Overview

overview

10

Static

static

10

08751be484...2d.dll

windows10-2004-x64

10

0a9f79abd4...51.exe

windows10-2004-x64

3

0di3x.exe

windows10-2004-x64

10

2019-09-02...10.exe

windows10-2004-x64

10

2c01b00772...eb.exe

windows10-2004-x64

7

31.exe

windows10-2004-x64

10

3DMark 11 ...on.exe

windows10-2004-x64

3

42f9729255...61.exe

windows10-2004-x64

10

5da0116af4...18.exe

windows10-2004-x64

10

69c56d12ed...6b.exe

windows10-2004-x64

10

905d572f23...50.exe

windows10-2004-x64

10

948340be97...54.exe

windows10-2004-x64

10

95560f1a46...f9.dll

windows10-2004-x64

3

Archive.zi...3e.exe

windows10-2004-x64

8

DiskIntern...en.exe

windows10-2004-x64

3

ForceOp 2....ce.exe

windows10-2004-x64

7

HYDRA.exe

windows10-2004-x64

10

KLwC6vii.exe

windows10-2004-x64

1

Keygen.exe

windows10-2004-x64

10

Lonelyscre...ox.exe

windows10-2004-x64

3

LtHv0O2KZDK4M637.exe

windows10-2004-x64

10

Magic_File...ja.exe

windows10-2004-x64

3

OnlineInstaller.exe

windows10-2004-x64

8

Remouse.Mi...cg.exe

windows10-2004-x64

3

SecuriteIn...dE.exe

windows10-2004-x64

10

SecuriteIn...ee.dll

windows10-2004-x64

10

SecurityTa...up.exe

windows10-2004-x64

4

Treasure.V...ox.exe

windows10-2004-x64

3

VyprVPN.exe

windows10-2004-x64

10

WSHSetup[1].exe

windows10-2004-x64

3

Yard.dll

windows10-2004-x64

10

b2bd3de3e5...2).exe

windows10-2004-x64

10

Resubmissions

13-11-2024 23:34

241113-3kmbta1eqc 10

13-11-2024 22:28

241113-2dpb6azme1 10

11-11-2024 05:34

241111-f9w6zstjbz 10

11-11-2024 03:05

241111-dlmlja1jbx 10

11-11-2024 03:00

241111-dhk9aszrdz 10

08-11-2024 08:59

241108-kx2cdssjdk 10

08-11-2024 08:55

241108-kvvf3aymdw 10

Analysis

  • max time kernel
    1796s
  • max time network
    1414s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 05:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Archive.zip__ccacaxs2tbz2t6ob3e.exe

  • Size

    430KB

  • MD5

    a3cab1a43ff58b41f61f8ea32319386b

  • SHA1

    94689e1a9e1503f1082b23e6d5984d4587f3b9ec

  • SHA256

    005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6

  • SHA512

    8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d

  • SSDEEP

    6144:vU9Q9tD5WuDQa4t3BMgLkzvCOnYxcEaSAOPou8BWinO8DR:8Q9tD5WyQlBBVAnYxRhr8DR

Score
8/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
    "C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\9059.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\9059.tmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3584
    • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Users\Admin\AppData\Local\Temp\7zS4732D351\WebCompanionInstaller.exe
        .\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=8.9.0.1201 --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4508
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5080
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3180
        • C:\Windows\system32\RunDLL32.Exe
          "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
          4⤵
          • Drops file in Drivers directory
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Windows\system32\runonce.exe
            "C:\Windows\system32\runonce.exe" -r
            5⤵
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:3540
            • C:\Windows\System32\grpconv.exe
              "C:\Windows\System32\grpconv.exe" -o
              6⤵
                PID:3292
          • C:\Windows\system32\net.exe
            "C:\Windows\sysnative\net.exe" start bddci
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2412
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start bddci
              5⤵
                PID:2012
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:968
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" description "DCIService" "Webprotection Bridge service"
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:4760
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3532
              • C:\Windows\SysWOW64\sc.exe
                sc start DCIService
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3488
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2372
              • C:\Windows\SysWOW64\netsh.exe
                netsh http add urlacl url=http://+:9007/ user=Everyone
                5⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2300
            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2112
            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2836
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\znxzs2vy.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4396
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C1C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2C1B.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2740
              • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe
                "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt"
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3316
      • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
        "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3864
      • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
        "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Windows\system32\netsh.exe
            netsh http add urlacl url=http://+:9007/ user=Everyone
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4512
      • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
        C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
        1⤵
          PID:4976

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Modify Registry

        2
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~2\Lavasoft\WEBCOM~1\Service\x64\bddci.sys
          Filesize

          781KB

          MD5

          2a241af18d9f0466aff6cd77c1561f9b

          SHA1

          2c6bfc8e583ed026fdf9ec01265d99e22d39305a

          SHA256

          528804013487cdb1da617e512d1de68060602887bcc8a7822bdb1346a2995ffd

          SHA512

          6779667bb57c87fdbf4dee57682e7851b5ad5bea39deb09fcb596ae48eb571317749ff59e825f91bd57527dab7477deac5b24bdbd86471844fad36876c08dd28

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
          Filesize

          8.8MB

          MD5

          33fe4870dffa70f707f0e8ba8f1ca415

          SHA1

          779189a3501aafcf1801bd392aab0d2730ac81d1

          SHA256

          3f5cc7f3c39e73d8c758e8e39891984de2664de9051fb56f654e72850dc8a50b

          SHA512

          9c6497fb5bb0da0481e6d6a50951a182a7a6a38b35ac31fae28a41c721f510cbbb15b94e9e3d970c882a6ded1d94c64b2e638ee18084662c5bab4c32de0d212d

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config
          Filesize

          18KB

          MD5

          b268ad3c2643d55cc89d460e7f7787f0

          SHA1

          634ca884ef19b4e55eeb9d8dbca74786ad609f23

          SHA256

          977d8ae0a472b9f745651fd22a16130f59c84188f50eb58e977082f187457c2b

          SHA512

          7fba51c95103455db78713bbb7dbaf4324d3937b5525b38b141fc4d3f24d9573b1b28bea2a151c50a752716726365b31ddce8ef42bc46df4e36294c2649d9180

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
          Filesize

          316KB

          MD5

          8803556da0150591f8b326b9ba1be4cb

          SHA1

          62052c002e290630dc3ed63ce390ccdbd9f77c6e

          SHA256

          5ac940cee14650b1d490ac12826034c11ec09d17ba98586c8f83cf029006c835

          SHA512

          1b80f5e2c5e1818dc4b1467016f8e27cd7373b9949cde8e8a0d6bd94f67745c80f1c8ee11e39ec68137445736fe7449eb9dac5bbc8064ec12165d8db1adf5191

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
          Filesize

          3.3MB

          MD5

          3827ca1c0ec114a29bb576bef431f070

          SHA1

          1189dd380f160046de9f5f2f1d74459958f31a4b

          SHA256

          dd45886108aa85350feaa6d9fcc6c922b0874dfa18bbfe23111cc8edcb37fcb1

          SHA512

          480b6a1fc02fdec7fc2316f01b239bce98a6d8152770d329ddc4bfb37e2e00a7987a702900523ccc0380caabbee38a404683dbb20fe9c9b9456083559afb8218

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
          Filesize

          4KB

          MD5

          e8b58a307f96dc9ce1eb2729f86e13b0

          SHA1

          5cee60f070930dc971e4d35d48e30364f623aad2

          SHA256

          2c9a7118ef74c3b168663c8ec6f3a7b27653896e193129ed0bc5e9aa55a0afbb

          SHA512

          7cd9fe7bcc8c8ec1466acc1adc7ab8c9ab6bdaf7c7c27dcc6c0cb43bab741f2519a88647ce43f74d7e9caf4ae39ae172dc639ed1b2027b9e8f15f35353613d91

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core.dll
          Filesize

          1.5MB

          MD5

          13efc649989e224c8346c52ae3cc9a93

          SHA1

          bf907fee6fce0745601219f3faa89bc2c08434b0

          SHA256

          f994e407e9f78d521f335f25b7a4217fdcc4a5e6dc050fdf90d7870fda1e0ef7

          SHA512

          7c6f65858e3803ab9abe075c2e257e322594b875bd6001be5a6c6bde0ab271844ccd7f869394666a2ce9b535abb46e0332697d2c19836f886241881a60697ce0

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dll
          Filesize

          2.6MB

          MD5

          53f6774df73cc44d29f354aecbdef948

          SHA1

          894158c553f39f8000c858c84ad772714e215d75

          SHA256

          d1130318e699b81f1918f468a8b49c9be7b8b4293c1078da4a17dac6ad999ec6

          SHA512

          5151804071c371fe2458c2fc67441441b01602a529582bed48b0e0226e051f933981dce1f84e3ac0f2ebe608b463fe1e9c226d058edd3bf6c5b35be9e8a9e234

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dll
          Filesize

          106KB

          MD5

          74d7799c00c804296c0f1b99324b513f

          SHA1

          527380e0e44c9fd8ca5f73d103e8e9f56eb13142

          SHA256

          66c0b9d01afab9db8f87164c747dc6bdd05ffae25092ab4627a8a47857118ab0

          SHA512

          3140d32d4199cc246fddb292400ec31bcc098e18349d9991828fc1462f7cd6aa3a0666037e569511b37b1cb6baf34c94be2fdc70a9685125a72fdd44e427cdac

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd
          Filesize

          49B

          MD5

          95e8c6cd0a911f1ab4969c06b8cf77a2

          SHA1

          be1b1f8abd0420f59ecab7bcf8120cdc2ce34195

          SHA256

          de795f6d8591577054813bee79e7c5b4ee13360039d29aa73971c6b985d26ebd

          SHA512

          e5eefaf761be7bf3cea207e22e98398093fa0a9d3b459af7df22bfbf07755816737a7b8b261acf01aec8b10b5d8f0d90132a4ecdd83c242b2cde883039fac1ff

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dll
          Filesize

          121KB

          MD5

          b7c081f03a50c391f5b22a0ee16b8a1e

          SHA1

          2fa63728dddb2e25f69adf0e02cbd75d053a9965

          SHA256

          42ccb6c597d0952042c3d3fdc0027634c3e9d118706a286277a32a7f6af6bd30

          SHA512

          8590e537d7df9523f934cd4bb18c7515d89e74fc8b3e8e35ce70b368c9a99659bf59dedb020fb470cf8577248f607ed271d52107015cdffc8a0a9f7e8ac2880b

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\http.dll
          Filesize

          189KB

          MD5

          c0d7a16ba0340ffaeadedb5fd82f6984

          SHA1

          63ac374a7322e4ecb9b8fed7e67ffcf01b71fc75

          SHA256

          e07a6f752e45e3240c95cbb890b22a154b1cca571c17fb57f11ef0b86108a7bb

          SHA512

          3e50f009b7a43d2fb58f28f0eaab4555d9fc68ed72af970f6a6bd875dab30b5ad32300e95ac570ddf0d925499e709457ea8757033580493f4bbae14a20d06c42

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dll
          Filesize

          106KB

          MD5

          f89b978400b6c035f975efc6ab7303a8

          SHA1

          173f9f2bc814b19870c7b98057c948b0292340f9

          SHA256

          ca621b67c0aa1fe669c99abc0ee1a52807321f5be4092bad7c49d4291c194b7c

          SHA512

          d0fc9d302ee3b8be6c65ccb2a2d387a1a914ed9a453ce0cad6734f2c9d59a0ea8694e39b81382ee7b6f6c61b96db81f7ad1c227727b65a5a61c0471a35c39e33

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dll
          Filesize

          576KB

          MD5

          e74caf5d94aa08d046a44ed6ed84a3c5

          SHA1

          ed9f696fa0902a7c16b257da9b22fb605b72b12e

          SHA256

          3dedef76c87db736c005d06a8e0d084204b836af361a6bd2ee4651d9c45675e8

          SHA512

          d3128587bc8d62e4d53f8b5f95eb687bc117a6d5678c08dc6b59b72ea9178a7fd6ae8faa9094d21977c406739d6c38a440134c1c1f6f9a44809e80d162723254

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dll
          Filesize

          108KB

          MD5

          4617113b1fa666e743f899d3781483d8

          SHA1

          0a1dadb7051c5a5ed9d108f78f83ac2b21419a84

          SHA256

          30af0cec58983ef5ccf2b30f074faad6ac348cd5fc88461c0b06977839a2c651

          SHA512

          92d0cd9e51de702a04bc2948e2966219b16c1bef93dadddccf801c58c2da1dd22ac5b9651583868957098959beeca2cfdd7465edece1120e364935ff65184675

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\rpc.dll
          Filesize

          107KB

          MD5

          fd8770a4368acd38c18ccb0298dcf587

          SHA1

          867772d872b84988bd7e9ea2271e470dd443874e

          SHA256

          e039a7e9bdecaf697bd73a47da557e5582fbffacc53f9a185790299156c85584

          SHA512

          e1123fa8cf304d082324cfaa5534ea34103226242cef1d6e1640bd2b343d19ae3bcec2302c3a6167c57f8196415190d86050fb55e2e6ba0d90aef189d5ca18c7

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\sav.dll
          Filesize

          726KB

          MD5

          47b40a1348a6eda7087a6241858ef9e1

          SHA1

          ca8ce0ba789baafc75b593fd8a98d4cf8afa4956

          SHA256

          cd83b1612c2823488ea267e88fe91a2aedf6b278bafdd39ff673bed3add39d6b

          SHA512

          dd43a1a08e0dd9386c0c4aa47c2e1a71a6ccd07dec1d70129c43845c5c32ec038efb617bec35320a467bbac77bad6abefd176c747b2a9113190d3e98d1b50130

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smb.dll
          Filesize

          192KB

          MD5

          b4a0352a49d7661e64693765707a0a1a

          SHA1

          888f7e14cc08ef0ff4f6557bc8ec3a4ac36d18f3

          SHA256

          4295bbc2ce2ccb68b17df07b2364ef90b3bb802fc2f44c710b13c1477f424caa

          SHA512

          8647121a5cfc25fb7ff46308cebe3c261927bac40d2fafe89c01945346993e31ff6b0369e2a686f9f4a16cc61b74c887ed670f30a1a21252e04cd1ba781bb712

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dll
          Filesize

          121KB

          MD5

          2b8265dfa5b53b61e875f7a83dde8680

          SHA1

          fa3c87c02750700ac0d20d21b88a90b8122be8e1

          SHA256

          748bac0cddaa20c4967f6f495db6b58f88fb675790c2039e211e42468afbe2eb

          SHA512

          9011bc9b204db910f7a06f89928986f03df234df39309b183b3fe226677eb0c435f0b8c3efaad9689a5fa44bee034ec99b7af2c6fc3a2056bc0a4c0d4d9d5de2

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ssl.dll
          Filesize

          178KB

          MD5

          9592f5912b31b62193656497e67a2d9b

          SHA1

          b8a92656880a7016edcba43b1e206d83fe3847e0

          SHA256

          5978dd53996bc3856d01010e4ddc41215dc9d7fe046961feabec419972ce94bd

          SHA512

          ffab48be1db5cc30f61d88b3bc02e2ea30c8dcd44bfe9bed786bb7cd699dac8c456c1d390925c9a9ff2994a54cf98eee0e76984eba318792ec9838db1954b98d

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140.dll
          Filesize

          99KB

          MD5

          8697c106593e93c11adc34faa483c4a0

          SHA1

          cd080c51a97aa288ce6394d6c029c06ccb783790

          SHA256

          ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

          SHA512

          724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

          Download Submit

        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140_1.dll
          Filesize

          43KB

          MD5

          21ae0d0cfe9ab13f266ad7cd683296be

          SHA1

          f13878738f2932c56e07aa3c6325e4e19d64ae9f

          SHA256

          7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

          SHA512

          6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

          Download Submit

        • C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
          Filesize

          4KB

          MD5

          c0194d258be2452dd79fefa81c590e38

          SHA1

          aeca24363d00ed389aa40c17c3484c3c2ef2475e

          SHA256

          77bbc97d4bf62cf4bd28c9a3e0a8cb5acd7798ce3733db1294426c5ba19bd7c0

          SHA512

          d2146c9465339e6e9a821133dd3b434aac98ac77283aa9e8084d3849d22e7754b1c373fd9eb1c523ce323a5e1fddcc52be358f1d33369d7e2d8953b630a594cf

          Download Submit

        • C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip.tmp
          Filesize

          17KB

          MD5

          80e1acb2c9fd443f4298bce8af7ccc25

          SHA1

          0caed9af7e3e11395246eb697b35532c6d752013

          SHA256

          8fdb29858290d88f953e7eabbbbf6ef7362a54fc50108e9b148cdadc35ed3ac3

          SHA512

          cb89672e2f7b5a596a9d1eb9df1a405c763e24a65d2c5def0ecf9671c5f22b207a48aa44c7e06179b93ecb564df4ed0f5edd26873e47985d99939bcbe034502d

          Download Submit

        • C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
          Filesize

          188B

          MD5

          9397dc34eae988cce947f46e6b15f6ff

          SHA1

          acecda0ecc9ffc199b2e0e823065479ad923ad4e

          SHA256

          facb47f8db57ac032ab85c77a2318234dccd4d2c1617eed1a699a05da451c9a3

          SHA512

          2f8fab700856848f631527b1cbd28c0538d640e6815fe81464ea15e8965cdf6abfd5315d6be146a7e76579172283d5f13a43b56446fb19a82a0903578b620485

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
          Filesize

          812B

          MD5

          22e2fb11dad84eb8802c3cc94d23f0bf

          SHA1

          dcb1df747c20465c9d839c234ccde8b295dbd3b3

          SHA256

          b1e43a1a701632df73508856cd6d4670c30acee60508f507d2df0a87c8af0961

          SHA512

          28ec41811aa5d3b7f69feb20e5577bd3c177ba4b7a56ead54fff9f11772582aff712cb5841c6d15de497b1272896f3060e49b6714478d39ec01c230ce65aed7f

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
          Filesize

          1KB

          MD5

          c421a12e0c6d7a717e05c9f15508ba29

          SHA1

          3c1e1b5d562633f72c9e331cda6e188296fbc7e9

          SHA256

          584cad896c61fb3327b210dddc523deb7bc09df6cc771515f33eae59ee92d209

          SHA512

          4751166a56fcc099ca6a7d0e7ed34003c0b905a47af4df9bca0e6c293b8e42116f466674779cbd1272b34449ea09fd476af682b9ce893e7cf13311caaac50ced

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_DF48483754A6AE209A217FF51855DB26
          Filesize

          806B

          MD5

          3344aab6768e1dc3fa061666ef7059d3

          SHA1

          5680d34b9820ae80a4973288071b91c8da538560

          SHA256

          0096b33983c79c7bc7c163d1638e4ab38f4497d7b522460e6821ae55c324422d

          SHA512

          0adb29e8ef18a008a09b0453ea150e2181520140fb5f2dbfd9872b4e61cebdd781a7702bfd0cb6fcb6c1afcbf54ec662f59ed726490be5d0b8ac6611c83bd552

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
          Filesize

          540B

          MD5

          c1182ecc0c5db7f298b36a72f41f3737

          SHA1

          5e8d39654964eb829effcf99afdfd62b4d9e489c

          SHA256

          72e57c2ea1d4ddcb14846398f53879588615c4cc81362235e9f1815e59625f2e

          SHA512

          dfd04000ee0d09fc346672ee6f7573bd84ae9efcd3f423dae5a358d81b84f2cb2c27d95989d898a2932a73aa205b3c9f4aa02ba432bc1e60de7115c0cbc3bd24

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
          Filesize

          528B

          MD5

          f884869be1276bc2246a788a5d09cd45

          SHA1

          cf57e3ef0018d21be8677c54365fde833dbaa9f3

          SHA256

          17e0d5e34577486d04e25b3a615f3d4b565ac720fd2959f949a641680a9b8f0d

          SHA512

          3ed367c8fc1df4bc410ef61264e8667c148c565898988361327a28fa7b3b2e22247129a37c6a5bcb7c065ab9fff7762c92b8c74f6842f80acbcc67469be98dba

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_DF48483754A6AE209A217FF51855DB26
          Filesize

          540B

          MD5

          a9aa44a477578f5de5288e1311d61e18

          SHA1

          881bf46ea4858010b4a0b910be11f8c4771158d7

          SHA256

          396e66c4fcac4be91e150f8b3ddc7f0a5d17c7e6ae90fd33e0a66ab4449f8d98

          SHA512

          734013ad8b2da2d0edf8ce2bf624f8840ec5f5ac92595664188c6a6e1218939f8c350d343e7b908c47d70704626d94ccc71069e34f39f9e15224c0d92e1e18f4

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\Search\Logs\search.log
          Filesize

          4KB

          MD5

          4c77582c64e533204367e878562c0246

          SHA1

          87691940c6bf78071d574c15bcb54ed0f99b9b97

          SHA256

          88c970b2c735f11a4a5b250eadbba4874891da0ae59cff0adb15e554d2be5ffd

          SHA512

          fa4d834efe99deb91990d4b7199c577cb28ec48d7f3479650b5580a97174671abd05dbd97a071b61177f5ea84aa07a2ad324c9c27e1d28b4635cd41038d8c509

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\1tjo-60k.newcfg
          Filesize

          4KB

          MD5

          95a8ceae2579d30b6517737da6dd0d8f

          SHA1

          b9acb5fbd5ae02f902ed78e221700a9110f934d4

          SHA256

          d2a0606f4fbd44e21790e3b5f5a7fd98c09dab3706a44074c2468b906f04897d

          SHA512

          a8a03a29eb34386f0ec84f783743d02ea3be320e45e3a227481f8fb7b62dea9072d67c496c8ec33966ef9b0b56091e2f06a17367e606ccc328c86bcfd9456f9b

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\_bp8o8bs.newcfg
          Filesize

          4KB

          MD5

          ddc6a1788e439907708b99ff091a5b20

          SHA1

          ce26329d4389e47a85c7b8be880d9c48120c1edb

          SHA256

          2ac5415922ba13a6e6ec839386e6aac396b58c6af499e3d11129724fa98b74eb

          SHA512

          d9add429c7970a74a5a72676e81e8bdb6a30ea0716bd7f4da06ff3701e90e3d42804caffba441989749f5257ac7e377b677205583c6a155c7e0584a8eb719d39

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\b-iuxr95.newcfg
          Filesize

          1KB

          MD5

          e4308a22084be6f951aa99648cdbe1c2

          SHA1

          dbef8d6b73e101397816c3ade09d4f156987a53b

          SHA256

          f96bacba602816427d078505dea2b0423bd391313950e8b60258471d7372b446

          SHA512

          8d1aa1380a5623d247fea0d8e0178cc1dbb61141c7dc45c095930a420a904efbf7f80f3febb5411cb8a152ee12e5e667f6466cf33de58dcdf89e0199fd959867

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\czobbp20.newcfg
          Filesize

          2KB

          MD5

          f0872e1ce6ba3ab5fc6738a8119bdde6

          SHA1

          0b47ac39f7aa40318eeb94295b6674d0e4871649

          SHA256

          c44fbf5c231c32b63719d924863faaec8154d192d9dc18a4731d78e629c3b069

          SHA512

          8ef5a5a3fcbcdcdd41fc91572ce5e6c71d13e5e2819fa9a267d017244bfdc17647dfad6732d1018b499050c4eeb820d324a8583678a2faa851bd6660554916b4

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\d5fdwscg.newcfg
          Filesize

          3KB

          MD5

          70b86e70f136eeb623a0b5d43ca7c22b

          SHA1

          86656ace7e8467e2842f99f1ce36d71def9974af

          SHA256

          98ba5ab513a6e7fa5d90264cb8c65c374cf43d50833d6c45bf7a5674d24a0f21

          SHA512

          c091a933a6203c54cdb78e7bc35c21265fb426d1110b8075d4a7462525648b822ebabdd5e036c24e0f8c8c42f9149fceaf6df5a4a31bce1ecfdefdbb7a7d6afb

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\e33b27o8.newcfg
          Filesize

          4KB

          MD5

          b946b4ef500cdb8ad4fc73c6855e2974

          SHA1

          e9da4b2e54be611e7e41d33afdf6eb357d85d7b4

          SHA256

          43d9c056484fbe0b972d59265d69f13e1700ad9f871bd9ea3903a4732bc0e974

          SHA512

          2126649cf7dac710535da1104ec5d631dcce782efe00bf758198ad9ec6a90f18e1f528ede8069334684f1350ccde37ee5fcff1d72f180148c86712b926d24381

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\gzv7b0tf.newcfg
          Filesize

          2KB

          MD5

          5f1f83a312233a25faa76719df761f1b

          SHA1

          6c2edd91baf45327c7c7ca93de64b65875599741

          SHA256

          6ddb57ba0d0877949c4f1e647da76152ef51fa5389032e93436dd7f6bf3276a6

          SHA512

          6627fee26885fcb46b86166a07cdac8951ba7d8c60b3db396ef8c523df9dd7f42e63e175231eec752bfe3e4182acd92e919dcf3a9e6a74f96449f0dc84025d29

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\hxktd4qn.newcfg
          Filesize

          2KB

          MD5

          0f52567ff36ee6655a32219f21b54887

          SHA1

          4fb341e09eaf176bc4e2d97f37a9de5d0c30872e

          SHA256

          89deccb3a952f09d39de0a9644cf37fd83afdb4ab97b52d9e0a9935f8a6ed152

          SHA512

          c44616767f441448cb32e40c3ae9c0f7836a726989424fa9d37c0f40af8779d8bb0f035b6763e7280063c3baa500dac59a3edf002195960cb85f53c2c9aa8c48

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\igv0uv_w.newcfg
          Filesize

          4KB

          MD5

          47de0627e95810126611b1469701fbf8

          SHA1

          73d98c484d501805a1053b49f602cd949dd7c37c

          SHA256

          06f56fbbbaa81f30c96b9c40870cf173491188369b78fa24d59270d7cbdcb22f

          SHA512

          fcf04d6b8271ea4b40af607573ca8980fa07f75b635307599a83795449951afec72366b74fcd0d6c900b1300c2dbffecb700511f2a7f9dbc8f99fd2eec53be39

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\lzbz8bbm.newcfg
          Filesize

          2KB

          MD5

          73410a4916dfb2bafd49613586f6980c

          SHA1

          a94cc135085d71bc4dc9467888d141912f7d8f67

          SHA256

          0c85600408e67390b67ae6bf8cc1881f5082728f0e1faf4e08b4fe804dbe96d2

          SHA512

          f457145992ff2115a58a6a5958c14593cf32ac7121a24559eacc5cf093b3b8edbe626ee8ad1ca5d59d3cb6afa2e2560baa32d4ab6f1d58bd1a112f8c4544784d

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\nirs76r7.newcfg
          Filesize

          2KB

          MD5

          6c15347458c318ed60377c88eb2db718

          SHA1

          c1a02db2eadb19e4ff489818037f56626b599a88

          SHA256

          ae3e90cf9a2b00d7510cc83fb4f1d8a4810af13eefe7556240e749e5a849f5da

          SHA512

          df679c8d98da443c756caad864f8499e92591a3a6503f2cb6c97b20c63c9e228692736de12fff1100f5d26fb1076c89897fa235a55926b5c5c402e2a3eadff84

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\nsttb3fx.newcfg
          Filesize

          4KB

          MD5

          04f2f1e06cab4167f07788f50907b403

          SHA1

          cd6c464b1cf8662e6231b0f53a89396ec16b074e

          SHA256

          e5a8d7a3e20570e5465c5f322357b1f0c067f63d9d96a5d04218b22e2b2b6061

          SHA512

          e31c32818b4c631d5adaae255d64ada0772f0d2e7c76a8cc295c563f81eba90bb5fdc85025f319bdf0e794b60cc61a168f51fdf483c83035b0336523ef798020

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\qhza08a0.newcfg
          Filesize

          3KB

          MD5

          2763c8f927811e72156fafd100104954

          SHA1

          c55973e88c34a68a657d7c80603597efb0bd78cb

          SHA256

          4489ee911a3b34302e979b5d6fb16d9d425c3579ac87a0f92dae8f2980f0579f

          SHA512

          9e1ba24ef6d8a2b00f87ca9f2a0d7515b4f3b98b2520527941a89a2d488a710f0225eeeb22f9e2075ed4032c465bb184a666b04c3d12463eaadffe670d0090cd

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\qw6esir1.newcfg
          Filesize

          4KB

          MD5

          6ad3e4306e636e1ac949dcef3558d888

          SHA1

          48a24f1e375981aaf5c46722ba97f1e5f0f840f5

          SHA256

          c287da95b7ba8822bf79702062670472a3ba509f89ef28829f7e48f09c608f70

          SHA512

          6936b62b90b315b34f950da99af0fdb4f0f10a704e3ad53aa63fbbcfdbbc61b4d11f8cf041ee7e20ef22075c5e2c230f0e88ce56f5d0ba2d35ab0d8926e1ee13

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\user.config
          Filesize

          338B

          MD5

          0a35fbae99f45bc0dccdb777ecfd0436

          SHA1

          65e295fde91f90d55b107680e060895654fe66e4

          SHA256

          19af84c48a15820c94367390d58588ddad8164b0ac4056c258a766c726329550

          SHA512

          db3a0973a373c039603c750f0f196cbf65553cddb83739f1942402eaacbe178a775be87c4b034feb706830ae69d20158c3e3ecad8d5d3febc45146b487c3c42c

          Download Submit

        • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\yf5ljhdq.newcfg
          Filesize

          2KB

          MD5

          80a89ec1f3075d1cb69cb30f04efd4cf

          SHA1

          e6e215a133bc1e44467ac62780bc8f6f91b7c516

          SHA256

          6a7f7966443e3a382c8dd2ee14460403281a8ab986181686fcc0e8e19a868dbf

          SHA512

          31595c0aee45b1d41ab897555750944f8a278e2199c33ed40d028a7c34fdd71c95c97e4c82b6434f4a0f443725349c750bdd1f807d7a308986cfdb4525e999f1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\7zS4732D351\ICSharpCode.SharpZipLib.dll
          Filesize

          208KB

          MD5

          94893afa464938ab2169c8be39d971a7

          SHA1

          4926bef17768e8e0e05bbd10d2321e475ab491a7

          SHA256

          a02c4fae529a5b48a28236bf15cd54ed3f7a613210e40970f3cca82f0f68075e

          SHA512

          fa5214c5190e5fe6b347504e8c8817f52ad2549254e985d13d71798e820c6f2ba956585afa0240fb6806a3e74816c869bfac7d9b9564136825abc9a57b4e125f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\7zS4732D351\Newtonsoft.Json.dll
          Filesize

          428KB

          MD5

          3a4649717bdaf9e86dc93cfbcf8a4baa

          SHA1

          d1a1ecd90691fbd768ec9a7f2ebc89340b447e84

          SHA256

          f2d262cd645b7888b88ffa0e799e3e77c982bd2b09e68ad625b218d1435b6f6b

          SHA512

          c40b8f51120fde698fae9907c335e9c7f9d957e073da88c2ea5dbaaa7bf609a44bdedf104092f442f6172dbef3693ee5c1b0ec683b3125f13c95b9e48b10f181

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\7zS4732D351\WebCompanionInstaller.exe
          Filesize

          454KB

          MD5

          36a9001422c3e6532893e9a2f43658eb

          SHA1

          5189fab41f5d43634367bfca2729ad9b6f36ba20

          SHA256

          7f86c7e4a65835f9c12d2425d611902d23b15626960a19d2da03ec511b6a7b9c

          SHA512

          1d60a35e2f64e70b6489a13426f0f5952d3e93e79051fa37a4a5bc8a89614c5614a07de25715670c6618db27b7682c7b4589c356418716a3aae764568bf3371e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\7zS4732D351\WebCompanionInstaller.exe.config
          Filesize

          1KB

          MD5

          025f5c132b47e5a5723d982bd652d5bc

          SHA1

          10460431043d2400166da8f464678d733f2e4f84

          SHA256

          6309de6d3c423af1dc0c47869793c37a108fa32da063d3f5bbb96927f93b4c25

          SHA512

          a72ad7f040acde97aac0f13f502bdfa395864497d1db9c012549377be9201252a59d5b8ce2e3bffb634e75efa6e594e6150ade60e2547760306cba8c568aa090

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\9059.tmp.exe
          Filesize

          149KB

          MD5

          060404f288040959694844afbd102966

          SHA1

          e0525e9ef6713fd7f269a669335ce3ddaab4b6a1

          SHA256

          40517e822f3442a2f389a50e905f40a6a2c4930077c865e3ea7b1929405f760a

          SHA512

          ddf8c53e1e1888084fa5422f297cc3ba9d97f7576c36f6b633ce67ca789127f7e259e9fb374fcbced66f883dadde0717d81ecce9776770bf07d8cf3b94b1a43f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Temp\SearchNewTab.exe
          Filesize

          2KB

          MD5

          9e42c2b5445ec53f8411709979e45e57

          SHA1

          8c4e350e6107055ff5cbf9dc648bbef8c4e05a42

          SHA256

          c82d30963c6fa1c4441fcdec83e8d8bee4b58b335156f7c4a9e7a9b0f74606f8

          SHA512

          467c0361d7f2fd8e02b4ec0f061d92e6afd5f08ae50bab3e6a5c6c30313579819b3415775cc5d16ddfc6b8de02879190ae2a0e27ec03c7a4ccadca7d50a416a6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
          Filesize

          551KB

          MD5

          f6cafe8321409eb7e885ef119cc161ce

          SHA1

          d6f1b4181c2e982fefe32808c6aff556f4e5d2ba

          SHA256

          6d2a2227681cf096a5783131a7a744da178fa103dc41dbdf4cbdd49b9909b60f

          SHA512

          2b9c02ebc8cddc478958ee7bdc3c9e3850940473737096b0940125f2f27acaa0bff405dbb19312a0966129de9351fd4d638b83ce153cf1769e4a6c6f26ba242e

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Lavasoft\Search\ProfileInfo.txt
          Filesize

          78B

          MD5

          eebe781df2eaa270d40e54b04c564fad

          SHA1

          67e21969df98a67ecb88ba49d7827d8294897bcb

          SHA256

          707102387612938339981447fb85b3efc1b100493777362759a92b476361b31b

          SHA512

          ee3cc6bacb40f906305e496662350d554792704705636f0198b8791ab87f32cbc44272a7a0bc55ff24444b7794f222f244fc9c29858196ff4192fa7405e7e158

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Lavasoft\Search\searchenginetemplate.xml
          Filesize

          1KB

          MD5

          b3c45cbea8dd3685f189db517db7992b

          SHA1

          e950121e65a194d735925fd9f8b6619acd735082

          SHA256

          6b391592ade248e6dfbc9711cc78c3e91090999e131c620de3dedb3f83202f75

          SHA512

          a3e2a6903c7a3daaeace184b1e54dad1b3896a62c3d613dac2b9d68bec12d9ed4af852835d1bc1432fddeff3fac1eaf567b2d8d4ea57a0986e647cea30f75b74

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\b_search.json
          Filesize

          676B

          MD5

          92ff3e51f55a2f70720c07f67acd3ca8

          SHA1

          4aaec240b744fa049bd6d2043106e9b5ca138bdd

          SHA256

          607783ec67ab3cc77fc9298011d53f2c1bb6b0882504c0164a167f787599532f

          SHA512

          47117d866fb6932bb0d6bf00e54a6e26517127be5f84fcdb9759372cbf6da2db4e7faf830793c215ecc94f6d080087b7a28663e4a358c9e1659e0986b3b1b93b

          Download Submit

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
          Filesize

          466B

          MD5

          6c60e16d0295362adb3346543c4e6abf

          SHA1

          218763d6cd4de384c46725dba526ac55f293855e

          SHA256

          36ed5a0542175594918a24b3711e5a683dcc4818da329feb6e536b997f99d05c

          SHA512

          1ef4e8db7c60c2302bfa252f5d78b3b62bf478ad6095130ee9e025fc26ccabfa09707dd0eb5abdab4fa2537e9f97976f3830c046b9bdef8fb44577839496110b

          Download Submit

        • memory/1428-351-0x0000000073E00000-0x00000000743B1000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1428-79-0x0000000073E00000-0x00000000743B1000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1428-704-0x0000000073E00000-0x00000000743B1000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1428-183-0x0000000073E02000-0x0000000073E03000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1428-78-0x0000000073E00000-0x00000000743B1000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1428-184-0x0000000073E00000-0x00000000743B1000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1428-76-0x0000000073E02000-0x0000000073E03000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2112-686-0x00000000661C0000-0x00000000661E2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2112-519-0x00000000716F0000-0x0000000071702000-memory.dmp

          Filesize

          72KB

          Download

        • memory/2112-518-0x000000000BD60000-0x000000000BD72000-memory.dmp

          Filesize

          72KB

          Download

        • memory/2836-1029-0x00000000661C0000-0x00000000661E2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2836-888-0x000000000F1D0000-0x000000000F1E2000-memory.dmp

          Filesize

          72KB

          Download

        • memory/2836-889-0x0000000074C00000-0x0000000074C12000-memory.dmp

          Filesize

          72KB

          Download

        • memory/3316-1037-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3316-1035-0x000000001C180000-0x000000001C48E000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/3316-1034-0x000000001C150000-0x000000001C176000-memory.dmp

          Filesize

          152KB

          Download

        • memory/3316-1033-0x000000001BF20000-0x000000001BF32000-memory.dmp

          Filesize

          72KB

          Download

        • memory/3316-1031-0x000000001BE70000-0x000000001BEDE000-memory.dmp

          Filesize

          440KB

          Download

        • memory/3316-1028-0x000000001B8A0000-0x000000001B90C000-memory.dmp

          Filesize

          432KB

          Download

        • memory/4976-831-0x000000001A6B0000-0x000000001A7E6000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/4976-830-0x0000000019FD0000-0x000000001A3A4000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/4992-576-0x000000001DD80000-0x000000001DDFE000-memory.dmp

          Filesize

          504KB

          Download

        • memory/4992-577-0x000000001DE90000-0x000000001DF1E000-memory.dmp

          Filesize

          568KB

          Download

        • memory/4992-553-0x000000001CBD0000-0x000000001CC19000-memory.dmp

          Filesize

          292KB

          Download

        • memory/4992-558-0x000000001D7F0000-0x000000001DCFE000-memory.dmp

          Filesize

          5.1MB

          Download

        • memory/4992-566-0x000000001CE50000-0x000000001CEC0000-memory.dmp

          Filesize

          448KB

          Download

        • memory/4992-557-0x000000001D1F0000-0x000000001D2E0000-memory.dmp

          Filesize

          960KB

          Download

        • memory/4992-548-0x000000001B740000-0x000000001B75E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/4992-549-0x000000001BDD0000-0x000000001BE32000-memory.dmp

          Filesize

          392KB

          Download

        • memory/4992-547-0x000000001B710000-0x000000001B720000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4992-546-0x000000001C610000-0x000000001CBCA000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/4992-540-0x000000001B090000-0x000000001B0E0000-memory.dmp

          Filesize

          320KB

          Download

        • memory/4992-539-0x000000001B030000-0x000000001B038000-memory.dmp

          Filesize

          32KB

          Download

        • memory/4992-538-0x000000001ACC0000-0x000000001ACE0000-memory.dmp

          Filesize

          128KB

          Download