                                          MD5

                                          5a1bd44affc41f953cb752b2acdf74ab

                                          SHA1

                                          5e9f8cee098b2a9fa8401b523e8868223964b233

                                          SHA256

                                          075de7f7d02f1dd688f6b6b4f73412d1f3c398d4e865d06e8a3c826b04e8f678

                                          SHA512

                                          2118eca4e0c899a4543a2b7580678a38f7c39ef10218acc8b3deffbd6479d9d824682abb0833dcfe244dddd4a9adb228ad219f62372a770ab252e4da3a8d9a39

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll

                                          Filesize

                                          90KB

                                          MD5

                                          55f0605ca2c05050c68ac054f3a9c6e9

                                          SHA1

                                          630ba2a47d789dc9c5f2d553638c4b7747c1dfbd

                                          SHA256

                                          765f4b1f9aec75d784c5102c4ac15a192cac9ea147380aa2b67963397da52ef9

                                          SHA512

                                          9b17bda3b080d9cdb55c194581857469821f5d26521c05f1de9bbc0a73687571750319666196f6e768bf0a3b4ae3245faf57c9c2c57acb4853755ae67fb3f09f

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll

                                          Filesize

                                          42KB

                                          MD5

                                          d489d37c6e91d195bd92414520741e0f

                                          SHA1

                                          8035a31c704c16d7497d2fa0a453584e6f7d2ddf

                                          SHA256

                                          5317a1bbb1be539960884f1c5e2875d0a4fb638d589952944cd63ad79fcea0cf

                                          SHA512

                                          f3cac928c5cf15bba89e4b8c01707a5ed7d62bca5584d93756bf0f3e14904aef51e3b836efe3205e48d0819cba9e043c2b156ce6c3b644d27382255e50ad7201

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll

                                          Filesize

                                          38KB

                                          MD5

                                          7e9fa2ceebba136fd22247601a49ff57

                                          SHA1

                                          4a7fca5c014ca8bcb2c2f9e453efa9d8793f5c1c

                                          SHA256

                                          b4e87a98a201ab9095b8ac23946d7b76d4bd2815b3d89a0228c6684b91aca445

                                          SHA512

                                          6b8a1d4bcc9d3224d2a47fa48697476f4bbc1b1617b25c06ac811e7bb202688d76e3941fd92f5c1c09c585de168694442ee839a14fe3ffed5d807b834bdae138

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll

                                          Filesize

                                          55KB

                                          MD5

                                          3640f0efc15d87de86f08fe80a2bfad1

                                          SHA1

                                          6d5213f6bdfc933985f4a99909161afcecb4a541

                                          SHA256

                                          f03eb1d0ad810e804573a570eb8c3d1ba169b0dfe221e236651a01c19c96b7c2

                                          SHA512

                                          aa98679e3e3b2242ca9b2a22d406a7b0fb72539327794c7398f92e7b5fe681e513393cef72f55db9083ba0670ebc76f3ea0db169bcb9e854343364ab2c130c1e

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll

                                          Filesize

                                          14KB

                                          MD5

                                          e8b3a1fe9074c7c2ad99d94d413fac17

                                          SHA1

                                          548ddd576ef1994f6c130623f1b805b7772f6786

                                          SHA256

                                          acf91988fd2f280a4c6e3cd66e4940b86e04ef27ba7b6ced9e52b44c242fa2ff

                                          SHA512

                                          c20ddb0f5b895db7697869b0e2c76ba241e57f4ea8ec50980b6d426a33a9f3a7ada1699cc9b86ba69231d87b05361d8b699114d7271f70e31a7dbb86b2bcf0ec

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip

                                          Filesize

                                          394B

                                          MD5

                                          130e5046b029a0847ac90aa770e8004a

                                          SHA1

                                          05738ba293fb8b5ec72eaae320d4464d543129a2

                                          SHA256

                                          a971b7c5d94091a7609b4636518a0ef56d984b7f0ab237db96081aab25d14dac

                                          SHA512

                                          0b6d474e9268a3cc19817f11b80ca3734ed9a651bec2207f4f99da9d85886c9e1ed3721ebd9335ce82abdd970a19e3c5e278b8a40c0237edf458d60a0d5ca816

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip

                                          Filesize

                                          394B

                                          MD5

                                          d86de8c9893a6390e5f8e79e9aa5597a

                                          SHA1

                                          207884fc9cbd9e197f1b9bafb119a94b09f315cf

                                          SHA256

                                          5a56909f0f15b85db635c1bb4abc1dab8e8cbfdf9cd8064597bc0f895b35b35f

                                          SHA512

                                          0497fe58d8f68b17f8da99a178b395f512f13ce6f2b7437fd01ef991ca8f09381438ec0ba1043809f5382720868db2cdaf1fe7226000e62bd4b3c6acfe39650e

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\AppSettings.txt

                                          Filesize

                                          332B

                                          MD5

                                          590fd86ad024f2b655deec8333e240a9

                                          SHA1

                                          f1946050248dd1aea834f139063ac8eb3e41677e

                                          SHA256

                                          7afe6a8c5bf14cace6e9bb2d40df2adb5f31325fc024f448138106cf7b63f7c1

                                          SHA512

                                          c19bf730552e548b6caaa27f5ff2c5b34d34ac9408b3b6e388361635ddfd4f619b9205fad76b9141f2804b8dd364cd843dcbabd4d9d7b7b712f320f6729d87ec

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\CData.txt

                                          Filesize

                                          209B

                                          MD5

                                          d6a41b3c23d831c73010400f44277f67

                                          SHA1

                                          a2f7c8586001bbeeddf253fa7935392936fbbb3e

                                          SHA256

                                          6eef55fe42db23d85402b233f082029c1073c44982a1e924790a5693993882fb

                                          SHA512

                                          49d493baceed2ca3facbbc622346538d416867652e9b78b2ed43f455a49adc7b26c72ec97a019de8e4958101eacd508e1ee243450442b4cfa05a53ba7cdd38b3

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\EData.txt

                                          Filesize

                                          192B

                                          MD5

                                          78368284cca9380f28da759acd4946fd

                                          SHA1

                                          c68d41f22714b60380eda0b614f3841932a4f20d

                                          SHA256

                                          f6994c13e157fb5f7542da175e25be244010a9651da09e09161325dc84a73da3

                                          SHA512

                                          caf23f4cda4bf12c927b23c86365134f15c882fa956adbe68adaf96c287a5f9d4b9166fba0a3de3ba8ae138305e96ee21e4d4044fa09d08de39b9d7616db11fe

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt

                                          Filesize

                                          208B

                                          MD5

                                          46cea7860683fd9c48aca6381092c9e4

                                          SHA1

                                          cd7c681ec0acb3a2d25167f94edbbab0cf3c2358

                                          SHA256

                                          c0530c6a9092ebf18c702d7a70324140e8ba5fc82c3cdb8b49b58f6e812552bf

                                          SHA512

                                          e4f956bafe8b0edcb5dcb440268e748c5d75e1aba5338215ffe6acb148e2dfc3107ac5f51570dec62798b1b5d65830c852057235ffad97e15dce68e498d5fca1

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip

                                          Filesize

                                          651B

                                          MD5

                                          e87e4ce20c13988810f5c0f33278b71b

                                          SHA1

                                          09a4080cb3787b4f6607d22f082330e46b7a6402

                                          SHA256

                                          ab8e888ff429203c397548683c4c691b6bf853e4e42ed758591d8e4448d601a9

                                          SHA512

                                          d5afdc372c772b3941d50f2d5da5d82206e64d1d0ef222ec607bba0288fd73b40a5db780cd0a9245d0912dcf7cd2d393fd4220756c9a5bc81b7bb5d3b00395c9

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip

                                          Filesize

                                          225B

                                          MD5

                                          65ff00716ec2d46d77fe0c2779081ff5

                                          SHA1

                                          7a1f72d832ab65a41671d21e4ab35264b81bbaa0

                                          SHA256

                                          63bc3c16a606f303ec4b024f764e39967e593686fbdb585a6672f2f910bb2678

                                          SHA512

                                          6f7c1701523f1edac419774d4c7dcce906ca60187c8515074ee3b12565155648dcce8d6bf2018ebeade8dbce621d2e4832906e8553e9b7316ee95adca6580efd

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Partner.txt

                                          Filesize

                                          48B

                                          MD5

                                          f6429dc81a123a064515b25876989779

                                          SHA1

                                          7352a602abce26967773a9fa17cb5450d9e20da2

                                          SHA256

                                          ab0e5e786f49461b3a8f97bad1ac323b2085e7ea7ff60ceae37fee63f9a0ea38

                                          SHA512

                                          53ca988c16eb248e76967bd8c6ed4f6bc1aed0e2c604a9f18fedda565c7d9294ab45fe9491bc6884ccb034a69b1bc5d2e1b731fe19e4bd470d7218719086270c

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt

                                          Filesize

                                          177B

                                          MD5

                                          b7e7290f6ddc2d0cc50a189f97de6a0c

                                          SHA1

                                          fc5f8c0b89a877f1c893d5283403390be5800630

                                          SHA256

                                          ec6c0b3b45d5435166ce6ecf5a18ff6a6ab4240805b68f9e4d978a9ef773ee82

                                          SHA512

                                          52a8321768512f07c0da62662802ed1a9aae959f17479c45eb5ce6329d98b22d8fa29b81bca971883b38f238bab884e9a134d3c0cda8c71b64544dd9e74cd639

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

                                          Filesize

                                          56B

                                          MD5

                                          36c8b3da6605686c08877af1ba0e2a61

                                          SHA1

                                          cf2986f6e770ec528230ffbe689ce505c596b02e

                                          SHA256

                                          67ed794c734b013f25e414157dfc55d5da499eb7ca28e58b97bde052b03a1a5a

                                          SHA512

                                          94834cd81ac1e2aa0563a3af6b8fb97e1ed8dbc2b266b45552971e99f7429e344b99367b0fafb627fca6e82b5b413bb8a10a47836f1baa3734d295b252be050b

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\WebProtectionConfig.txt

                                          Filesize

                                          308B

                                          MD5

                                          0cb1cc6ebd3113ffa4d08cb8e611b0c1

                                          SHA1

                                          c084178a890875d41c400e8950537e1f8a58a50f

                                          SHA256

                                          b578ec7cfe4cdf6690c83daa66b068fc585a8b35fc3a8722e29f2dc0fabb26e2

                                          SHA512

                                          c86f4c9a16249313e1a4e0561dc6241e931c5d382a830b64e3aa9d1447734716417bc2f08e4860edc0d2945cc5091170b90039194c90985395d33a36662fffec

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db

                                          Filesize

                                          2KB

                                          MD5

                                          82fdeb6b1d1453ae338db9aa5f19d57f

                                          SHA1

                                          99067ef91d64e56f410d9ab10c758b79d0c71c69

                                          SHA256

                                          be938aa4c70311dbc62faca68bf6884e3324e6570608ce1d9ca2c0155776c058

                                          SHA512

                                          c2a2cef52fcf8b501aefd1856ad9481ac951470d72690a322175d08254036260a32021a2cce0753568b43fc0b14b4688c503cdafbccd2f3dac87fe7bb92caf1a

                                        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db

                                          Filesize

                                          2KB

                                          MD5

                                          0ba133079a10fca82e8eb391ebe05cef

                                          SHA1

                                          78073ae6e3e2c33092cd26d63f85993a4ca6be1b

                                          SHA256

                                          83bd76fdbf4cd1bef2376bc0d11f7c73915e4ac4fbff7638ec7c82f0c55fd81a

                                          SHA512

                                          07026f8a2aa88da08c679e1e88c63165b72295ce92397dbb0fb8ef520350b498c1aa2632e02f9df5927147a9ec9c7de683e67f14afc14bafa093d7890804d61d

                                        • memory/3984-45-0x0000000006860000-0x00000000068CE000-memory.dmp

                                          Filesize

                                          440KB

                                        • memory/3984-37-0x00000000056B0000-0x00000000056C2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/3984-32-0x0000000000C60000-0x0000000000CDE000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/3984-46-0x0000000006EC0000-0x0000000006EE0000-memory.dmp

                                          Filesize

                                          128KB

                                        • memory/3984-33-0x0000000073D30000-0x00000000744E0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3984-170-0x00000000056E0000-0x00000000056F0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3984-48-0x00000000073F0000-0x0000000007456000-memory.dmp

                                          Filesize

                                          408KB

                                        • memory/3984-34-0x00000000056E0000-0x00000000056F0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3984-52-0x00000000076D0000-0x00000000076D8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3984-35-0x0000000005DD0000-0x00000000063E8000-memory.dmp

                                          Filesize

                                          6.1MB

                                        • memory/3984-54-0x0000000007940000-0x00000000079D2000-memory.dmp

                                          Filesize

                                          584KB

                                        • memory/3984-153-0x00000000056E0000-0x00000000056F0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3984-148-0x0000000073D30000-0x00000000744E0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3984-63-0x0000000005BC0000-0x0000000005BF4000-memory.dmp

                                          Filesize

                                          208KB

                                        • memory/3984-57-0x0000000009D70000-0x0000000009DA8000-memory.dmp

                                          Filesize

                                          224KB

                                        • memory/3984-58-0x0000000009D40000-0x0000000009D4E000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/3984-38-0x00000000056F0000-0x000000000572C000-memory.dmp

                                          Filesize

                                          240KB

                                        • memory/3984-47-0x0000000006EE0000-0x0000000007234000-memory.dmp

                                          Filesize

                                          3.3MB

                                        • memory/3984-36-0x0000000005660000-0x00000000056B0000-memory.dmp

                                          Filesize

                                          320KB

                                        • memory/3984-53-0x00000000056E0000-0x00000000056F0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3984-39-0x0000000005730000-0x000000000577C000-memory.dmp

                                          Filesize

                                          304KB

                                        • memory/3984-40-0x0000000005970000-0x0000000005A7A000-memory.dmp

                                          Filesize

                                          1.0MB

                                        • memory/3984-56-0x0000000007CC0000-0x0000000007CC8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3984-55-0x0000000007CB0000-0x0000000007CB8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/4584-855-0x0000000008D90000-0x0000000008DE6000-memory.dmp

                                          Filesize

                                          344KB

                                        • memory/4584-892-0x000000000AA70000-0x000000000AA78000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/4584-1039-0x0000000073D30000-0x00000000744E0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/4584-856-0x0000000008FD0000-0x0000000008FE4000-memory.dmp

                                          Filesize

                                          80KB

                                        • memory/4584-1068-0x0000000005F90000-0x0000000005FA0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4584-857-0x0000000005F90000-0x0000000005FA0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4584-1090-0x0000000005F90000-0x0000000005FA0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4584-827-0x00000000661C0000-0x00000000661E2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/4584-1097-0x0000000005F90000-0x0000000005FA0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4584-600-0x0000000073D30000-0x00000000744E0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/4584-601-0x0000000005F90000-0x0000000005FA0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4584-604-0x000000006A580000-0x000000006A592000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4968-422-0x0000000008450000-0x0000000008466000-memory.dmp

                                          Filesize

                                          88KB

                                        • memory/4968-220-0x000000006A580000-0x000000006A592000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4968-165-0x00000000055D0000-0x0000000005620000-memory.dmp

                                          Filesize

                                          320KB

                                        • memory/4968-174-0x0000000005A40000-0x0000000005A60000-memory.dmp

                                          Filesize

                                          128KB

                                        • memory/4968-219-0x00000000068B0000-0x00000000068C2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4968-598-0x00000000661C0000-0x00000000661E2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/4968-208-0x0000000006920000-0x000000000698E000-memory.dmp

                                          Filesize

                                          440KB

                                        • memory/4968-599-0x0000000073D30000-0x00000000744E0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/4968-555-0x0000000008980000-0x00000000089A2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/4968-529-0x00000000661C0000-0x00000000661E2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/4968-470-0x0000000009380000-0x0000000009924000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/4968-434-0x0000000008640000-0x000000000865E000-memory.dmp

                                          Filesize

                                          120KB

                                        • memory/4968-432-0x00000000085C0000-0x0000000008636000-memory.dmp

                                          Filesize

                                          472KB

                                        • memory/4968-169-0x00000000059C0000-0x00000000059F4000-memory.dmp

                                          Filesize

                                          208KB

                                        • memory/4968-188-0x0000000005C60000-0x0000000005CA8000-memory.dmp

                                          Filesize

                                          288KB

                                        • memory/4968-204-0x0000000006230000-0x0000000006256000-memory.dmp

                                          Filesize

                                          152KB

                                        • memory/4968-184-0x0000000005C00000-0x0000000005C08000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/4968-192-0x0000000006090000-0x00000000060B1000-memory.dmp

                                          Filesize

                                          132KB

                                        • memory/4968-381-0x00000000084C0000-0x00000000084F4000-memory.dmp

                                          Filesize

                                          208KB

                                        • memory/4968-161-0x00000000002F0000-0x0000000000DA0000-memory.dmp

                                          Filesize

                                          10.7MB

                                        • memory/4968-286-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4968-178-0x0000000005A90000-0x0000000005AB6000-memory.dmp

                                          Filesize

                                          152KB

                                        • memory/4968-332-0x0000000007380000-0x0000000007408000-memory.dmp

                                          Filesize

                                          544KB

                                        • memory/4968-196-0x00000000061D0000-0x00000000061F2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/4968-160-0x0000000073D30000-0x00000000744E0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/4968-191-0x00000000060D0000-0x000000000610C000-memory.dmp

                                          Filesize

                                          240KB

                                        • memory/4968-338-0x0000000007A80000-0x0000000007AF8000-memory.dmp

                                          Filesize

                                          480KB