Overview

overview

10

Static

static

10

08751be484...2d.dll

windows10-2004-x64

10

08751be484...2d.dll

windows11-21h2-x64

10

0a9f79abd4...51.exe

windows10-2004-x64

3

0a9f79abd4...51.exe

windows11-21h2-x64

3

0di3x.exe

windows10-2004-x64

10

0di3x.exe

windows11-21h2-x64

10

2019-09-02...10.exe

windows10-2004-x64

10

2019-09-02...10.exe

windows11-21h2-x64

10

2c01b00772...eb.exe

windows10-2004-x64

10

2c01b00772...eb.exe

windows11-21h2-x64

10

31.exe

windows10-2004-x64

10

31.exe

windows11-21h2-x64

10

3DMark 11 ...on.exe

windows10-2004-x64

3

3DMark 11 ...on.exe

windows11-21h2-x64

3

42f9729255...61.exe

windows10-2004-x64

10

42f9729255...61.exe

windows11-21h2-x64

10

5da0116af4...18.exe

windows10-2004-x64

10

5da0116af4...18.exe

windows11-21h2-x64

5

69c56d12ed...6b.exe

windows10-2004-x64

10

69c56d12ed...6b.exe

windows11-21h2-x64

10

905d572f23...50.exe

windows10-2004-x64

10

905d572f23...50.exe

windows11-21h2-x64

10

948340be97...54.exe

windows10-2004-x64

10

948340be97...54.exe

windows11-21h2-x64

10

95560f1a46...f9.dll

windows10-2004-x64

5

95560f1a46...f9.dll

windows11-21h2-x64

3

Archive.zi...3e.exe

windows10-2004-x64

8

Archive.zi...3e.exe

windows11-21h2-x64

8

DiskIntern...en.exe

windows10-2004-x64

3

DiskIntern...en.exe

windows11-21h2-x64

3

ForceOp 2....ce.exe

windows10-2004-x64

7

ForceOp 2....ce.exe

windows11-21h2-x64

7

Resubmissions

16/04/2025, 11:04

250416-m58gsaz1ay 10

15/04/2025, 17:34

250415-v5ylksypw9 10

15/04/2025, 06:16

250415-g1p7ras1dw 10

14/04/2025, 08:06

250414-jzpwpstxhx 10

14/04/2025, 07:59

250414-jvg1assky4 10

14/04/2025, 07:22

250414-h7g1dss1h1 10

14/04/2025, 07:16

250414-h3xv2s1nv6 10

11/04/2025, 21:39

250411-1h113szzaz 10

Analysis

  • max time kernel
    896s
  • max time network
    824s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2025, 17:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Archive.zip__ccacaxs2tbz2t6ob3e.exe

  • Size

    430KB

  • MD5

    a3cab1a43ff58b41f61f8ea32319386b

  • SHA1

    94689e1a9e1503f1082b23e6d5984d4587f3b9ec

  • SHA256

    005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6

  • SHA512

    8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d

  • SSDEEP

    6144:vU9Q9tD5WuDQa4t3BMgLkzvCOnYxcEaSAOPou8BWinO8DR:8Q9tD5WyQlBBVAnYxRhr8DR

Score
8/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 2 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
    "C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\B536.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\B536.tmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5092
    • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Users\Admin\AppData\Local\Temp\7zSC2068F1D\WebCompanionInstaller.exe
        .\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=8.9.0.1201 --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1488
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5340
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1528
        • C:\Windows\system32\RunDLL32.Exe
          "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
          4⤵
          • Drops file in Drivers directory
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:5696
          • C:\Windows\system32\runonce.exe
            "C:\Windows\system32\runonce.exe" -r
            5⤵
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:6136
            • C:\Windows\System32\grpconv.exe
              "C:\Windows\System32\grpconv.exe" -o
              6⤵
                PID:4276
          • C:\Windows\system32\net.exe
            "C:\Windows\sysnative\net.exe" start bddci
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5660
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start bddci
              5⤵
                PID:404
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3232
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" description "DCIService" "Webprotection Bridge service"
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:5084
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1792
              • C:\Windows\SysWOW64\sc.exe
                sc start DCIService
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4628
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2608
              • C:\Windows\SysWOW64\netsh.exe
                netsh http add urlacl url=http://+:9007/ user=Everyone
                5⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:6000
            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5848
            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall
              4⤵
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3000
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yu8w1ljd.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2920
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6FF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB6FE.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2520
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c grpconv -o
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\system32\grpconv.exe
          grpconv -o
          2⤵
            PID:5556
        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
          "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2300
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
          1⤵
            PID:2248
          • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
            "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1044
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1952
              • C:\Windows\system32\netsh.exe
                netsh http add urlacl url=http://+:9007/ user=Everyone
                3⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:4852
          • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
            C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
            1⤵
              PID:1748

            Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            3
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\PROGRA~2\Lavasoft\WEBCOM~1\Service\x64\bddci.sys
              Filesize

              781KB

              MD5

              2a241af18d9f0466aff6cd77c1561f9b

              SHA1

              2c6bfc8e583ed026fdf9ec01265d99e22d39305a

              SHA256

              528804013487cdb1da617e512d1de68060602887bcc8a7822bdb1346a2995ffd

              SHA512

              6779667bb57c87fdbf4dee57682e7851b5ad5bea39deb09fcb596ae48eb571317749ff59e825f91bd57527dab7477deac5b24bdbd86471844fad36876c08dd28

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              Filesize

              8.8MB

              MD5

              33fe4870dffa70f707f0e8ba8f1ca415

              SHA1

              779189a3501aafcf1801bd392aab0d2730ac81d1

              SHA256

              3f5cc7f3c39e73d8c758e8e39891984de2664de9051fb56f654e72850dc8a50b

              SHA512

              9c6497fb5bb0da0481e6d6a50951a182a7a6a38b35ac31fae28a41c721f510cbbb15b94e9e3d970c882a6ded1d94c64b2e638ee18084662c5bab4c32de0d212d

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config
              Filesize

              18KB

              MD5

              b268ad3c2643d55cc89d460e7f7787f0

              SHA1

              634ca884ef19b4e55eeb9d8dbca74786ad609f23

              SHA256

              977d8ae0a472b9f745651fd22a16130f59c84188f50eb58e977082f187457c2b

              SHA512

              7fba51c95103455db78713bbb7dbaf4324d3937b5525b38b141fc4d3f24d9573b1b28bea2a151c50a752716726365b31ddce8ef42bc46df4e36294c2649d9180

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
              Filesize

              316KB

              MD5

              8803556da0150591f8b326b9ba1be4cb

              SHA1

              62052c002e290630dc3ed63ce390ccdbd9f77c6e

              SHA256

              5ac940cee14650b1d490ac12826034c11ec09d17ba98586c8f83cf029006c835

              SHA512

              1b80f5e2c5e1818dc4b1467016f8e27cd7373b9949cde8e8a0d6bd94f67745c80f1c8ee11e39ec68137445736fe7449eb9dac5bbc8064ec12165d8db1adf5191

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
              Filesize

              3.3MB

              MD5

              3827ca1c0ec114a29bb576bef431f070

              SHA1

              1189dd380f160046de9f5f2f1d74459958f31a4b

              SHA256

              dd45886108aa85350feaa6d9fcc6c922b0874dfa18bbfe23111cc8edcb37fcb1

              SHA512

              480b6a1fc02fdec7fc2316f01b239bce98a6d8152770d329ddc4bfb37e2e00a7987a702900523ccc0380caabbee38a404683dbb20fe9c9b9456083559afb8218

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
              Filesize

              4KB

              MD5

              e8b58a307f96dc9ce1eb2729f86e13b0

              SHA1

              5cee60f070930dc971e4d35d48e30364f623aad2

              SHA256

              2c9a7118ef74c3b168663c8ec6f3a7b27653896e193129ed0bc5e9aa55a0afbb

              SHA512

              7cd9fe7bcc8c8ec1466acc1adc7ab8c9ab6bdaf7c7c27dcc6c0cb43bab741f2519a88647ce43f74d7e9caf4ae39ae172dc639ed1b2027b9e8f15f35353613d91

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core.dll
              Filesize

              1.5MB

              MD5

              13efc649989e224c8346c52ae3cc9a93

              SHA1

              bf907fee6fce0745601219f3faa89bc2c08434b0

              SHA256

              f994e407e9f78d521f335f25b7a4217fdcc4a5e6dc050fdf90d7870fda1e0ef7

              SHA512

              7c6f65858e3803ab9abe075c2e257e322594b875bd6001be5a6c6bde0ab271844ccd7f869394666a2ce9b535abb46e0332697d2c19836f886241881a60697ce0

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dll
              Filesize

              2.6MB

              MD5

              53f6774df73cc44d29f354aecbdef948

              SHA1

              894158c553f39f8000c858c84ad772714e215d75

              SHA256

              d1130318e699b81f1918f468a8b49c9be7b8b4293c1078da4a17dac6ad999ec6

              SHA512

              5151804071c371fe2458c2fc67441441b01602a529582bed48b0e0226e051f933981dce1f84e3ac0f2ebe608b463fe1e9c226d058edd3bf6c5b35be9e8a9e234

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dll
              Filesize

              106KB

              MD5

              74d7799c00c804296c0f1b99324b513f

              SHA1

              527380e0e44c9fd8ca5f73d103e8e9f56eb13142

              SHA256

              66c0b9d01afab9db8f87164c747dc6bdd05ffae25092ab4627a8a47857118ab0

              SHA512

              3140d32d4199cc246fddb292400ec31bcc098e18349d9991828fc1462f7cd6aa3a0666037e569511b37b1cb6baf34c94be2fdc70a9685125a72fdd44e427cdac

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd
              Filesize

              49B

              MD5

              95e8c6cd0a911f1ab4969c06b8cf77a2

              SHA1

              be1b1f8abd0420f59ecab7bcf8120cdc2ce34195

              SHA256

              de795f6d8591577054813bee79e7c5b4ee13360039d29aa73971c6b985d26ebd

              SHA512

              e5eefaf761be7bf3cea207e22e98398093fa0a9d3b459af7df22bfbf07755816737a7b8b261acf01aec8b10b5d8f0d90132a4ecdd83c242b2cde883039fac1ff

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dll
              Filesize

              121KB

              MD5

              b7c081f03a50c391f5b22a0ee16b8a1e

              SHA1

              2fa63728dddb2e25f69adf0e02cbd75d053a9965

              SHA256

              42ccb6c597d0952042c3d3fdc0027634c3e9d118706a286277a32a7f6af6bd30

              SHA512

              8590e537d7df9523f934cd4bb18c7515d89e74fc8b3e8e35ce70b368c9a99659bf59dedb020fb470cf8577248f607ed271d52107015cdffc8a0a9f7e8ac2880b

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\http.dll
              Filesize

              189KB

              MD5

              c0d7a16ba0340ffaeadedb5fd82f6984

              SHA1

              63ac374a7322e4ecb9b8fed7e67ffcf01b71fc75

              SHA256

              e07a6f752e45e3240c95cbb890b22a154b1cca571c17fb57f11ef0b86108a7bb

              SHA512

              3e50f009b7a43d2fb58f28f0eaab4555d9fc68ed72af970f6a6bd875dab30b5ad32300e95ac570ddf0d925499e709457ea8757033580493f4bbae14a20d06c42

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dll
              Filesize

              106KB

              MD5

              f89b978400b6c035f975efc6ab7303a8

              SHA1

              173f9f2bc814b19870c7b98057c948b0292340f9

              SHA256

              ca621b67c0aa1fe669c99abc0ee1a52807321f5be4092bad7c49d4291c194b7c

              SHA512

              d0fc9d302ee3b8be6c65ccb2a2d387a1a914ed9a453ce0cad6734f2c9d59a0ea8694e39b81382ee7b6f6c61b96db81f7ad1c227727b65a5a61c0471a35c39e33

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dll
              Filesize

              576KB

              MD5

              e74caf5d94aa08d046a44ed6ed84a3c5

              SHA1

              ed9f696fa0902a7c16b257da9b22fb605b72b12e

              SHA256

              3dedef76c87db736c005d06a8e0d084204b836af361a6bd2ee4651d9c45675e8

              SHA512

              d3128587bc8d62e4d53f8b5f95eb687bc117a6d5678c08dc6b59b72ea9178a7fd6ae8faa9094d21977c406739d6c38a440134c1c1f6f9a44809e80d162723254

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dll
              Filesize

              108KB

              MD5

              4617113b1fa666e743f899d3781483d8

              SHA1

              0a1dadb7051c5a5ed9d108f78f83ac2b21419a84

              SHA256

              30af0cec58983ef5ccf2b30f074faad6ac348cd5fc88461c0b06977839a2c651

              SHA512

              92d0cd9e51de702a04bc2948e2966219b16c1bef93dadddccf801c58c2da1dd22ac5b9651583868957098959beeca2cfdd7465edece1120e364935ff65184675

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\rpc.dll
              Filesize

              107KB

              MD5

              fd8770a4368acd38c18ccb0298dcf587

              SHA1

              867772d872b84988bd7e9ea2271e470dd443874e

              SHA256

              e039a7e9bdecaf697bd73a47da557e5582fbffacc53f9a185790299156c85584

              SHA512

              e1123fa8cf304d082324cfaa5534ea34103226242cef1d6e1640bd2b343d19ae3bcec2302c3a6167c57f8196415190d86050fb55e2e6ba0d90aef189d5ca18c7

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\sav.dll
              Filesize

              726KB

              MD5

              47b40a1348a6eda7087a6241858ef9e1

              SHA1

              ca8ce0ba789baafc75b593fd8a98d4cf8afa4956

              SHA256

              cd83b1612c2823488ea267e88fe91a2aedf6b278bafdd39ff673bed3add39d6b

              SHA512

              dd43a1a08e0dd9386c0c4aa47c2e1a71a6ccd07dec1d70129c43845c5c32ec038efb617bec35320a467bbac77bad6abefd176c747b2a9113190d3e98d1b50130

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smb.dll
              Filesize

              192KB

              MD5

              b4a0352a49d7661e64693765707a0a1a

              SHA1

              888f7e14cc08ef0ff4f6557bc8ec3a4ac36d18f3

              SHA256

              4295bbc2ce2ccb68b17df07b2364ef90b3bb802fc2f44c710b13c1477f424caa

              SHA512

              8647121a5cfc25fb7ff46308cebe3c261927bac40d2fafe89c01945346993e31ff6b0369e2a686f9f4a16cc61b74c887ed670f30a1a21252e04cd1ba781bb712

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dll
              Filesize

              121KB

              MD5

              2b8265dfa5b53b61e875f7a83dde8680

              SHA1

              fa3c87c02750700ac0d20d21b88a90b8122be8e1

              SHA256

              748bac0cddaa20c4967f6f495db6b58f88fb675790c2039e211e42468afbe2eb

              SHA512

              9011bc9b204db910f7a06f89928986f03df234df39309b183b3fe226677eb0c435f0b8c3efaad9689a5fa44bee034ec99b7af2c6fc3a2056bc0a4c0d4d9d5de2

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ssl.dll
              Filesize

              178KB

              MD5

              9592f5912b31b62193656497e67a2d9b

              SHA1

              b8a92656880a7016edcba43b1e206d83fe3847e0

              SHA256

              5978dd53996bc3856d01010e4ddc41215dc9d7fe046961feabec419972ce94bd

              SHA512

              ffab48be1db5cc30f61d88b3bc02e2ea30c8dcd44bfe9bed786bb7cd699dac8c456c1d390925c9a9ff2994a54cf98eee0e76984eba318792ec9838db1954b98d

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140.dll
              Filesize

              99KB

              MD5

              8697c106593e93c11adc34faa483c4a0

              SHA1

              cd080c51a97aa288ce6394d6c029c06ccb783790

              SHA256

              ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

              SHA512

              724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140_1.dll
              Filesize

              43KB

              MD5

              21ae0d0cfe9ab13f266ad7cd683296be

              SHA1

              f13878738f2932c56e07aa3c6325e4e19d64ae9f

              SHA256

              7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

              SHA512

              6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

              Download Submit

            • C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
              Filesize

              5KB

              MD5

              08e41f47515043f904cc5b86bb42ca3b

              SHA1

              c1dd7e3b1241027553b2f745ede376f424f0e6b3

              SHA256

              2f5b55685c7db119243eda7aae0a8d917dda2aa5e9d9ef3c3d884657c9bc9ed0

              SHA512

              dbf2ca91b288fb550af777cec0a6fb2672be8d4cfd5096944514cb7796eb89d5f93c28c92fa94c0e7649fb12ff1764b87d2d4da371e89a1fdda4f798da2ba299

              Download Submit

            • C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip
              Filesize

              17KB

              MD5

              b9a877dd6a8ecf1455a032bcae39beba

              SHA1

              f1cfb541eb406dc8afe1439722a34cf6921fa166

              SHA256

              b5b83b43c1ea5075370f4e895f70c9e1690230cbd1af059f589b3ade140f0925

              SHA512

              8895217d354a5bb6eaf07332c174d35e0db5f5d364c199a7b590fc345479a84642e0428772bea0abe53fa2725579734b46e22ba6bfb7b597526a512c55352ea0

              Download Submit

            • C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
              Filesize

              187B

              MD5

              01a57e12dcf612df0b89a7c78f49d2ee

              SHA1

              39fe8483428d88c488362f53fe9b4440baff6473

              SHA256

              40f338411be98c6201edadd8da6a4423f490536ce3c7cd38ff8e0400e2b0a568

              SHA512

              9902413b207b118025cf40828824895c688a87c13abcbda744ab549b3c33e0b89092c905656d231df2b5d7b507cef7f12c782952ceb260da038ec25f88f73610

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
              Filesize

              812B

              MD5

              113834e9af5e0ef8cb14306d25bbb5f1

              SHA1

              c1359fd5220f3fce5ac6030244bf1fe8ff4cdae9

              SHA256

              4f91d3ca4ccda6a25c0377f7b1ab882c4ccf21f18831511cebea93c17b350499

              SHA512

              2522c1880a31c549f810f847bc34d506907c219dbd088f60fd21e1a91db523a1234728140415b7ca3896e70bec7055e15e280c85f010366d83c20e28eebe2618

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
              Filesize

              1KB

              MD5

              70d600dd3d3ca00fa7ca994f504a9d92

              SHA1

              afd97ffffab17f7d049ca45c99e6f5b3b8ea4ccc

              SHA256

              684a9b188af9f1c2a414427229b87cc579cd5d3ab99fe2615379d3f5d7686b2c

              SHA512

              c2c72261fcc70afb1fc7ac1beadae95f88461a724efab5b652fd6eb5bfb159227752f5b5d2610efe6d6aa96a9fcff072e52336f4a0033fb7d221b2fe7caea1f9

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_DF48483754A6AE209A217FF51855DB26
              Filesize

              806B

              MD5

              e6213e888e76900f9fbcac7e7852940f

              SHA1

              8b5662c2299bfc42309c4e3cbcdc6f19817081f8

              SHA256

              0a616f16cff84447ce3c29373a8c54a58f78d753343d9dc00433c2294523d625

              SHA512

              e5a599b6a8dccd233db7c5fe67834fb7400715a6eaddc0bdd4cc63e124317a39a980c8324c3900b9b55c8884f94da85429e7cdc4d530858e3e4f27aa67aa1a49

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
              Filesize

              540B

              MD5

              e6f9304eb866583ccd205818873b912d

              SHA1

              e10667393c0b9231978a61f1214fd41d3e0c2340

              SHA256

              4634405eb80eeb1d6c7db31786d8d40597bda039593c06f74ca7443e10ad1514

              SHA512

              3c48145c73cbdd5cadad4e877f05503183ad2fcd6822186093ed6c0b527ecbf722e00a3f3497dfb53865793fcddb3b2c3dbb47bd6b6de49f4e46b5fd50181899

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
              Filesize

              528B

              MD5

              4db6a9e9658577cf0272d025b71a2ebc

              SHA1

              f49da655f89dfcf28f31dd40cc822a53ab5cb166

              SHA256

              0e3589e8dc9b8bb39b4de95fac7b9a8b86b6462447eccca744118c754e7893a9

              SHA512

              e308f8d2136e88ca7257bfbd51713cbe1caeac7a07204350bf84d1abab74aa75a321682c1c0cbcb9945c5d2396a2a43f937361456fea45c0f32bcc46d5336db6

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_DF48483754A6AE209A217FF51855DB26
              Filesize

              540B

              MD5

              918d5c242f2ccbedb5bdfe128d320d22

              SHA1

              96b6efa63603375153b36f6c92a346922a6e5978

              SHA256

              284c91f61d7707b9421dc3fb259176b1bdbdfcf5f13f445f59ad02718ce565a7

              SHA512

              d8ff4c61d6152a10fdd41fe6836fcede851a463e66f3a5faf8832c0ff804183d4812b4c13e6a7ea13dcf8bbd2edea6389f37ea7f217f4a7b1b0dbf24de9fa4c2

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\4cd0uqm5.newcfg
              Filesize

              3KB

              MD5

              b40cfacfe8304436c03e75751ce9512e

              SHA1

              35205783a33d36f597c7081739e89535c4774902

              SHA256

              1ddcc261cf5c6c0537a5d16a166be75fd802ce940b87aac9f828ad9d4ccce9c0

              SHA512

              b53c96704c001723149da71231641364c517b97c8a6d62aa13ffc5fcb0ed1ccc042b6816c9ae7d0f00fc3fc9194455091e5f17bbc06525e26454f69e1bdfc794

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\4jdsmgj9.newcfg
              Filesize

              3KB

              MD5

              36b61f48d1bac2720683dae60a6f3058

              SHA1

              3afa6df15c98890e97801303bacdbd8bcdc44d8c

              SHA256

              d7c192c6bd7dc6ec74faff14d6b93d2c0dd7fa6d500c3616b2f00cc221ac4105

              SHA512

              73b1595eb4eecea4397b639a8de7851bbdf620edb9af00c4325d288e33e5af1b90c1341a79bbf6c7b8e686cb7a4ab60d683de6323288fadd62b39971c3fd14de

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\a3drjy-m.newcfg
              Filesize

              4KB

              MD5

              e0a7d2d6dc5ebfce0ff546b31199cdf8

              SHA1

              03ca4ca33af6a8565835f29ffde9bede710da146

              SHA256

              3bd7f894e757dfe4c90af1073d64ef845a83259230840a9668a61d044c648a43

              SHA512

              34ee7c92fe7a4fd6fd2604fbb5a4ef8b2a1fb99950a32055e65d18f3df738f7c005a48abc6922a1d260e353b228c744a81820685b2f6ffbf181b295c28f43498

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\bgwasjid.newcfg
              Filesize

              1KB

              MD5

              e4308a22084be6f951aa99648cdbe1c2

              SHA1

              dbef8d6b73e101397816c3ade09d4f156987a53b

              SHA256

              f96bacba602816427d078505dea2b0423bd391313950e8b60258471d7372b446

              SHA512

              8d1aa1380a5623d247fea0d8e0178cc1dbb61141c7dc45c095930a420a904efbf7f80f3febb5411cb8a152ee12e5e667f6466cf33de58dcdf89e0199fd959867

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\brvuh0we.newcfg
              Filesize

              2KB

              MD5

              6c15347458c318ed60377c88eb2db718

              SHA1

              c1a02db2eadb19e4ff489818037f56626b599a88

              SHA256

              ae3e90cf9a2b00d7510cc83fb4f1d8a4810af13eefe7556240e749e5a849f5da

              SHA512

              df679c8d98da443c756caad864f8499e92591a3a6503f2cb6c97b20c63c9e228692736de12fff1100f5d26fb1076c89897fa235a55926b5c5c402e2a3eadff84

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\de2twuf7.newcfg
              Filesize

              2KB

              MD5

              19af3b140758372fe1430a30d5fa75a4

              SHA1

              e64fd9e953aa91cd9e477cd41b89869e9896268d

              SHA256

              30c39d03e3c67041ec36fc1d41a6368bb968200a591708d05645024c599d6801

              SHA512

              a9d0585bdce46ac67a9b0be8658ed01f8d23e601bdf45803912492e355c3ff5c1681889db79a4f017df1003219bfea796d0f1a6e0508d9cac7999d36c4d05588

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\jlocl7lp.newcfg
              Filesize

              2KB

              MD5

              2caf6ccd3677f79d02cba0e98e395cd2

              SHA1

              0f47367b37aaa0dcc66d83730638d9fa81c3195a

              SHA256

              e8166489cb457c7c50e70a6793b7094b2a9f5d7f5f50e38a0db833f9df02d743

              SHA512

              2a5b2863964b51a354ee40e80228cd5f32e3ceebb91e561ba787eac40d9d058cdbc2f98f65efca9a77e251499a973fca3b4a4369ffb8f7818a03cf93a8cf015c

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\jtsth85m.newcfg
              Filesize

              2KB

              MD5

              0f52567ff36ee6655a32219f21b54887

              SHA1

              4fb341e09eaf176bc4e2d97f37a9de5d0c30872e

              SHA256

              89deccb3a952f09d39de0a9644cf37fd83afdb4ab97b52d9e0a9935f8a6ed152

              SHA512

              c44616767f441448cb32e40c3ae9c0f7836a726989424fa9d37c0f40af8779d8bb0f035b6763e7280063c3baa500dac59a3edf002195960cb85f53c2c9aa8c48

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\m6eyzzhe.newcfg
              Filesize

              4KB

              MD5

              943fb7481398eb538e73f4f8257be3cd

              SHA1

              a46191378754bce8c5335459054d974fcf992e97

              SHA256

              b08bca113c64af470396a2d289aad4846a493c22db1cd8f640972dc4329bf8d0

              SHA512

              6fab1a7831a945586d633e849d0b8011edc3c606058124848aa098ae06d03bcfe9c30d62f4a2bc301a2b67c7a9bf83fc022c46c749bf6b17db394c04cf718790

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\mgayno6j.newcfg
              Filesize

              4KB

              MD5

              08e3efb6b088710074cd1f5421f9b360

              SHA1

              b86472f6a9dce171dc7cd44dbfa8b777be8d734d

              SHA256

              53f80b6ea20a1e7c6c04ee7ed51eec1d7c80281143fa178227b991935ac4f6d8

              SHA512

              96856eb4cdc9e5b949a0b15ba75e25fabf1444208fc41166f08e20fff1c67b718a25783c39ae4c970f6b81cfb67f9a31ffcee5f5d886d39b1ca9690f3c3ef501

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\qpvsw_eq.newcfg
              Filesize

              4KB

              MD5

              db9813c3721ecdfc532909f36939026e

              SHA1

              d290e02da5310cc829b019c741c0b5c09f388cda

              SHA256

              c59c2a0aad908ab9dd5289933b5e208478707b33416695e11d6d6f3891298dc6

              SHA512

              2e7b9dcafffdec3999b4d2ee234417dcf0c8a8e70092e4c69a1948754983296845f85c73797cd38a00c2be7bfa067f96b641f837ca38032ea0a5dcc65e8ff3fd

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\rwiutpx5.newcfg
              Filesize

              2KB

              MD5

              3dcbf9d3afb33456a3c75b77f8c3fc18

              SHA1

              b341daca34ace290c4e09637798283a9cc66175e

              SHA256

              eda7c85e623bd2843a15abf5e38debaaef9204e38ca0d759b3acefdad3ac11d5

              SHA512

              e419f5a1ed6bf5158797ba4cae8e19fd93e2dff5341e6630395e3e1308bfafbe62c3a4d77030e09e5c1eb4a619c801e262aa9db70694ec36d04a5bed27bb9fed

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\user.config
              Filesize

              338B

              MD5

              0a35fbae99f45bc0dccdb777ecfd0436

              SHA1

              65e295fde91f90d55b107680e060895654fe66e4

              SHA256

              19af84c48a15820c94367390d58588ddad8164b0ac4056c258a766c726329550

              SHA512

              db3a0973a373c039603c750f0f196cbf65553cddb83739f1942402eaacbe178a775be87c4b034feb706830ae69d20158c3e3ecad8d5d3febc45146b487c3c42c

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\uy6pegua.newcfg
              Filesize

              4KB

              MD5

              c593fe842a1fc8c7119c28aa84f20deb

              SHA1

              52886f6f6547b663e0f9213d4b06e090b30573d3

              SHA256

              6f46276cae84654ad3926d88b6eaa33bf9289927d6dcf8bae1f28b03b4aecdb1

              SHA512

              11eeb21947e2ac6d46d19e32e51f9a0b6ba317b2dfba61f3677911c4bec2e00e483527b284444c8cc78ce18d5e6d542fadb24391b259c489b1f139eeda7f19c8

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\wbadss5s.newcfg
              Filesize

              2KB

              MD5

              f0872e1ce6ba3ab5fc6738a8119bdde6

              SHA1

              0b47ac39f7aa40318eeb94295b6674d0e4871649

              SHA256

              c44fbf5c231c32b63719d924863faaec8154d192d9dc18a4731d78e629c3b069

              SHA512

              8ef5a5a3fcbcdcdd41fc91572ce5e6c71d13e5e2819fa9a267d017244bfdc17647dfad6732d1018b499050c4eeb820d324a8583678a2faa851bd6660554916b4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zSC2068F1D\ICSharpCode.SharpZipLib.dll
              Filesize

              208KB

              MD5

              94893afa464938ab2169c8be39d971a7

              SHA1

              4926bef17768e8e0e05bbd10d2321e475ab491a7

              SHA256

              a02c4fae529a5b48a28236bf15cd54ed3f7a613210e40970f3cca82f0f68075e

              SHA512

              fa5214c5190e5fe6b347504e8c8817f52ad2549254e985d13d71798e820c6f2ba956585afa0240fb6806a3e74816c869bfac7d9b9564136825abc9a57b4e125f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zSC2068F1D\Newtonsoft.Json.dll
              Filesize

              428KB

              MD5

              3a4649717bdaf9e86dc93cfbcf8a4baa

              SHA1

              d1a1ecd90691fbd768ec9a7f2ebc89340b447e84

              SHA256

              f2d262cd645b7888b88ffa0e799e3e77c982bd2b09e68ad625b218d1435b6f6b

              SHA512

              c40b8f51120fde698fae9907c335e9c7f9d957e073da88c2ea5dbaaa7bf609a44bdedf104092f442f6172dbef3693ee5c1b0ec683b3125f13c95b9e48b10f181

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zSC2068F1D\WebCompanionInstaller.exe
              Filesize

              454KB

              MD5

              36a9001422c3e6532893e9a2f43658eb

              SHA1

              5189fab41f5d43634367bfca2729ad9b6f36ba20

              SHA256

              7f86c7e4a65835f9c12d2425d611902d23b15626960a19d2da03ec511b6a7b9c

              SHA512

              1d60a35e2f64e70b6489a13426f0f5952d3e93e79051fa37a4a5bc8a89614c5614a07de25715670c6618db27b7682c7b4589c356418716a3aae764568bf3371e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zSC2068F1D\WebCompanionInstaller.exe.config
              Filesize

              1KB

              MD5

              025f5c132b47e5a5723d982bd652d5bc

              SHA1

              10460431043d2400166da8f464678d733f2e4f84

              SHA256

              6309de6d3c423af1dc0c47869793c37a108fa32da063d3f5bbb96927f93b4c25

              SHA512

              a72ad7f040acde97aac0f13f502bdfa395864497d1db9c012549377be9201252a59d5b8ce2e3bffb634e75efa6e594e6150ade60e2547760306cba8c568aa090

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\B536.tmp.exe
              Filesize

              149KB

              MD5

              060404f288040959694844afbd102966

              SHA1

              e0525e9ef6713fd7f269a669335ce3ddaab4b6a1

              SHA256

              40517e822f3442a2f389a50e905f40a6a2c4930077c865e3ea7b1929405f760a

              SHA512

              ddf8c53e1e1888084fa5422f297cc3ba9d97f7576c36f6b633ce67ca789127f7e259e9fb374fcbced66f883dadde0717d81ecce9776770bf07d8cf3b94b1a43f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
              Filesize

              551KB

              MD5

              f6cafe8321409eb7e885ef119cc161ce

              SHA1

              d6f1b4181c2e982fefe32808c6aff556f4e5d2ba

              SHA256

              6d2a2227681cf096a5783131a7a744da178fa103dc41dbdf4cbdd49b9909b60f

              SHA512

              2b9c02ebc8cddc478958ee7bdc3c9e3850940473737096b0940125f2f27acaa0bff405dbb19312a0966129de9351fd4d638b83ce153cf1769e4a6c6f26ba242e

              Download Submit

            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
              Filesize

              466B

              MD5

              a183c83f6233c3a1602d8630677c2f3d

              SHA1

              3e093c3b6f8498aa7e9b4a96ad65e44c8234e1c0

              SHA256

              7fbe9ab0a36c11153311e57463ab9f1d942eb6aa4931fb10c5af9f12b93604cb

              SHA512

              cdc8ab8a655cd052ee754925477d71a7e3717b051469d3c1d3ca08646e3993687ed13387040d13eaef209f6377bd6016efd4692666663196d2bf4f9fcf06b750

              Download Submit

            • memory/1044-540-0x000000001B520000-0x000000001BADA000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/1044-544-0x000000001A6D0000-0x000000001A6E0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1044-545-0x000000001BBE0000-0x000000001BBFE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1044-546-0x000000001BC50000-0x000000001BCB2000-memory.dmp

              Filesize

              392KB

              Download

            • memory/1044-550-0x000000001BE50000-0x000000001BE99000-memory.dmp

              Filesize

              292KB

              Download

            • memory/1044-551-0x000000001C3B0000-0x000000001C4A0000-memory.dmp

              Filesize

              960KB

              Download

            • memory/1044-552-0x000000001C9B0000-0x000000001CEBE000-memory.dmp

              Filesize

              5.1MB

              Download

            • memory/1044-534-0x0000000019D80000-0x0000000019DD0000-memory.dmp

              Filesize

              320KB

              Download

            • memory/1044-569-0x000000001C1D0000-0x000000001C240000-memory.dmp

              Filesize

              448KB

              Download

            • memory/1044-570-0x000000001C2C0000-0x000000001C33E000-memory.dmp

              Filesize

              504KB

              Download

            • memory/1044-571-0x000000001CF50000-0x000000001CFDE000-memory.dmp

              Filesize

              568KB

              Download

            • memory/1044-533-0x0000000019D20000-0x0000000019D28000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1044-532-0x0000000000B00000-0x0000000000B20000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1748-825-0x000000001B4E0000-0x000000001B616000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/1748-824-0x000000001AE00000-0x000000001B1D4000-memory.dmp

              Filesize

              3.8MB

              Download

            • memory/3000-883-0x0000000074080000-0x0000000074092000-memory.dmp

              Filesize

              72KB

              Download

            • memory/3000-882-0x0000000011D80000-0x0000000011D92000-memory.dmp

              Filesize

              72KB

              Download

            • memory/3000-995-0x00000000661C0000-0x00000000661E2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4488-698-0x0000000073220000-0x00000000737D1000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4488-177-0x0000000073222000-0x0000000073223000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4488-178-0x0000000073220000-0x00000000737D1000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4488-73-0x0000000073220000-0x00000000737D1000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4488-251-0x0000000073220000-0x00000000737D1000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4488-72-0x0000000073220000-0x00000000737D1000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4488-70-0x0000000073222000-0x0000000073223000-memory.dmp

              Filesize

              4KB

              Download

            • memory/5848-513-0x0000000070B10000-0x0000000070B22000-memory.dmp

              Filesize

              72KB

              Download

            • memory/5848-512-0x000000000D8B0000-0x000000000D8C2000-memory.dmp

              Filesize

              72KB

              Download

            • memory/5848-680-0x00000000661C0000-0x00000000661E2000-memory.dmp

              Filesize

              136KB

              Download