Overview

overview

10

Static

static

10

08751be484...2d.dll

windows10-2004-x64

10

08751be484...2d.dll

windows11-21h2-x64

10

0a9f79abd4...51.exe

windows10-2004-x64

3

0a9f79abd4...51.exe

windows11-21h2-x64

3

0di3x.exe

windows10-2004-x64

10

0di3x.exe

windows11-21h2-x64

10

2019-09-02...10.exe

windows10-2004-x64

10

2019-09-02...10.exe

windows11-21h2-x64

10

2c01b00772...eb.exe

windows10-2004-x64

10

2c01b00772...eb.exe

windows11-21h2-x64

10

31.exe

windows10-2004-x64

10

31.exe

windows11-21h2-x64

10

3DMark 11 ...on.exe

windows10-2004-x64

3

3DMark 11 ...on.exe

windows11-21h2-x64

3

42f9729255...61.exe

windows10-2004-x64

10

42f9729255...61.exe

windows11-21h2-x64

10

5da0116af4...18.exe

windows10-2004-x64

10

5da0116af4...18.exe

windows11-21h2-x64

5

69c56d12ed...6b.exe

windows10-2004-x64

10

69c56d12ed...6b.exe

windows11-21h2-x64

10

905d572f23...50.exe

windows10-2004-x64

10

905d572f23...50.exe

windows11-21h2-x64

10

948340be97...54.exe

windows10-2004-x64

10

948340be97...54.exe

windows11-21h2-x64

10

95560f1a46...f9.dll

windows10-2004-x64

5

95560f1a46...f9.dll

windows11-21h2-x64

3

Archive.zi...3e.exe

windows10-2004-x64

8

Archive.zi...3e.exe

windows11-21h2-x64

8

DiskIntern...en.exe

windows10-2004-x64

3

DiskIntern...en.exe

windows11-21h2-x64

3

ForceOp 2....ce.exe

windows10-2004-x64

7

ForceOp 2....ce.exe

windows11-21h2-x64

7

Resubmissions

16/04/2025, 11:04

250416-m58gsaz1ay 10

15/04/2025, 17:34

250415-v5ylksypw9 10

15/04/2025, 06:16

250415-g1p7ras1dw 10

14/04/2025, 08:06

250414-jzpwpstxhx 10

14/04/2025, 07:59

250414-jvg1assky4 10

14/04/2025, 07:22

250414-h7g1dss1h1 10

14/04/2025, 07:16

250414-h3xv2s1nv6 10

11/04/2025, 21:39

250411-1h113szzaz 10

Analysis

  • max time kernel
    898s
  • max time network
    825s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/04/2025, 17:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Archive.zip__ccacaxs2tbz2t6ob3e.exe

  • Size

    430KB

  • MD5

    a3cab1a43ff58b41f61f8ea32319386b

  • SHA1

    94689e1a9e1503f1082b23e6d5984d4587f3b9ec

  • SHA256

    005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6

  • SHA512

    8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d

  • SSDEEP

    6144:vU9Q9tD5WuDQa4t3BMgLkzvCOnYxcEaSAOPou8BWinO8DR:8Q9tD5WyQlBBVAnYxRhr8DR

Score
8/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
    "C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\8DC9.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\8DC9.tmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1908
    • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Users\Admin\AppData\Local\Temp\7zS05EB7A8C\WebCompanionInstaller.exe
        .\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=8.9.0.1201 --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3368
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3428
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3344
        • C:\Windows\system32\RunDLL32.Exe
          "C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
          4⤵
          • Drops file in Drivers directory
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4564
          • C:\Windows\system32\runonce.exe
            "C:\Windows\system32\runonce.exe" -r
            5⤵
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:1004
            • C:\Windows\System32\grpconv.exe
              "C:\Windows\System32\grpconv.exe" -o
              6⤵
                PID:3604
          • C:\Windows\system32\net.exe
            "C:\Windows\sysnative\net.exe" start bddci
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:904
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start bddci
              5⤵
                PID:724
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:960
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" description "DCIService" "Webprotection Bridge service"
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:5096
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2808
              • C:\Windows\SysWOW64\sc.exe
                sc start DCIService
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:5192
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5424
              • C:\Windows\SysWOW64\netsh.exe
                netsh http add urlacl url=http://+:9007/ user=Everyone
                5⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:684
            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5276
            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall
              4⤵
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4688
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zae3dkge.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1884
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9445.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9444.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3936
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c grpconv -o
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Windows\system32\grpconv.exe
          grpconv -o
          2⤵
            PID:2144
        • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
          "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
          1⤵
            PID:2836
          • C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
            "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:6076
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:388
              • C:\Windows\system32\netsh.exe
                netsh http add urlacl url=http://+:9007/ user=Everyone
                3⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2548
          • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
            C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
            1⤵
              PID:5084

            Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\PROGRA~2\Lavasoft\WEBCOM~1\Service\x64\bddci.sys
              Filesize

              781KB

              MD5

              2a241af18d9f0466aff6cd77c1561f9b

              SHA1

              2c6bfc8e583ed026fdf9ec01265d99e22d39305a

              SHA256

              528804013487cdb1da617e512d1de68060602887bcc8a7822bdb1346a2995ffd

              SHA512

              6779667bb57c87fdbf4dee57682e7851b5ad5bea39deb09fcb596ae48eb571317749ff59e825f91bd57527dab7477deac5b24bdbd86471844fad36876c08dd28

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
              Filesize

              8.8MB

              MD5

              33fe4870dffa70f707f0e8ba8f1ca415

              SHA1

              779189a3501aafcf1801bd392aab0d2730ac81d1

              SHA256

              3f5cc7f3c39e73d8c758e8e39891984de2664de9051fb56f654e72850dc8a50b

              SHA512

              9c6497fb5bb0da0481e6d6a50951a182a7a6a38b35ac31fae28a41c721f510cbbb15b94e9e3d970c882a6ded1d94c64b2e638ee18084662c5bab4c32de0d212d

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config
              Filesize

              18KB

              MD5

              b268ad3c2643d55cc89d460e7f7787f0

              SHA1

              634ca884ef19b4e55eeb9d8dbca74786ad609f23

              SHA256

              977d8ae0a472b9f745651fd22a16130f59c84188f50eb58e977082f187457c2b

              SHA512

              7fba51c95103455db78713bbb7dbaf4324d3937b5525b38b141fc4d3f24d9573b1b28bea2a151c50a752716726365b31ddce8ef42bc46df4e36294c2649d9180

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll
              Filesize

              316KB

              MD5

              8803556da0150591f8b326b9ba1be4cb

              SHA1

              62052c002e290630dc3ed63ce390ccdbd9f77c6e

              SHA256

              5ac940cee14650b1d490ac12826034c11ec09d17ba98586c8f83cf029006c835

              SHA512

              1b80f5e2c5e1818dc4b1467016f8e27cd7373b9949cde8e8a0d6bd94f67745c80f1c8ee11e39ec68137445736fe7449eb9dac5bbc8064ec12165d8db1adf5191

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
              Filesize

              3.3MB

              MD5

              3827ca1c0ec114a29bb576bef431f070

              SHA1

              1189dd380f160046de9f5f2f1d74459958f31a4b

              SHA256

              dd45886108aa85350feaa6d9fcc6c922b0874dfa18bbfe23111cc8edcb37fcb1

              SHA512

              480b6a1fc02fdec7fc2316f01b239bce98a6d8152770d329ddc4bfb37e2e00a7987a702900523ccc0380caabbee38a404683dbb20fe9c9b9456083559afb8218

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
              Filesize

              4KB

              MD5

              e8b58a307f96dc9ce1eb2729f86e13b0

              SHA1

              5cee60f070930dc971e4d35d48e30364f623aad2

              SHA256

              2c9a7118ef74c3b168663c8ec6f3a7b27653896e193129ed0bc5e9aa55a0afbb

              SHA512

              7cd9fe7bcc8c8ec1466acc1adc7ab8c9ab6bdaf7c7c27dcc6c0cb43bab741f2519a88647ce43f74d7e9caf4ae39ae172dc639ed1b2027b9e8f15f35353613d91

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core.dll
              Filesize

              1.5MB

              MD5

              13efc649989e224c8346c52ae3cc9a93

              SHA1

              bf907fee6fce0745601219f3faa89bc2c08434b0

              SHA256

              f994e407e9f78d521f335f25b7a4217fdcc4a5e6dc050fdf90d7870fda1e0ef7

              SHA512

              7c6f65858e3803ab9abe075c2e257e322594b875bd6001be5a6c6bde0ab271844ccd7f869394666a2ce9b535abb46e0332697d2c19836f886241881a60697ce0

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddcihttp.dll
              Filesize

              2.6MB

              MD5

              53f6774df73cc44d29f354aecbdef948

              SHA1

              894158c553f39f8000c858c84ad772714e215d75

              SHA256

              d1130318e699b81f1918f468a8b49c9be7b8b4293c1078da4a17dac6ad999ec6

              SHA512

              5151804071c371fe2458c2fc67441441b01602a529582bed48b0e0226e051f933981dce1f84e3ac0f2ebe608b463fe1e9c226d058edd3bf6c5b35be9e8a9e234

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bittorrent.dll
              Filesize

              106KB

              MD5

              74d7799c00c804296c0f1b99324b513f

              SHA1

              527380e0e44c9fd8ca5f73d103e8e9f56eb13142

              SHA256

              66c0b9d01afab9db8f87164c747dc6bdd05ffae25092ab4627a8a47857118ab0

              SHA512

              3140d32d4199cc246fddb292400ec31bcc098e18349d9991828fc1462f7cd6aa3a0666037e569511b37b1cb6baf34c94be2fdc70a9685125a72fdd44e427cdac

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd
              Filesize

              49B

              MD5

              95e8c6cd0a911f1ab4969c06b8cf77a2

              SHA1

              be1b1f8abd0420f59ecab7bcf8120cdc2ce34195

              SHA256

              de795f6d8591577054813bee79e7c5b4ee13360039d29aa73971c6b985d26ebd

              SHA512

              e5eefaf761be7bf3cea207e22e98398093fa0a9d3b459af7df22bfbf07755816737a7b8b261acf01aec8b10b5d8f0d90132a4ecdd83c242b2cde883039fac1ff

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ftp.dll
              Filesize

              121KB

              MD5

              b7c081f03a50c391f5b22a0ee16b8a1e

              SHA1

              2fa63728dddb2e25f69adf0e02cbd75d053a9965

              SHA256

              42ccb6c597d0952042c3d3fdc0027634c3e9d118706a286277a32a7f6af6bd30

              SHA512

              8590e537d7df9523f934cd4bb18c7515d89e74fc8b3e8e35ce70b368c9a99659bf59dedb020fb470cf8577248f607ed271d52107015cdffc8a0a9f7e8ac2880b

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\http.dll
              Filesize

              189KB

              MD5

              c0d7a16ba0340ffaeadedb5fd82f6984

              SHA1

              63ac374a7322e4ecb9b8fed7e67ffcf01b71fc75

              SHA256

              e07a6f752e45e3240c95cbb890b22a154b1cca571c17fb57f11ef0b86108a7bb

              SHA512

              3e50f009b7a43d2fb58f28f0eaab4555d9fc68ed72af970f6a6bd875dab30b5ad32300e95ac570ddf0d925499e709457ea8757033580493f4bbae14a20d06c42

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\lsa.dll
              Filesize

              106KB

              MD5

              f89b978400b6c035f975efc6ab7303a8

              SHA1

              173f9f2bc814b19870c7b98057c948b0292340f9

              SHA256

              ca621b67c0aa1fe669c99abc0ee1a52807321f5be4092bad7c49d4291c194b7c

              SHA512

              d0fc9d302ee3b8be6c65ccb2a2d387a1a914ed9a453ce0cad6734f2c9d59a0ea8694e39b81382ee7b6f6c61b96db81f7ad1c227727b65a5a61c0471a35c39e33

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dll
              Filesize

              576KB

              MD5

              e74caf5d94aa08d046a44ed6ed84a3c5

              SHA1

              ed9f696fa0902a7c16b257da9b22fb605b72b12e

              SHA256

              3dedef76c87db736c005d06a8e0d084204b836af361a6bd2ee4651d9c45675e8

              SHA512

              d3128587bc8d62e4d53f8b5f95eb687bc117a6d5678c08dc6b59b72ea9178a7fd6ae8faa9094d21977c406739d6c38a440134c1c1f6f9a44809e80d162723254

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\pop3.dll
              Filesize

              108KB

              MD5

              4617113b1fa666e743f899d3781483d8

              SHA1

              0a1dadb7051c5a5ed9d108f78f83ac2b21419a84

              SHA256

              30af0cec58983ef5ccf2b30f074faad6ac348cd5fc88461c0b06977839a2c651

              SHA512

              92d0cd9e51de702a04bc2948e2966219b16c1bef93dadddccf801c58c2da1dd22ac5b9651583868957098959beeca2cfdd7465edece1120e364935ff65184675

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\rpc.dll
              Filesize

              107KB

              MD5

              fd8770a4368acd38c18ccb0298dcf587

              SHA1

              867772d872b84988bd7e9ea2271e470dd443874e

              SHA256

              e039a7e9bdecaf697bd73a47da557e5582fbffacc53f9a185790299156c85584

              SHA512

              e1123fa8cf304d082324cfaa5534ea34103226242cef1d6e1640bd2b343d19ae3bcec2302c3a6167c57f8196415190d86050fb55e2e6ba0d90aef189d5ca18c7

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\sav.dll
              Filesize

              726KB

              MD5

              47b40a1348a6eda7087a6241858ef9e1

              SHA1

              ca8ce0ba789baafc75b593fd8a98d4cf8afa4956

              SHA256

              cd83b1612c2823488ea267e88fe91a2aedf6b278bafdd39ff673bed3add39d6b

              SHA512

              dd43a1a08e0dd9386c0c4aa47c2e1a71a6ccd07dec1d70129c43845c5c32ec038efb617bec35320a467bbac77bad6abefd176c747b2a9113190d3e98d1b50130

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smb.dll
              Filesize

              192KB

              MD5

              b4a0352a49d7661e64693765707a0a1a

              SHA1

              888f7e14cc08ef0ff4f6557bc8ec3a4ac36d18f3

              SHA256

              4295bbc2ce2ccb68b17df07b2364ef90b3bb802fc2f44c710b13c1477f424caa

              SHA512

              8647121a5cfc25fb7ff46308cebe3c261927bac40d2fafe89c01945346993e31ff6b0369e2a686f9f4a16cc61b74c887ed670f30a1a21252e04cd1ba781bb712

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\smtp.dll
              Filesize

              121KB

              MD5

              2b8265dfa5b53b61e875f7a83dde8680

              SHA1

              fa3c87c02750700ac0d20d21b88a90b8122be8e1

              SHA256

              748bac0cddaa20c4967f6f495db6b58f88fb675790c2039e211e42468afbe2eb

              SHA512

              9011bc9b204db910f7a06f89928986f03df234df39309b183b3fe226677eb0c435f0b8c3efaad9689a5fa44bee034ec99b7af2c6fc3a2056bc0a4c0d4d9d5de2

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ssl.dll
              Filesize

              178KB

              MD5

              9592f5912b31b62193656497e67a2d9b

              SHA1

              b8a92656880a7016edcba43b1e206d83fe3847e0

              SHA256

              5978dd53996bc3856d01010e4ddc41215dc9d7fe046961feabec419972ce94bd

              SHA512

              ffab48be1db5cc30f61d88b3bc02e2ea30c8dcd44bfe9bed786bb7cd699dac8c456c1d390925c9a9ff2994a54cf98eee0e76984eba318792ec9838db1954b98d

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140.dll
              Filesize

              99KB

              MD5

              8697c106593e93c11adc34faa483c4a0

              SHA1

              cd080c51a97aa288ce6394d6c029c06ccb783790

              SHA256

              ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

              SHA512

              724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

              Download Submit

            • C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vcruntime140_1.dll
              Filesize

              43KB

              MD5

              21ae0d0cfe9ab13f266ad7cd683296be

              SHA1

              f13878738f2932c56e07aa3c6325e4e19d64ae9f

              SHA256

              7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

              SHA512

              6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

              Download Submit

            • C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
              Filesize

              4KB

              MD5

              04cde83a4b630c1ad1a8d1f3787348f7

              SHA1

              939a31ea9d6126ff9ee74e4201306f7344d7de02

              SHA256

              4af357dea10adfc70d298558e2a5a4b15025edb4eedad28f4132cc7196b9f020

              SHA512

              b1a94241e039e4fd697e5b9106ebb672db795b5419755b90e73d763a486c772b8ab8d0cca8e1c26ac861ec578bcedd7f3a414e907f37c65840157395c17dae2d

              Download Submit

            • C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip.tmp
              Filesize

              17KB

              MD5

              b9a877dd6a8ecf1455a032bcae39beba

              SHA1

              f1cfb541eb406dc8afe1439722a34cf6921fa166

              SHA256

              b5b83b43c1ea5075370f4e895f70c9e1690230cbd1af059f589b3ade140f0925

              SHA512

              8895217d354a5bb6eaf07332c174d35e0db5f5d364c199a7b590fc345479a84642e0428772bea0abe53fa2725579734b46e22ba6bfb7b597526a512c55352ea0

              Download Submit

            • C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
              Filesize

              187B

              MD5

              f3ec58a15322917dd8042fa272b0125c

              SHA1

              6605c9248f30c05fa7cac9ca0feaf54daeb64af3

              SHA256

              5b00c79202bcbc98d9ada6d78481c301e1e2596c93b042527042ad709fed4cae

              SHA512

              2a724d1e54aa44ee617f8697b9e4a0e92ed8ea417289de20be26657742abde801c553542321e10dfeccf18e93927bc43ef7bd1c172d3d56bae11841371370d69

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
              Filesize

              812B

              MD5

              113834e9af5e0ef8cb14306d25bbb5f1

              SHA1

              c1359fd5220f3fce5ac6030244bf1fe8ff4cdae9

              SHA256

              4f91d3ca4ccda6a25c0377f7b1ab882c4ccf21f18831511cebea93c17b350499

              SHA512

              2522c1880a31c549f810f847bc34d506907c219dbd088f60fd21e1a91db523a1234728140415b7ca3896e70bec7055e15e280c85f010366d83c20e28eebe2618

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
              Filesize

              1KB

              MD5

              70d600dd3d3ca00fa7ca994f504a9d92

              SHA1

              afd97ffffab17f7d049ca45c99e6f5b3b8ea4ccc

              SHA256

              684a9b188af9f1c2a414427229b87cc579cd5d3ab99fe2615379d3f5d7686b2c

              SHA512

              c2c72261fcc70afb1fc7ac1beadae95f88461a724efab5b652fd6eb5bfb159227752f5b5d2610efe6d6aa96a9fcff072e52336f4a0033fb7d221b2fe7caea1f9

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_DF48483754A6AE209A217FF51855DB26
              Filesize

              806B

              MD5

              e6213e888e76900f9fbcac7e7852940f

              SHA1

              8b5662c2299bfc42309c4e3cbcdc6f19817081f8

              SHA256

              0a616f16cff84447ce3c29373a8c54a58f78d753343d9dc00433c2294523d625

              SHA512

              e5a599b6a8dccd233db7c5fe67834fb7400715a6eaddc0bdd4cc63e124317a39a980c8324c3900b9b55c8884f94da85429e7cdc4d530858e3e4f27aa67aa1a49

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
              Filesize

              540B

              MD5

              0e769e1b052c1f9d17bb83ccbf2a1bbe

              SHA1

              63e400d66ed6b837eb81b078d9770dd5a2f858eb

              SHA256

              fda92604042523f262f881605707346d5e751ff400ab732f8c173725ac3bee5a

              SHA512

              ad6ed8ab0fca2d4f95c16c98e88aa2e97a775c7b19007de90e77c108af8db75ff0624d83eb6292b4b775575a4d3c4b90966760cc1f0c2f96264f84adb1b02561

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
              Filesize

              528B

              MD5

              908e321855c287c96ba54a375342df02

              SHA1

              a29e04a8c17c4c28fb3379cf983bb41963314979

              SHA256

              d99231cde0ddc8599f386d4b9c24d9b457a4cd551dc2a45fa829cc9382da7a80

              SHA512

              a568ad18dd188a98f1aef1df8b355385a3e88091c5bdf16b39603f2cfebf109f5b04292f0665d36eeca8f9e89ed9e0471acb7fc3afde02b79298863561faa932

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_DF48483754A6AE209A217FF51855DB26
              Filesize

              540B

              MD5

              39fb63d9997c3e4c105cccb57c15a29c

              SHA1

              6a18ad22bbcdf8f845e3b482e99efe15c4317e10

              SHA256

              46946bd79137ac21353be24b8f8d88ed7234b60aab455418b368a569cda67d2e

              SHA512

              bb8a0c1aecbe9ed9a031520c554378d7ad1927578be26084c82b39bc7020b010b848b987b360c53d160d9e82297e8f0db5aa307a958d48ef4b97bad906ca54cf

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\0e3jqbnt.newcfg
              Filesize

              4KB

              MD5

              543364fc3318c34c5e4a87f43124e356

              SHA1

              b6bdc91ecd091e3879ecdfe2fcf4d2ddac43d114

              SHA256

              7998fef76f85bb6342b81b53ec300a1289ef65f251a544fa77f6ffdb5a59fc79

              SHA512

              11d9a1bc39065a873dd00bc0d6fb5694dc3e9ef1ea1d4b305169749278aba5f1d65d25b918c8aee2e45e85c5fdfb710ccfc155dfecf86ec73479d5c84e2cfd68

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\_z9ptuyx.newcfg
              Filesize

              2KB

              MD5

              e48459111277e491950974594baf579a

              SHA1

              225ebb6af60e11f6a97f1cd7821c23a85111d431

              SHA256

              3aa6e028d3d4aa9e78623e62eebb80d629aa1e26578b59861362975328d330ff

              SHA512

              3b222761935fb44f0bc2aa80df9865cf1ddbea8bf129e61dc1f810bda274e8b7474a8f9d50d0962533ca937c6ca80a527eb5d2fb5697fe134777450aaa12bf77

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\kov4hzfb.newcfg
              Filesize

              2KB

              MD5

              0f52567ff36ee6655a32219f21b54887

              SHA1

              4fb341e09eaf176bc4e2d97f37a9de5d0c30872e

              SHA256

              89deccb3a952f09d39de0a9644cf37fd83afdb4ab97b52d9e0a9935f8a6ed152

              SHA512

              c44616767f441448cb32e40c3ae9c0f7836a726989424fa9d37c0f40af8779d8bb0f035b6763e7280063c3baa500dac59a3edf002195960cb85f53c2c9aa8c48

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\qffdzd9a.newcfg
              Filesize

              4KB

              MD5

              b74a73e90eca0bb14a45a1172170e3d8

              SHA1

              53be8f23839e36f62eb7fa1cb3ed516e53976483

              SHA256

              e1e4db179156c8d27114ff81db5ae7710d181d94ac8f540ed4ecdcafa60cba0a

              SHA512

              5974f2e988c6753fbfbb64c7a1cefd12ddd4728370199d9e5df9dacc28a051c30fbd107baad393b636dbc4dd61107be2bbbe76c9f235f73a340d10db7f627359

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\qiz7niff.newcfg
              Filesize

              3KB

              MD5

              bd2cccfe5cb47f382e79d13456ff425a

              SHA1

              1ac02dffdd41cb0c0c19cf11f926fd9cc8bcf9e2

              SHA256

              319fd4413bfe6c392c9545b3f20454e0151d1b7ff1b0452e09e19e9288c395bd

              SHA512

              8ac01cfd7117aefb0a147dbfaf6ad04c594b18d6e904b8f1f23c7941c486926a402f009b790eec0fe1c2d839a0e940d6ff37ee3b66cc4fe243359f6b122d1c13

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\rqtobawk.newcfg
              Filesize

              2KB

              MD5

              0c10e85a914bfab297b1136aa702d6dc

              SHA1

              b683763c8ca026a0802c6b736bcb77d8007271f3

              SHA256

              eb619223afc70a8ccd74d6c6f2df8abbbdb27651a000f7e86d91b945758b7bfb

              SHA512

              0a3511927e9268997fa48ad1e2e6cf909e6c7d298618e2bdd846b1418fcb725fe61200f21fe40e28d3cfd9a2689a8dbe5236cb8017fb6f0ac4eb1a3e3fc9ac2e

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\tccoaalq.newcfg
              Filesize

              2KB

              MD5

              e2b85f9fdd38e442269c14eae46c85a1

              SHA1

              987a9062ab95baba4f1b44b4aa768e044d1349f7

              SHA256

              0f8804ac739e178a9692a89cc0c6fae77a0371cd275123eac03d8206a5dfb2b0

              SHA512

              f87a30cdaf4b319a2868674cd8fd63e7d148aa68e62b82c7be676a32fb888f35c948e302f15f764759e638a36cd0a5cecc090dd426b5e8a1ddae9462599956bd

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\tqebh-hq.newcfg
              Filesize

              1KB

              MD5

              e4308a22084be6f951aa99648cdbe1c2

              SHA1

              dbef8d6b73e101397816c3ade09d4f156987a53b

              SHA256

              f96bacba602816427d078505dea2b0423bd391313950e8b60258471d7372b446

              SHA512

              8d1aa1380a5623d247fea0d8e0178cc1dbb61141c7dc45c095930a420a904efbf7f80f3febb5411cb8a152ee12e5e667f6466cf33de58dcdf89e0199fd959867

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\user.config
              Filesize

              338B

              MD5

              0a35fbae99f45bc0dccdb777ecfd0436

              SHA1

              65e295fde91f90d55b107680e060895654fe66e4

              SHA256

              19af84c48a15820c94367390d58588ddad8164b0ac4056c258a766c726329550

              SHA512

              db3a0973a373c039603c750f0f196cbf65553cddb83739f1942402eaacbe178a775be87c4b034feb706830ae69d20158c3e3ecad8d5d3febc45146b487c3c42c

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\user.config
              Filesize

              4KB

              MD5

              2b9953aa35aba18fb3eabb468a9b1483

              SHA1

              d169d26388895de3b69854b30652ad3f15d906ba

              SHA256

              92892760b3242f34af5391fb9f8a910c248ffc766d5120a28210d9df162794e2

              SHA512

              0f2acb4300b0d7ddd811ce7a2f611facbe08fbc227f67b35ef4103f88ee9b471437f9d3dd086445afcca4009adb1e0333ca5cab10addcbd6a09cf6a066ebfb81

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\v82tszpe.newcfg
              Filesize

              3KB

              MD5

              55606f105806fab4ba6daa90ff685511

              SHA1

              78744d3187fb58c030a90cc2c21f0c9cf7d68cfb

              SHA256

              db2f53150f1929acdef05be42d143d0aa4c0003e15b6583200a07db7b2783d69

              SHA512

              431617c98d68eb2530ad883d4125f217a2ecfb5ebce819f7c9b2a15132fb1f024c32b721d04722722d39578551f3ab4148cb2f0c4dbf6e1dc5c5706afedfd21c

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\v9owcsx3.newcfg
              Filesize

              4KB

              MD5

              1f1738273ae285c88b84b57d8bfb2356

              SHA1

              e6db912d9f51cdfb5e32930e7e7873c36f271197

              SHA256

              3c585a3689c74afc924fbcbe549a3ad27742e089221d0cf486320a05e6589c93

              SHA512

              0a6087fe324a0470c5ad8aaac09e1e56f10c7ed242d22394bb602cf69ee3ae107492068d3c15eaec2a1f0b2f8d221c6f785d6bef322f28c98ff63db711f3adad

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\vwsilvtz.newcfg
              Filesize

              2KB

              MD5

              f54c3af71e5a6292055e9128cdfe9e35

              SHA1

              a4927c8ca1318caa9ce45ef8254d85d2e06a5fd3

              SHA256

              439243344f1f42c05138674fac46bf45ef55ec691bcd564845f6ac31d5e5eb98

              SHA512

              11bb93abc5b32f3f17d18901507589ae86ecd183f482ae2e62be403ba16dd84d6abf2d8b2ec86cc0d1c3bb82162a90e70a98292f84469c3588717f22e0ba641b

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\xts0vfle.newcfg
              Filesize

              4KB

              MD5

              de3dc57d50efcbeb37e2cd708a8e16ad

              SHA1

              28547cf34a5d2250a35336a607ed0d54915b08fb

              SHA256

              3f13e66a276703f8b823a0379e542bcf1d93dfc2a8958536ff826f9d07c44950

              SHA512

              ddbb8ee4272d01fca852bc90d191ca4a380e756438210d74dc34e2df986b02082ea63582a09ae310bac02f587f146c90b7d352a514949865feea786f3ebc6180

              Download Submit

            • C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.1201\y4vtdto1.newcfg
              Filesize

              2KB

              MD5

              c5b658ebdf4805615109bfe32157f08a

              SHA1

              ea51dc45444c9b8caded05e1d95cacdb6d7f5557

              SHA256

              8feeea7789d9d64042aebad312ba1c6949c318fa8147b5cf3e3558349e8e108a

              SHA512

              25caec0d7babe53def364a6c585ff16e351357794fbee2e8c03aa8869cb47b1a05117d8610d5c45e5451b2535d97855da1de0fa64f6e2eeb7a58a1a123d48823

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zS05EB7A8C\ICSharpCode.SharpZipLib.dll
              Filesize

              208KB

              MD5

              94893afa464938ab2169c8be39d971a7

              SHA1

              4926bef17768e8e0e05bbd10d2321e475ab491a7

              SHA256

              a02c4fae529a5b48a28236bf15cd54ed3f7a613210e40970f3cca82f0f68075e

              SHA512

              fa5214c5190e5fe6b347504e8c8817f52ad2549254e985d13d71798e820c6f2ba956585afa0240fb6806a3e74816c869bfac7d9b9564136825abc9a57b4e125f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zS05EB7A8C\Newtonsoft.Json.dll
              Filesize

              428KB

              MD5

              3a4649717bdaf9e86dc93cfbcf8a4baa

              SHA1

              d1a1ecd90691fbd768ec9a7f2ebc89340b447e84

              SHA256

              f2d262cd645b7888b88ffa0e799e3e77c982bd2b09e68ad625b218d1435b6f6b

              SHA512

              c40b8f51120fde698fae9907c335e9c7f9d957e073da88c2ea5dbaaa7bf609a44bdedf104092f442f6172dbef3693ee5c1b0ec683b3125f13c95b9e48b10f181

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zS05EB7A8C\WebCompanionInstaller.exe
              Filesize

              454KB

              MD5

              36a9001422c3e6532893e9a2f43658eb

              SHA1

              5189fab41f5d43634367bfca2729ad9b6f36ba20

              SHA256

              7f86c7e4a65835f9c12d2425d611902d23b15626960a19d2da03ec511b6a7b9c

              SHA512

              1d60a35e2f64e70b6489a13426f0f5952d3e93e79051fa37a4a5bc8a89614c5614a07de25715670c6618db27b7682c7b4589c356418716a3aae764568bf3371e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7zS05EB7A8C\WebCompanionInstaller.exe.config
              Filesize

              1KB

              MD5

              025f5c132b47e5a5723d982bd652d5bc

              SHA1

              10460431043d2400166da8f464678d733f2e4f84

              SHA256

              6309de6d3c423af1dc0c47869793c37a108fa32da063d3f5bbb96927f93b4c25

              SHA512

              a72ad7f040acde97aac0f13f502bdfa395864497d1db9c012549377be9201252a59d5b8ce2e3bffb634e75efa6e594e6150ade60e2547760306cba8c568aa090

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\8DC9.tmp.exe
              Filesize

              149KB

              MD5

              060404f288040959694844afbd102966

              SHA1

              e0525e9ef6713fd7f269a669335ce3ddaab4b6a1

              SHA256

              40517e822f3442a2f389a50e905f40a6a2c4930077c865e3ea7b1929405f760a

              SHA512

              ddf8c53e1e1888084fa5422f297cc3ba9d97f7576c36f6b633ce67ca789127f7e259e9fb374fcbced66f883dadde0717d81ecce9776770bf07d8cf3b94b1a43f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe
              Filesize

              551KB

              MD5

              f6cafe8321409eb7e885ef119cc161ce

              SHA1

              d6f1b4181c2e982fefe32808c6aff556f4e5d2ba

              SHA256

              6d2a2227681cf096a5783131a7a744da178fa103dc41dbdf4cbdd49b9909b60f

              SHA512

              2b9c02ebc8cddc478958ee7bdc3c9e3850940473737096b0940125f2f27acaa0bff405dbb19312a0966129de9351fd4d638b83ce153cf1769e4a6c6f26ba242e

              Download Submit

            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
              Filesize

              466B

              MD5

              6ce8022df40a931c92eae601fac63070

              SHA1

              4a86ac3b0576a4e0e697666f04fbf39a8f5f6bfc

              SHA256

              1b06f9ee20d17fe6960eff6a37c75722d1730eca8159561142b584aebe3b40f4

              SHA512

              9d085d14549c16d75d9f08e3d69983bfcba9e8c662aa334896e964b84d9df0f66345cb3a960744532306d31f0327ec3cb99e019118f463a4bc4df1cdc9a34d6d

              Download Submit

            • memory/4164-693-0x0000000073060000-0x0000000073611000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4164-72-0x0000000073061000-0x0000000073062000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4164-179-0x0000000073060000-0x0000000073611000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4164-75-0x0000000073060000-0x0000000073611000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4164-180-0x0000000073060000-0x0000000073611000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4164-74-0x0000000073060000-0x0000000073611000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/4688-983-0x00000000661C0000-0x00000000661E2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4688-877-0x000000000FC60000-0x000000000FC72000-memory.dmp

              Filesize

              72KB

              Download

            • memory/4688-878-0x0000000073EB0000-0x0000000073EC2000-memory.dmp

              Filesize

              72KB

              Download

            • memory/5084-820-0x000000001ACE0000-0x000000001AE16000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/5084-819-0x000000001A5D0000-0x000000001A9A4000-memory.dmp

              Filesize

              3.8MB

              Download

            • memory/5276-513-0x000000000D630000-0x000000000D642000-memory.dmp

              Filesize

              72KB

              Download

            • memory/5276-514-0x0000000070880000-0x0000000070892000-memory.dmp

              Filesize

              72KB

              Download

            • memory/5276-675-0x00000000661C0000-0x00000000661E2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/6076-553-0x000000001D860000-0x000000001D8D0000-memory.dmp

              Filesize

              448KB

              Download

            • memory/6076-532-0x000000001AB90000-0x000000001ABB0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/6076-533-0x000000001ABD0000-0x000000001ABD8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/6076-534-0x000000001AC30000-0x000000001AC80000-memory.dmp

              Filesize

              320KB

              Download

            • memory/6076-543-0x000000001C0C0000-0x000000001C67A000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/6076-570-0x000000001D960000-0x000000001D9E4000-memory.dmp

              Filesize

              528KB

              Download

            • memory/6076-571-0x000000001DA80000-0x000000001DB0E000-memory.dmp

              Filesize

              568KB

              Download

            • memory/6076-546-0x000000001C7F0000-0x000000001C852000-memory.dmp

              Filesize

              392KB

              Download

            • memory/6076-544-0x000000001B290000-0x000000001B2A0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/6076-552-0x000000001D350000-0x000000001D860000-memory.dmp

              Filesize

              5.1MB

              Download

            • memory/6076-551-0x000000001CD50000-0x000000001CE40000-memory.dmp

              Filesize

              960KB

              Download

            • memory/6076-550-0x000000001CD00000-0x000000001CD49000-memory.dmp

              Filesize

              292KB

              Download

            • memory/6076-545-0x000000001C780000-0x000000001C79E000-memory.dmp

              Filesize

              120KB

              Download