7c4c29521545d8bb875e91b5ebbf342a39d336fbc77f566bc2cfaefc70454777

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
Size

326KB
MD5

68e56acafcb0fe632ef7fc0d9d9a6588
SHA1

99bd546220ff8fadee2335cff747c485c9d5c72e
SHA256

7c4c29521545d8bb875e91b5ebbf342a39d336fbc77f566bc2cfaefc70454777
SHA512

c42f673feab8c17fcacec2f0aa0a6f8bae92e1d984ae4325dfba50e13b4221b2b701a32313fc698a48951bfa51436e193b0daefde7e71d289cdbf0d656901069
SSDEEP

6144:T3VTflVq72ECrYhiH6it/PMyWPC7EHwksThzkHY8AOoAt4qLTz754Z:T3VTdVq72ECrYhiH/t0a+wb9mY8OA7Ty

Score

10^/10

discovery evasion execution persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

Processes:

RunDLL32.Exe

description	ioc	process
File created	C:\Windows\system32\DRIVERS\SETD0F5.tmp	RunDLL32.Exe
File opened for modification	C:\Windows\system32\DRIVERS\bddci.sys	RunDLL32.Exe
File opened for modification	C:\Windows\system32\DRIVERS\SETD0F5.tmp	RunDLL32.Exe

Executes dropped EXE 6 IoCs

Processes:

WCInstaller.exeWebCompanionInstaller.exeDCIService.exeWebCompanion.exeLavasoft.WCAssistant.WinService.exe

pid process

1496 WCInstaller.exe
2416 WebCompanionInstaller.exe
480
2608 DCIService.exe
1412 WebCompanion.exe
2964 Lavasoft.WCAssistant.WinService.exe

pid	process
1496	WCInstaller.exe
2416	WebCompanionInstaller.exe
480
2608	DCIService.exe
1412	WebCompanion.exe
2964	Lavasoft.WCAssistant.WinService.exe

Loads dropped DLL 64 IoCs

Processes:

68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exeWCInstaller.exeWebCompanionInstaller.exeDCIService.exeWebCompanion.exe

pid	process
1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
1496	WCInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2608	DCIService.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe
1412	WebCompanion.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RunDLL32.ExeWebCompanion.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RunDLL32.Exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com

flow	ioc
5	ip-api.com

Drops file in System32 directory 4 IoCs

Processes:

Lavasoft.WCAssistant.WinService.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	Lavasoft.WCAssistant.WinService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	Lavasoft.WCAssistant.WinService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	Lavasoft.WCAssistant.WinService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	Lavasoft.WCAssistant.WinService.exe

Drops file in Program Files directory 64 IoCs

Processes:

WebCompanionInstaller.exe

description	ioc	process
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-file-l2-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_core.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-libraryloader-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebcompaionReimageIcon.ico	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-rtlsupport-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\ftp.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\WebFilteringSimple.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-heap-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\msvcp140_2.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe.config	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-synch-l1-2-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\BDUpdateServiceCom.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.pdb	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-process-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bridge_uninstall.cmd	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\scan.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\smb.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-namedpipe-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-time-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ionic.Zip.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-conio-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.sys	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_reinstall_boot.cmd	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_stop.cmd	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-libraryloader-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-time-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bddci_install_boot.cmd	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bdnc.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-util-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-profile-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-core-memory-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-multibyte-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\7za.exe	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-string-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\BDUpdateServiceCom.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\lsa.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\api-ms-win-crt-string-l1-1-0.dll	WebCompanionInstaller.exe
File created	C:\Program Files (x86)\Lavasoft\Web Companion\Service\Win32\bridge_stop.cmd	WebCompanionInstaller.exe

Drops file in Windows directory 1 IoCs

Processes:

RunDLL32.Exe

description ioc process

File opened for modification C:\Windows\INF\setupapi.app.log RunDLL32.Exe
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2276 sc.exe
1584 sc.exe
1724 sc.exe
2660 sc.exe
2948 sc.exe
2456 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	RunDLL32.Exe

pid	process
2276	sc.exe
1584	sc.exe
1724	sc.exe
2660	sc.exe
2948	sc.exe
2456	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c0736b9aacda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b94b2207af4d514c82a3bc19372a9d1c00000000020000000000106600000001000020000000f5873584031515c8dd4b88c116479f6eb16e1f5694345c06d77ef1463a40df99000000000e8000000002000020000000f7b0731e6e152b0090a5702d41a8549a30653c2ce6fd4352139828c4e62fba2e900000007662c41cf25f2596915ca146ced4aaa0a8022bdf2c0cb036e6cc09325c068da624ba1ce37b44c57fbc38cb1570b2ccc740c878b2344db8ce4e1ca0ca07e6d90912600b7bb9b8bfd8423c6faa646ce290a687cd14cb3a5d500a359f87ba17ca4d55b81463606c5537d6bb4fd0fd226b146ff243b9913e5b8fdc0f2a410651de0f20a61905650fa7880660c5661aba3d7340000000cf70e9f266e269570c638343573965c8bdbb7153a10374ddd73e62aa42523afd5841e03ac2c2429e6ea6c689daf7866b435e5111f082b3232950af840946a487	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{942D6101-188D-11EF-B69B-6AA5205CD920} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b94b2207af4d514c82a3bc19372a9d1c0000000002000000000010660000000100002000000050f1925cf6e868a0f4b9fef0b62a58ef1a20b9d0f5c2908bdb780699e4a53dda000000000e80000000020000200000004dbf9e67a941a668d2e2c60701061f44eff644c281746ffd8c2e11960f88e48320000000b2838b94b8bbc1801536f7d7bb4153492162a975b2ee63f3c56af69253ccaccd400000009bf4891166e557a2e33bd2a696bc5001135e7d78c57af502edf2dad875bb499e375cc399f27f7c8c1cb1a854da6602e8dcadba8f95b2b1c13883a83e4e2e96fa	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE

Modifies data under HKEY_USERS 43 IoCs

Processes:

Lavasoft.WCAssistant.WinService.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	Lavasoft.WCAssistant.WinService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	Lavasoft.WCAssistant.WinService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	Lavasoft.WCAssistant.WinService.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

WebCompanionInstaller.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	WebCompanionInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebCompanionInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	WebCompanionInstaller.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exeWebCompanionInstaller.exe

pid	process
1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe
2416	WebCompanionInstaller.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

480

pid	process
480

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

WebCompanionInstaller.exeRunDLL32.Exe

description	pid	process
Token: SeDebugPrivilege	2416	WebCompanionInstaller.exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe
Token: SeRestorePrivilege	1640	RunDLL32.Exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1736 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1736 IEXPLORE.EXE
1736 IEXPLORE.EXE
1892 IEXPLORE.EXE
1892 IEXPLORE.EXE
1892 IEXPLORE.EXE
1892 IEXPLORE.EXE

pid	process
1736	IEXPLORE.EXE

pid	process
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEWCInstaller.exeWebCompanionInstaller.exeRunDLL32.Exerunonce.exenet.exe

description	pid	process	target process
PID 1988 wrote to memory of 2112	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	iexplore.exe
PID 1988 wrote to memory of 2112	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	iexplore.exe
PID 1988 wrote to memory of 2112	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	iexplore.exe
PID 1988 wrote to memory of 2112	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	iexplore.exe
PID 2112 wrote to memory of 1736	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 1736	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 1736	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 1736	2112	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 1892	1736	IEXPLORE.EXE	IEXPLORE.EXE
PID 1736 wrote to memory of 1892	1736	IEXPLORE.EXE	IEXPLORE.EXE
PID 1736 wrote to memory of 1892	1736	IEXPLORE.EXE	IEXPLORE.EXE
PID 1736 wrote to memory of 1892	1736	IEXPLORE.EXE	IEXPLORE.EXE
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1988 wrote to memory of 1496	1988	68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe	WCInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 1496 wrote to memory of 2416	1496	WCInstaller.exe	WebCompanionInstaller.exe
PID 2416 wrote to memory of 2276	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2276	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2276	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2276	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1584	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1584	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1584	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1584	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1724	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1724	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1724	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1724	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 1640	2416	WebCompanionInstaller.exe	RunDLL32.Exe
PID 2416 wrote to memory of 1640	2416	WebCompanionInstaller.exe	RunDLL32.Exe
PID 2416 wrote to memory of 1640	2416	WebCompanionInstaller.exe	RunDLL32.Exe
PID 2416 wrote to memory of 1640	2416	WebCompanionInstaller.exe	RunDLL32.Exe
PID 1640 wrote to memory of 928	1640	RunDLL32.Exe	runonce.exe
PID 1640 wrote to memory of 928	1640	RunDLL32.Exe	runonce.exe
PID 1640 wrote to memory of 928	1640	RunDLL32.Exe	runonce.exe
PID 928 wrote to memory of 2852	928	runonce.exe	grpconv.exe
PID 928 wrote to memory of 2852	928	runonce.exe	grpconv.exe
PID 928 wrote to memory of 2852	928	runonce.exe	grpconv.exe
PID 2416 wrote to memory of 940	2416	WebCompanionInstaller.exe	net.exe
PID 2416 wrote to memory of 940	2416	WebCompanionInstaller.exe	net.exe
PID 2416 wrote to memory of 940	2416	WebCompanionInstaller.exe	net.exe
PID 2416 wrote to memory of 940	2416	WebCompanionInstaller.exe	net.exe
PID 2416 wrote to memory of 2660	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2660	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2660	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2660	2416	WebCompanionInstaller.exe	sc.exe
PID 940 wrote to memory of 2596	940	net.exe	net1.exe
PID 940 wrote to memory of 2596	940	net.exe	net1.exe
PID 940 wrote to memory of 2596	940	net.exe	net1.exe
PID 2416 wrote to memory of 2948	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2948	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2948	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2948	2416	WebCompanionInstaller.exe	sc.exe
PID 2416 wrote to memory of 2576	2416	WebCompanionInstaller.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68e56acafcb0fe632ef7fc0d9d9a6588_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://hostas.ga/bb/tds.php
2⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://hostas.ga/bb/tds.php
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Users\Admin\AppData\Local\Temp\WCInstaller.exe
C:\Users\Admin\AppData\Local\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\7zS8D5E9AA7\WebCompanionInstaller.exe
.\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=8.9.0.992 --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\sc.exe
"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
4⤵
- Launches sc.exe
PID:2276

C:\Windows\SysWOW64\sc.exe
"sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
4⤵
- Launches sc.exe
PID:1584

C:\Windows\SysWOW64\sc.exe
"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
4⤵
- Launches sc.exe
PID:1724

C:\Windows\system32\RunDLL32.Exe
"C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
5⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
6⤵
PID:2852

C:\Windows\system32\net.exe
"C:\Windows\sysnative\net.exe" start bddci
4⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start bddci
5⤵
PID:2596

C:\Windows\SysWOW64\sc.exe
"sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
4⤵
- Launches sc.exe
PID:2660

C:\Windows\SysWOW64\sc.exe
"sc.exe" description "DCIService" "Webprotection Bridge service"
4⤵
- Launches sc.exe
PID:2948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
4⤵
PID:2576

C:\Windows\SysWOW64\sc.exe
sc start DCIService
5⤵
- Launches sc.exe
PID:2456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
4⤵
PID:1812

C:\Windows\SysWOW64\netsh.exe
netsh http add urlacl url=http://+:9007/ user=Everyone
5⤵
PID:2400

C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1412

C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
"C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608

C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Lavasoft\WEBCOM~1\Service\x64\bddci.sys

Filesize
781KB

MD5
2a241af18d9f0466aff6cd77c1561f9b

SHA1
2c6bfc8e583ed026fdf9ec01265d99e22d39305a

SHA256
528804013487cdb1da617e512d1de68060602887bcc8a7822bdb1346a2995ffd

SHA512
6779667bb57c87fdbf4dee57682e7851b5ad5bea39deb09fcb596ae48eb571317749ff59e825f91bd57527dab7477deac5b24bdbd86471844fad36876c08dd28

Download Submit
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

Filesize
8.8MB

MD5
2c178ebc4ac7466f63236e00d9e77b54

SHA1
6a5152b6c1fa9d5856c0ab2deed4c9912d05d9a6

SHA256
55b1802b3cae0d58ef5d88b3b9a61f6635d8d568dab2bee7f2aed392a91ab0f1

SHA512
ffc647865e75bb5b54b9bad5d218121c38ab8c7abc8b8770a18956a9443766c45820f19c4dc56008792f27951176449c637ca37998310efec44a644509bf4237

Download Submit
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe

Filesize
3.3MB

MD5
3827ca1c0ec114a29bb576bef431f070

SHA1
1189dd380f160046de9f5f2f1d74459958f31a4b

SHA256
dd45886108aa85350feaa6d9fcc6c922b0874dfa18bbfe23111cc8edcb37fcb1

SHA512
480b6a1fc02fdec7fc2316f01b239bce98a6d8152770d329ddc4bfb37e2e00a7987a702900523ccc0380caabbee38a404683dbb20fe9c9b9456083559afb8218

Download Submit
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\VCRUNTIME140_1.dll

Filesize
43KB

MD5
21ae0d0cfe9ab13f266ad7cd683296be

SHA1
f13878738f2932c56e07aa3c6325e4e19d64ae9f

SHA256
7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

SHA512
6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

Download Submit
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf

Filesize
4KB

MD5
e8b58a307f96dc9ce1eb2729f86e13b0

SHA1
5cee60f070930dc971e4d35d48e30364f623aad2

SHA256
2c9a7118ef74c3b168663c8ec6f3a7b27653896e193129ed0bc5e9aa55a0afbb

SHA512
7cd9fe7bcc8c8ec1466acc1adc7ab8c9ab6bdaf7c7c27dcc6c0cb43bab741f2519a88647ce43f74d7e9caf4ae39ae172dc639ed1b2027b9e8f15f35353613d91

Download Submit
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd

Filesize
49B

MD5
95e8c6cd0a911f1ab4969c06b8cf77a2

SHA1
be1b1f8abd0420f59ecab7bcf8120cdc2ce34195

SHA256
de795f6d8591577054813bee79e7c5b4ee13360039d29aa73971c6b985d26ebd

SHA512
e5eefaf761be7bf3cea207e22e98398093fa0a9d3b459af7df22bfbf07755816737a7b8b261acf01aec8b10b5d8f0d90132a4ecdd83c242b2cde883039fac1ff

Download Submit
C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

Filesize
4KB

MD5
baa334816d9fbd508f201666fe2df514

SHA1
38b885c4b8b5a977e27c9df390f64081135db040

SHA256
d7f0da5e0381dd47bfa58d364f5169f86ac57eeacf3d108cd71213230b96fd70

SHA512
f1f512d96d32a4b40964e577b253f9a363636917c4b47e476b1037ff43b2966c9bf840de5d4f7aada8f62248521f390aa5bdd56a303ef795f8f820c02515abb2

Download Submit
C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip

Filesize
17KB

MD5
80e1acb2c9fd443f4298bce8af7ccc25

SHA1
0caed9af7e3e11395246eb697b35532c6d752013

SHA256
8fdb29858290d88f953e7eabbbbf6ef7362a54fc50108e9b148cdadc35ed3ac3

SHA512
cb89672e2f7b5a596a9d1eb9df1a405c763e24a65d2c5def0ecf9671c5f22b207a48aa44c7e06179b93ecb564df4ed0f5edd26873e47985d99939bcbe034502d

Download Submit
C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt

Filesize
188B

MD5
d78c7bc0d14b32d4e27684cdd3a035d0

SHA1
2a77ff55ddf1525a1d85525d5701c3f61cbb9ea5

SHA256
a0d039a0128c23bd81453a7e9b8f6b6b9132e73bb65a49ed7ed04dd42278e272

SHA512
2adfeaa208e96a6317d80526ab05106cf54e32d1d2af802387cc3c10a1ea5230344f12ac6dd52a910382f73f6da57c852235eeded537eb3d232af0f9e7b56d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ee2ab1cb3eda00a537b9a37f726f4628

SHA1
629865c315e1f7861e7c33f345baa3d9387b0ebd

SHA256
aef2b4a71234767f40220113f20b9a0595bf394db9093657c6657a1f924b9080

SHA512
8b99233ec9173c9302615959fc7a56335f4c59c6f1ce23aa0c0f9cae24701a6aef5cb1bd9a0741747c6a475786e4aa5301fe7a491560fde911a3a18934812853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b22c8e4413b55498c9775b81f68575ad

SHA1
8d1c2b0011fbab71b321597e7ae92d86f144cfd4

SHA256
1d592f52f476f0a9cfd14a27ad21cb34bf596f0223d2ef2cf5c6ca09375b73de

SHA512
37674bae3e63d4e9f31b56631305b37559ebe7939d124c151a70145ed65ab857a64a20ed9191e8d660ed0779df30d256aa87dfd8ce3c33fe60860663add74288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
879628d1fff7cc3edfc4a0eb4201971e

SHA1
09fb30c44e683b60a7b35f41c4dcd72d68d8c18d

SHA256
9e698f344bf2979016e4dafa42d6991403eaf97cf46e03051680d1485e62cc03

SHA512
0f26a515837765015c6ebddee5a390e9e8c70599fde0a60bf367855383cde825389fc4af5ce38525331066515a6264faf0535d657c5265b94ca5b94c56e54075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1bf9d9d89665128cf6b03b200edecf5

SHA1
ddd3a70e3788b7db59ca84446cc278bdaad2dca6

SHA256
ca6ac916f51c3ef33df9da95d09c815ae5e9ce63be3a908924c3a0cde7d49178

SHA512
ac8f632e619c285898a235343106acf68b27ec59b02597fdd3a9ca346a31be624391c68bb8895707801d7d4580d83795f7233539724d4ef084ad876bc1acb50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90d392275852549fa5e806138276f640

SHA1
56d9623d171dc1a499791045dbd49b81727f491c

SHA256
f5421e64b934a90b3e1d62c1201537c856c2a4749b7174945b642a80f5e8eeec

SHA512
cd030485f5e967d80c3d60c77150b9bd24e5dd18ce245548844138677d1a49aad973d67548be026955795267220bf78b9478256e22ffe8b72bf5344bc54a30ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d086a32eb2f338773c3cc1618d4683cc

SHA1
8ee25a68dd6f4fa1f5793bb163d98a3570019fd6

SHA256
93e06f24162b25f87cd85f6edc212210915f6b0316a8b8d020c02e541ff223f7

SHA512
ff0c45cf00fecde29f4d19aa7f81e12d164c80e47ff965bc85def408bbe8d68809825d4036d68dbaa53a738ee7d1be63d15903e6fa0e0e23a66500a3b39a9cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220fa3cb5005ea618b790965ca051eea

SHA1
d0419fb4a53713c2ea4e275b1da8b0be71061fa4

SHA256
7075179d8a2b106f93b77c17d16633620b317cf9b0b32756f5de96c2638a0cc3

SHA512
b9f298c6c9cf7e6832bd4aeb830b1c0dedc0e04e0cb1899c609bcfeabedf4450d4cc120534bb462a00871a6420509d134dd0e3691ece0942200f39bb852de076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5c7a47730cb38b11e44a7c9a2a84fc5

SHA1
a208be4c4ba891e3745bdd23e6d62a34a4dd46ee

SHA256
b8d4a0e8e892003ea9f11ea83b4e7f37df81dc250ea5f08038bea6a6fe4d510d

SHA512
34fa1b8f6a1755b19146fd73e9b74bc124c34105aef0860e69aa6cf29ade90ee0019680b16e814a8349cf9f34616e58f0c4ab916405680f974ada331000e1a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40b5b9b7c2ee71da4328de538daf9677

SHA1
38186df3bdfe701c2b52113dc223fbd4d7a08f5a

SHA256
855f6a69363ddb5650c765d4e3a248462385d9aa2fc189e715ac842a296e8840

SHA512
c0ff1011073f54ae8b0c81ec8fa678438c8b49efbb2b7dd36b911fec215098d6af01133907c9436df59aa969b3c4622d77e8a3f94e242edac16bfc07dd964dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c5adaf9c0f0618fe80ab3ffe35ea7c

SHA1
0a5df65a5db4c40f4c9b87fe154b4b3b9e32fbd6

SHA256
f3bd2da19016f4b08214a999ddcdac2376351cf07f51437d57c2bcd3ecd57b0a

SHA512
8988c2f0abd98574be9399033a16a1f2ba7292c454986fa5cc794c4cb8109865cbbdea92d48d8cda80b17f5bf0810844a48d9eb7fb2eb5d73827e5cb5eaa0fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
247a8858b457d5a013ddeef9c87a8c10

SHA1
17d7bfd3b73cb171d2c687b8f1a8a8208d9d367d

SHA256
f8ce87144677f95da45dfcc77c604f522eb484746c009084fe02add2adabf264

SHA512
0ab0b52c0df715cbac241919fd34a8a3951bd7d9d4dd544ff7af27f2ebcd74a8249f312f39623662a84aa2f65852137932fd89e408191fe249bd262c658620cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
550831622917cf20855fd9aa3b3919fc

SHA1
f5c807753a4e7adaca65b2c1cb02ea166b0f2fff

SHA256
e32ac74112ed3a177439dd8f62d7deda8fa0037806efef0974b585053cccab9b

SHA512
8c3cc242c619436c2ab4267b334647c91a39a341170fa4d82b8f88da5b0f2bb59dae72a6d1825e8e98b7a89aef18ac0132618bc44b3b8760354ed571ab6b3b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.992\5aklibf1.newcfg

Filesize
2KB

MD5
0f52567ff36ee6655a32219f21b54887

SHA1
4fb341e09eaf176bc4e2d97f37a9de5d0c30872e

SHA256
89deccb3a952f09d39de0a9644cf37fd83afdb4ab97b52d9e0a9935f8a6ed152

SHA512
c44616767f441448cb32e40c3ae9c0f7836a726989424fa9d37c0f40af8779d8bb0f035b6763e7280063c3baa500dac59a3edf002195960cb85f53c2c9aa8c48

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.992\7y7qss1e.newcfg

Filesize
1KB

MD5
e4308a22084be6f951aa99648cdbe1c2

SHA1
dbef8d6b73e101397816c3ade09d4f156987a53b

SHA256
f96bacba602816427d078505dea2b0423bd391313950e8b60258471d7372b446

SHA512
8d1aa1380a5623d247fea0d8e0178cc1dbb61141c7dc45c095930a420a904efbf7f80f3febb5411cb8a152ee12e5e667f6466cf33de58dcdf89e0199fd959867

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.992\user.config

Filesize
338B

MD5
0a35fbae99f45bc0dccdb777ecfd0436

SHA1
65e295fde91f90d55b107680e060895654fe66e4

SHA256
19af84c48a15820c94367390d58588ddad8164b0ac4056c258a766c726329550

SHA512
db3a0973a373c039603c750f0f196cbf65553cddb83739f1942402eaacbe178a775be87c4b034feb706830ae69d20158c3e3ecad8d5d3febc45146b487c3c42c

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.992\user.config

Filesize
2KB

MD5
ef12bea72f5f2b272fe26b197b3ca184

SHA1
7126b27288d8e5108fb15111b779b5eb8f77e902

SHA256
692e2d91afcd905969c5aa8fcbbb96b662207df6d1b78a595556bd3012533d39

SHA512
b9be043de3eed4e836c31405818a7c13de1da341907f809d809f2c0d093bc6c0a17964ba2e0d9df1faf2708f2f91915a73787c6221c7e829b037d3ada08051e9

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.992\user.config

Filesize
2KB

MD5
11f06d0ad6ffd5bba69c33dd652f1bf4

SHA1
16955cf7eff60e17006f1dc334524674952a1484

SHA256
3ca9011a3a97508dc4d1bffa39f237dd4d145d49018d589e8810f7315b1cdb36

SHA512
75d0027a8c19e9e947965a5749f99f4586ec07245c2642cff233aee6c5bcbf599be1604cefd9edb0a559796f55ad510bc564d60b8c1446bd2317d1a50ddcb7d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D5E9AA7\Newtonsoft.Json.dll

Filesize
428KB

MD5
eb259a0e2377f4c0bfb8712b773456fe

SHA1
d9123b055df58e33aa2ab2f242b30fc6a37f1cad

SHA256
4f9d1e187920dadd4e7693897f8240621e498ffd1709915c3b8394aaa1a34b43

SHA512
1f6e7c2233307a90dda68eaaa4ac08848b0499b464d3a307390a4b95ec1751d00b923572f92588b55f049ae6f4282d4126d2425e5caf8a95c8260f7600dc574a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D5E9AA7\WebCompanionInstaller.exe.config

Filesize
2KB

MD5
8faad08d58b1207cff53b7dc1a35af91

SHA1
e74f806a6cfea16c2e5c6c90ff6a66111b61cea8

SHA256
091d2aae6d9f4a9b403e45ebc578e0cf27a08d16e9b8784e614c8710080f2cca

SHA512
dc0cfe69c6a3f715875f1badbf44eb90aeb97ebb5fc7b9f3dd4b4f4561de4c403b086709730f4f11de0815828f212591bf63b0fc591e8445ba7a320c574ea2ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA79A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WCInstaller.exe

Filesize
552KB

MD5
bc4c25ffc19286961d5cc54dd79a6d2d

SHA1
d1ca4a578a51946d38b0ceaf63a3a75c4b8fff5a

SHA256
409960971e9e9e31121d10d5033f27ec07ac228e52c32873292f2ee8567a8eaa

SHA512
0c4fc53d6d5fe5fa478f436616022a3c509d70a2d99714badfb945d88c6da9e005961b2d3409a124abdf5b5858001a0e385c58169c822f3b0d4cbd70327044a1

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf39a354bc9fa9fbd7a2c37069f17969

SHA1
523f9b126e9b267d06cf4ddc9d4f367139cfaae9

SHA256
7955e16fd4d80b5d77d6e5b92b67a59e47ebbbacb4984207714d4e36ea5eb914

SHA512
f324497da6491ad4b0c8f001a5d63fe5840cd6744d2f00ec4c7bd6759d16eb31ca63f4b62d7d382fa09b23069a54fe8f50ca51aa9932adfc7e452825218fa5c8

Download Submit
C:\Windows\Temp\Cab513E.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
7041205ea1a1d9ba68c70333086e6b48

SHA1
5034155f7ec4f91e882eae61fd3481b5a1c62eb0

SHA256
eff4703a71c42bec1166e540aea9eeaf3dc7dfcc453fedcb79c0f3b80807869d

SHA512
aea052076059a8b4230b73936ef8864eb4bb06a8534e34fe9d03cc92102dd01b0635bfce58f4e8c073f47abfd95fb19b6fbfcdaf3bc058a188665ac8d5633eb1

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
8fd05f79565c563a50f23b960f4d77a6

SHA1
98e5e665ef4a3dd6f149733b180c970c60932538

SHA256
3eb57cda91752a2338ee6b83b5e31347be08831d76e7010892bfd97d6ace9b73

SHA512
587a39aecb40eff8e4c58149477ebaeb16db8028d8f7bea9114d34e22cd4074718490a4e3721385995a2b477fe33894a044058880414c9a668657b90b76d464f

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
769bf2930e7b0ce2e3fb2cbc6630ba2e

SHA1
b9df24d2d37ca8b52ca7eb5c6de414cb3159488a

SHA256
d10ff3164acd8784fe8cc75f5b12f32ce85b12261adb22b8a08e9704b1e5991a

SHA512
9abdcccc8ee21b35f305a91ea001c0b8964d8475680fa95b4afbdc2d42797df543b95fc1bcd72d3d2ccc1d26dff5b3c4e91f1e66753626837602dbf73fc8369b

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
6486e2f519a80511ac3de235487bee79

SHA1
b43fd61e62d98eea74cf8eb54ca16c8f8e10c906

SHA256
24cc30d7a3e679989e173ddc0a9e185d6539913af589ee6683c03bf3de485667

SHA512
02331c5b15d9ee5a86a7aaf93d07f9050c9254b0cd5969d51eff329e97e29eea0cb5f2dccfe2bfa30e0e9fc4b222b89719f40a46bd762e3ff0479dbac704792c

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
a639c64c03544491cd196f1ba08ae6e0

SHA1
3ee08712c85aab71cfbdb43dbef06833daa36ab2

SHA256
a4e57620f941947a570b5559ca5cce2f79e25e046fcb6519e777f32737e5fd60

SHA512
c940d1f4e41067e6d24c96687a22be1cb5ffd6b2b8959d9667ba8db91e64d777d4cd274d5877380d4cfef13f6486b4f0867af02110f96c040686cc0242d5234b

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
6f9f9d52087ae4d8d180954b9d42778b

SHA1
67419967a40cc82a0ca4151589677de8226f9693

SHA256
ef1d71fe621341c9751ee59e50cbec1d22947622ffaf8fb1f034c693f1091ef0

SHA512
22a0488613377746c13db9742f2e517f9e31bd563352cc394c3ae12809a22aa1961711e3c0648520e2e11f94411b82d3bb05c7ea1f4d1887aacf85045cf119d7

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
ebac9545734cc1bec37c1c32ffaff7d8

SHA1
2b716ce57f0af28d1223f4794cc8696d49ae2f29

SHA256
d09b49f2a30dcc13b7f0de8242fa57d0bdeb22f3b7e6c224be73bc4dd98d3c26

SHA512
0396ea24a6744d48ce18f9ccb270880f74c4b6eab40f8f8baf5fd9b4ad2ac79b830f9b33c13a3fec0206a95ad3824395db6b1825302d1d401d26bdc9eef003b2

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
c7c4a49c6ee6b1272ade4f06db2fa880

SHA1
b4b5490a51829653cb2e9e3f6fbe9caf3ba5561e

SHA256
37f731e7b1538467288bf1d0e586405b20808d4bad05e47225673661bc8b4a9f

SHA512
62ccdfac19ef4e3d378122146e8b2cba0e1db2cc050b49522bedbf763127cc2103a56c5a266e161a51d5be6bd9a47222ee8bb344b383f13d0aac0baa41eab0ff

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
bef17bf1ba00150163a2e1699ff5840a

SHA1
89145a894b17427f4cb2b4e7e814c92457fd2a75

SHA256
48c71b2d0af6807f387d97ab22a3ba77b85bdf457f8a4f03ce79d13fbb891328

SHA512
489d1b4d405edbb5f46b087a3ebf57a344bf65478b3cd5fcf273736ea6fdd33e54b1806fbb751849e160370df8354f39fc7ca7896a05b4660ad577a9e0e683e4

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
fbfcf220f1bf1051e82a40f349d4beae

SHA1
43154ea6705ab1c34207b66a0a544ac211c1f37d

SHA256
9b9a43b9a32a3d3c3de72b2acca41e051b1e604b45be84985b6a62fb03355e6d

SHA512
e9ab17ceb5449e8303027a08afdbdd118cb59eaea0d5173819d66d3ee01f0cd370d7230a7d609a226b186b151fe2b13e811339fa21f3ec45f843075cedc2a5c0

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
2c8e5e31e996e2c0664f4a945cece991

SHA1
8522c378bdd189ce03a89199dd73ed0834b2fa95

SHA256
1c556505a926fd5f713004e88d7f8d68177d7d40a406f6ed04af7bacd2264979

SHA512
14b92e32fb0fd9c50aa311f02763cba50692149283d625a78b0549b811d221331cf1b1f46d42869500622d128c627188691d7de04c500f501acd720cea7c8050

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
77c5cc86b89eed37610b80f24e88dcc2

SHA1
d2142ecce3432b545fedc8005cc1bf08065c3119

SHA256
3e8828ab7327f26da0687f683944ffc551440a3de1004cc512f04a2f498520f6

SHA512
81de6533bba83f01fed3f7beed1d329b05772b7a13ffe395414299c62e3e6d43173762cb0b326ea7ecf0e61125901fcee7047e7a7895b750de3d714c3fe0cc67

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
a3f630a32d715214d6c46f7c87761213

SHA1
1078c77010065c933a7394d10da93bfb81be2a95

SHA256
d16db68b4020287bb6ce701b71312a9d887874c0d26b9ebd82c3c9b965029562

SHA512
920bb08310eadd7832011ac80edd3e12ce68e54e510949dbbde90adaac497debe050e2b73b9b22d9dc105386c45d558c3f9e37e1c51ed4700dd82b00e80410bc

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
c99c9eea4f83a985daf48eed9f79531b

SHA1
56486407c84beecadb88858d69300035e693d9a6

SHA256
7c416d52a7e8d6113ff85bf833cae3e11c45d1c2215b061a5bbd47432b2244a5

SHA512
78b8fd1faada381b7c4b7b6721454a19969011c1d1105fc02ba8246b477440b83dc16f0e0ce0b953a946da9d1971b65315ac29dbb6df237a11becb3d981b16b9

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
d3d72d7f4c048d46d81a34e4186600b4

SHA1
cdcad0a3df99f9aee0f49c549758ee386a3d915f

SHA256
fd8a73640a158857dd76173c5d97ceeba190e3c3eabf39446936b24032b54116

SHA512
6bf9d2fdc5c2d8cd08bf543ef7a0cdcb69d7658a12bee5601eeb9381b11d78d3c42ef9dd7e132e37d1ec34cc3dc66df0f50aefadfdc927904b520fdc2f994f18

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
a992f1e06c3c32ffe9799d4750af070a

SHA1
97ffd536d048720010133c3d79b6deed7fc82e58

SHA256
b401edaac4b41da73356de9b3358dc21f8b998a63413c868510dc734b1e4022f

SHA512
50bd08680fccff190454e6555e65e2787bdc0e8a9bf711e364eb0b065951c2430559e049202b8f330ac65e9d4cd588349c524a71f700e179859d7829d8e840b8

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dll

Filesize
576KB

MD5
e74caf5d94aa08d046a44ed6ed84a3c5

SHA1
ed9f696fa0902a7c16b257da9b22fb605b72b12e

SHA256
3dedef76c87db736c005d06a8e0d084204b836af361a6bd2ee4651d9c45675e8

SHA512
d3128587bc8d62e4d53f8b5f95eb687bc117a6d5678c08dc6b59b72ea9178a7fd6ae8faa9094d21977c406739d6c38a440134c1c1f6f9a44809e80d162723254

Download Submit
\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ucrtbase.dll

Filesize
938KB

MD5
d4b22fb86c88c071335fe2fb623e40ce

SHA1
cc722eb1098b3a630a990dbceb62e3338b064110

SHA256
2195fef9bd0a01d6b10a2ab77ff4f5bbca01d65d5f6590befc98d80102372605

SHA512
369fb5d80535cb1f8d46512234d7777754648aeab6a3ff1536edc64ca0097a8e8eaa7c68feeabf756de474706f0c7c896b14c4c39cbd5916ad9258f2ed3fcdf1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8D5E9AA7\ICSharpCode.SharpZipLib.dll

Filesize
208KB

MD5
b4ecb8001f71894c1a17860476981441

SHA1
72d28f2aa50082a152cb6b3e25895855188fe9b8

SHA256
e6133baa62122e214ab9c114e9fff73bf25956518907a88577a85c8fb88c561f

SHA512
930e1b8181048790fffc1a5bd7f9dde91eeb757f1f8f35e01373f9414794963a53c03239b4ccc60b5c38049aba9e4db0ef5c166e278751c15c136a331ae495b0

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8D5E9AA7\WebCompanionInstaller.exe

Filesize
456KB

MD5
994672c2aa0d63930a0d8614bafeac09

SHA1
94dc5848fd00f05589707fece3f60b8840aed26a

SHA256
c5a088842a698f1938c22f6314a141251282e32f263d99a6854c2d58fdee9272

SHA512
47a0d7bf14b46cddc90cc1dab0add345e40621fcd11d97786b3947a04bf9acf1cd4cc304562a51c1f83b7b8422302bdf7f8dd23dd949ee6847850f5e911d6e4e

Download Submit
memory/1412-2375-0x0000000008990000-0x00000000089A2000-memory.dmp

Filesize
72KB

Download
memory/1412-2376-0x0000000069D80000-0x0000000069D92000-memory.dmp

Filesize
72KB

Download
memory/2416-1213-0x0000000071200000-0x00000000717AB000-memory.dmp

Filesize
5.7MB

Download
memory/2416-46-0x0000000071200000-0x00000000717AB000-memory.dmp

Filesize
5.7MB

Download
memory/2416-44-0x0000000071201000-0x0000000071202000-memory.dmp

Filesize
4KB

Download
memory/2964-2580-0x0000000000C20000-0x0000000000C28000-memory.dmp

Filesize
32KB

Download
memory/2964-2677-0x0000000000C60000-0x0000000000CB0000-memory.dmp

Filesize
320KB

Download
memory/2964-2781-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Filesize
64KB

Download