70a10e559c27092a2f22db963989eb8f6c28b846b67b417b4d97a13d462dc56e

Analysis

user interaction
yes
max time kernel
151s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 532KB
Sample260818-vrt18sad67
SHA256 70a10e559c27092a2f22db963989eb8f6c28b846b67b417b4d97a13d462dc56e
MD5 753bccd9e5bb39cf64d34bbb35bd65b9
SHA1 3d373a3c7f04bb13de6e9b4b563172bc377fe2f1
SHA512 52d822f2a19bd11e4b9a6c517badfd9c26208f32f84f515fe92e8434c8ec57cbdd67c9e399bcde72ede30d9085d5d3607b4b55efb9c9d3b34e80b541e0511b4c
SSDEEP 12288:NG5knZfFKeTTOydwORmV42Y5RBHtf8WS8sejGxUeRx7/bB:NG50ZfFKMTRCa0gDS8geePB
TLSH
T17EC4F1127DE089B5D5820431CC745FA6A2B6FE560A20887773997E3E7F7F642C232A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Users\\Admin\\AppData\\Roaming\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Users\\Admin\\AppData\\Roaming\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
2132	WebCompanion-Installer.exe
4348	WebCompanion.exe
2944	WebCompanion.exe

Loads dropped DLL 64 IoCs

pid	Process
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2784	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCompanion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCompanion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCompanion-Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1628	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WebCompanion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WebCompanion.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315468997722272"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
2132	WebCompanion-Installer.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
4348	WebCompanion.exe
1352	chrome.exe
1352	chrome.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
2944	WebCompanion.exe
1352	chrome.exe
1352	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	WebCompanion-Installer.exe
Token: SeDebugPrivilege	4348	WebCompanion.exe
Token: SeDebugPrivilege	2944	WebCompanion.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
2944	WebCompanion.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
2944	WebCompanion.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 2132	5404	Setup.exe	90
PID 2132 wrote to memory of 2784	2132	WebCompanion-Installer.exe	92
PID 2784 wrote to memory of 4844	2784	cmd.exe	94
PID 2132 wrote to memory of 4348	2132	WebCompanion-Installer.exe	95
PID 2132 wrote to memory of 2944	2132	WebCompanion-Installer.exe	98
PID 2132 wrote to memory of 1352	2132	WebCompanion-Installer.exe	99
PID 1352 wrote to memory of 4660	1352	chrome.exe	100
PID 1352 wrote to memory of 1628	1352	chrome.exe	102
PID 1352 wrote to memory of 5160	1352	chrome.exe	103
PID 1352 wrote to memory of 5160	1352	chrome.exe	103
PID 1352 wrote to memory of 3576	1352	chrome.exe	104
PID 1352 wrote to memory of 3576	1352	chrome.exe	104
PID 1352 wrote to memory of 1228	1352	chrome.exe	105
PID 1352 wrote to memory of 1228	1352	chrome.exe	105
PID 1352 wrote to memory of 624	1352	chrome.exe	106
PID 1352 wrote to memory of 624	1352	chrome.exe	106
PID 1352 wrote to memory of 4540	1352	chrome.exe	107
PID 1352 wrote to memory of 4540	1352	chrome.exe	107
PID 1352 wrote to memory of 2044	1352	chrome.exe	108
PID 1352 wrote to memory of 4832	1352	chrome.exe	109
PID 1352 wrote to memory of 4832	1352	chrome.exe	109
PID 1352 wrote to memory of 4416	1352	chrome.exe	110
PID 1352 wrote to memory of 4416	1352	chrome.exe	110
PID 1352 wrote to memory of 5472	1352	chrome.exe	119
PID 1352 wrote to memory of 2088	1352	chrome.exe	114
PID 1352 wrote to memory of 5472	1352	chrome.exe	119
PID 1352 wrote to memory of 2088	1352	chrome.exe	114
PID 1352 wrote to memory of 2808	1352	chrome.exe	115
PID 1352 wrote to memory of 2808	1352	chrome.exe	115
PID 1352 wrote to memory of 1372	1352	chrome.exe	116
PID 1352 wrote to memory of 1372	1352	chrome.exe	116
PID 1352 wrote to memory of 5996	1352	chrome.exe	118
PID 1352 wrote to memory of 5996	1352	chrome.exe	118
PID 1352 wrote to memory of 4932	1352	chrome.exe	117
PID 1352 wrote to memory of 4932	1352	chrome.exe	117
PID 1352 wrote to memory of 4120	1352	chrome.exe	121
PID 1352 wrote to memory of 804	1352	chrome.exe	122
PID 1352 wrote to memory of 4120	1352	chrome.exe	121
PID 1352 wrote to memory of 804	1352	chrome.exe	122
PID 1352 wrote to memory of 2424	1352	chrome.exe	123
PID 1352 wrote to memory of 2424	1352	chrome.exe	123
PID 1352 wrote to memory of 6028	1352	chrome.exe	124
PID 1352 wrote to memory of 1428	1352	chrome.exe	125
PID 1352 wrote to memory of 6028	1352	chrome.exe	124
PID 1352 wrote to memory of 1428	1352	chrome.exe	125
PID 1352 wrote to memory of 5936	1352	chrome.exe	128
PID 1352 wrote to memory of 4712	1352	chrome.exe	129
PID 1352 wrote to memory of 3152	1352	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Users\Admin\AppData\Local\Temp\7zSC15A98C9\WebCompanion-Installer.exe
  .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20398341592 --version=13.900.0.1080
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\SysWOW64\netsh.exe
      netsh http add urlacl url=http://+:9007/ user=Everyone
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4844
- - C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
    "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
    "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN240402&campaign=20398341592&
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9c9ffc728,0x7ff9c9ffc734,0x7ff9c9ffc740
      4⤵
      PID:4660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1376,i,17318847766878207948,2355000521233517738,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,721384680619714749,10844201483400651956,262144 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:5160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,1119228624654073498,1490521316718901191,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
      4⤵
      PID:3576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,14100163833196174572,14665088340601285157,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:1228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,6590308303856338343,14509146929157124416,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,5006980141300237566,12254912720122901769,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,15453844163564718796,14250278098641023473,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5512,i,12894570532670655446,8899754788864720239,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:4832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5600,i,9701259732485831931,2072918982200075461,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,5845559636385251056,15970843310151458287,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5652,i,7173332617990950831,4553270001892419018,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5884,i,16387556456980365937,8105502812030690276,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
      4⤵
      PID:2808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5492,i,10644940418268543021,5687228049291319038,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5648,i,4161783694433090132,179632435402763555,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,8611081767032472592,6360407813247746484,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4808,i,10586178776659727035,15110244820594598344,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,8635717103255612939,7084802347792077768,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6060,i,15094870627184737512,14815386590779081729,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:2424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5912,i,7434288775193085399,12069513912657292400,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
      4⤵
      PID:6028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4668,i,3321188030601683300,12794731014356420284,2097152 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3216,i,15846064504593270683,7827262163460913521,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:5936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,6505715135029240975,14828912095122215928,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,18282068722421724300,8077749311460060294,524288 --field-trial-handle=2392,i,13497244432440381263,15586762082742541246,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5472

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 a57e781ca2d745fb58f44d24430f1ae1e276143a9bc4465d2ca1d10908d85499
MD5 8535821d429f93565ffa99ec261b6f09
SHA1 22a142d6563be544033a871d7467625283eb7973
SHA512 6ae14d24fb7fc1f5a1d807689775cb30b17b28d8d6b8b7ee6cb0d1aef3e791d0414b3a36a6c1c850a67db2ddbb7f0f44ae12e5ec2b6f227d1c47bec22ab6eb43
TLSH
T19AE0950155DC216BCF2123310D666C55335A176708347777A11C0CCCDCB3DF50101249
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1054e59c75d5a0727f84b3d8238804551760bdef4fbf390eada3106da1d7bd4e
MD5 bcf4de93e58f97738d8364391679981d
SHA1 cff2cf9929bd6ab0a8e298b1a7eb400050fb5baf
SHA512 90d6bc69483a48977254df5c8ab4331a53cf9e70b112cfe96a63f9d741000f82eade070a3759748f5d7327474b516795bf3d5a9c6dd12e8899ed42e88b9a3824
SSDEEP 96:DZJtIaEMGtzI2fCoYOWiPSibqO8Ca13nOVK:DZJtIaEMGtzI2fCoYOWiKWqO8Ca13OVK
TLSH
T1D1A19CF7C3E4893D991155F4AB156E1BCF990A14533C386A88E86F4B93E7CE0E210A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 33dbd9618119de1c672b7468ca85a28e42ead6865a1817076786e54b78f53b0b
MD5 ddce91ee360d36599f35af4c0b8929b1
SHA1 6c1f5e872a5af45a42db86cd7dd356b8a9243bdb
SHA512 34c9d20d13a46d7ca72d5aa41197a81286b92fd98da4bfe565d7ab3ebcf0009655df923b1f7a3e71abbd78903aa23d7c62d62ef6c4805670562d627a63831a4e
SSDEEP 192:vR12+Z6mv7MsAPRp2eJ9gHsb+WNnspluN2l12vvtukwjVyIsnAUgR:vR12sjQNXHqw+G2v2vvtulR
TLSH
T11932A56EBA2579776DDBD229FD213753E7F5102221912E84EBFC892C14E76CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2fdcf772f3a8d9837cda04ec5aa1b01b8235af44044cc286fd149a6e5d39de90
MD5 99b943751545f4bd6a7ccd61a46564d1
SHA1 98b33d35a105b9d879c1471af8bcf34fc648cbfd
SHA512 7ef5709dd99b7d298e1232cdd0a00ab573d3af996f6a2158c12ba6a8f0db8a1f216846054c65425635233ab4cd035a38a70176a9c5962a5e9e77b87cce6737af
SSDEEP 192:vRK2+Z6mv7MvpPRpVeJ9gHsb+WNnsplZ+eU12vvtukw7VyIsnAUgE:vRK2sjQJX8qw+Sec2vvtudE
TLSH
T1FC42D76EBD2479776DDAD219FD617B53E7F5202221912E84EBFC892C14EB6CC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9aeb937454258fe24809981a7062e9d83f8d191aec05ca0a6008e1d4726302b6
MD5 f52250baa333796693ded41415f69e8a
SHA1 dc3b140098e9d22bca2d9bf15f1de84cd7d9722c
SHA512 e592eeb5103bc66d5b21329ecf62ee1a298aed71c918b8b3f6c88cb3ff997dd93e32b23dfc8374134189ec69cff3393451ec7f3283ae9a6d987633ad37d33761
SSDEEP 192:vR12+Z6mv7MvAPRp2eJ9gHsb+WNnspluN2l12vvtukwjVyIsnAUge:vR12sjQ6XHqw+G2v2vvtule
TLSH
T12C42B56EBE24797B6DDBD219FD617653E7F5102221912E84EBFC892C14EB6CC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 01080981933d9a03d7fe5944d03c2733dc7b22d69f8c3a625ad18a1b4a23a96f
MD5 5b5a23ab9d84f4dab59b188cf8fd0559
SHA1 4f34f337edc1a76e6ca718c7db392af0a65e858a
SHA512 7e9285353377f4745dacae39ad4a3d413e9fda58104d91be6257ab54f6af041cfad484b13290e0ac85fa35fbea554294fed5aa1b54b32d832b1ba3abffb70be1
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9ojIAl53In:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllC+
TLSH
T1D032E827A44D9A7B0FD8E54DDC136F8B6DF5419272780D28A2FB9C0803A97CE114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 bda5632a7cf1614aa431e5d11d06c49e81f453c59fd5d36a645ad8d578d085d2
MD5 05cf97f1242859e6726ccc8ee679fa9c
SHA1 68dd44b6d94cb3b77e5f9f3d4e912590c66c3492
SHA512 1590141362fd67bbc6b8a25de417e183b01602f7c3d1b73115a7f5af9eb12c68564aea95ff70fea28caa638f5bbd2754bcc99e88be1a9ae40b0418927fbdbe76
TLSH
T176A0026041D01C99DF20937064611542A2658C265951730394D629D4DC7B7C2C505510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e77434eb4cfc75f94f8594aa76af3a9d0966e936409eb3cae807cf0ded861aa6
MD5 1966745ab527e71d327654d4cb9d2f74
SHA1 21dcec769a5beb10d4d39d45f4bbe83f13711d0d
SHA512 28df727c7ade2fa71ec5ed73f4a3819e95240d87de4d9cd3509f464ccc62aa968e217bec1fb9602e224e98b82ba2b837717b31c784018c4ecee6786f2ec0d7f7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 115bf7cbf5f3022f4868ddafb5a1c54208fa6254d63d55c6ef5ecb65ab6182a5
MD5 bc11aa91098ad9b93ad479b1e8a361ad
SHA1 df78d5d90f509c81f2485b093b1951c4f3df3fab
SHA512 399ba8eb236519d17a76b646e61628024e562365c3800794c8a03262b84b83b41c817b06fc5c07be4680d624fe983edbb8c63c2e1d64a3ab85101a9543f7cd93
SSDEEP 3072:YXQ1g+SAIEUe5MzG3WZs84b9np5e/0bR6E8NtiYSuevK9IF9:gQJHIsyzG3WZsjb9npQ/hTIpm9O
TLSH
T1B7D302B26CF8BFB346E50E4991266D13CC4DC0BB9A18714972E56E1A56EF7DE8383031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 67ab517225e8bb82818f18c5db33fdd9c9bc35880b8e03f8927745ae9097fd8f
MD5 977a15e35870f3c067ecf5e0d0c8db50
SHA1 7a45f6bfddffc092d030b920abaa1e6e9cdb14f7
SHA512 35210137736577366ee11fd652a30faa5f7770e8fc70daed66b420daf6d06a8b041c699a921092225f1f9264b57652030f25d273cf89ba0095bf3c001e3157e0
SSDEEP 3072:xUQ1g+SAIEUe5MzG3WZs84b9np5e/0bR6E8NtiYSuevK9IF9:SQJHIsyzG3WZsjb9npQ/hTIpm9O
TLSH
T175D312A2ACF8BF7346E50B4A91766C13C90A8077991D704973E56E2B56FF7DA8383031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 fc82df5fbc28a51cf7babb090cbe73ccee4f0b288db71f61689811c31479fe29
MD5 7510c325a745c8f7ce7e4ad9ec888128
SHA1 227582da0b2c87aa52bfdb5f26a4cdc412acda22
SHA512 d722a4cc01aae918da5193f448c02ca87c9869f5ac65c80b04c3ca16ea446df47c3a0e24816104824568c0d2400647ceb710da3fb318e2e9de809a835054b8f9
SSDEEP 3072:YUQ1g+SAIEUe5MzG3WZs84b9np5e/0bR6E8NtiYSuevK9IF9:3QJHIsyzG3WZsjb9npQ/hTIpm9O
TLSH
T1DAD312A26CF8BF7346E50B4A91766C13C90A8076991D704973E56E2B56FF7DE8383031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 51f39e8fffb51f51568dae96e376b58ed9fd5ae6d2d7c40c437ce5fd32e7c207
MD5 1d6f445b90dd199408177d6ef136aebe
SHA1 62df01124f3f834e8ad8a8f7c471172620284e30
SHA512 a3257804f2b814cb368477899f18caf1d64b9f05390cf9e777c713b253b03af9b1cfd3d47bfadf6493ca37244d847881899fcd585a8eab919b835115d6d21fb9
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5WRA6DTB6gGyvXNQ/rbfyYv4a:RC0G4DkG/FZ9kGDUDoNMAQ/rbfX
TLSH
T129A10971A47D9EB76972C548F5923A43DEA4A0AFA611EF44DEDC0E0C11FB1ED0382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webcompanion.log

Path C:\Users\Admin\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
Size 2KB
SHA256 ee4b01c4bb620cff00f9bc554bda26057b04ded91002ae77af247159b38b43b3
MD5 6d9ff484c34dc9866f8adfdddc7895ad
SHA1 7c492c9ee815edd438a1348d61936c4e4610e0be
SHA512 094dbdf0a05c4184bac72fa8492089e8c326e6156bca4f695d31b8233e076cd539674501a097e68a90812a5ba87c4b371adc437418ac8e7513c4c77fe2e41a8a
TLSH
T11E513D6CFC45747B89F6F1D55F41EFF9FA9811168EB4009A560A8AC081C3842EF2F5B9
MD5 SHA1 SHA512 TLSH

Submit Download

webcompanion.log

Path C:\Users\Admin\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
Size 4KB
SHA256 7791d9d8fb156761c1457fa7eb739132877322cfd72a273f508b467319b28421
MD5 988b05f3d5e152bf409dbfdc5d9869c8
SHA1 34df785a242791c51d91bf0dfaba3070091a9a41
SHA512 a9dfd16e089e80ca6f157e88a1c2c3c7d68fcc9834289ee0b5a172b82c21ec013261cc43196fc4cd2e605e554f25bc9c4cb4306a895fbd3a5b3c65b96296a11d
SSDEEP 96:EPsBKlaBQmBQmGBQmBQmBQmBQmkkq2FrBBQmBQmGBQmBQmBQmBQmkkq2Fr1:kClKllljrrlKllljr1
TLSH
T10DA13A68FC45743B89F7B1D55E81EFF9FA9811168EB0009A920A8AC08187842DF2F1B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

403fkw3c.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\403fkw3c.newcfg
Size 1KB
SHA256 53a49dbc5dff6b012135b6ef773f5e02ac801d7d28627af3513b7df755e09ae1
MD5 eea7d0a0eec7d751247568b895f5d231
SHA1 d278b7ba00671a8f5766adc2b22988d04edc6e76
SHA512 57dd7bb10ab6f7168154115b2911aa73818e47ec619363b3b295ee2f0520eeaee33d58e9a2fc40ecd11875f04f9f0280c1d3a2c7f6df089ccdad761d1e2f673b
TLSH
T10431280CB1C1DE9A51766A35E73142D1EDE006635176B0F0B8ED22635F71CDA4AE33A5
MD5 SHA1 SHA512 TLSH

Submit Download

chslk5g3.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\chslk5g3.newcfg
Size 1KB
SHA256 54b3291d8a656fe0748790cd9bad60d306dddfcbc528942ef94ad30859c2505d
MD5 e18d2ff5b0720c29364aa54e2be87ebe
SHA1 9a698c79e2b4375a3e14861620a20e3b59e6488c
SHA512 6d87c7455d2bd594e01faad1e053f7a7b1acb2e329e6d7f3b1e5511f3c7e96f7d00383fe2a50b2f96d49634c22470a8b6dfa820a58a3df34c5967b2882551b72
TLSH
T18F215B0CB1C19E9B51766631E33542C1EDA006635177A0F0B8ED21635F72CDA0AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

erjs0qop.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\erjs0qop.newcfg
Size 853B
SHA256 ae5a1ed92d53e6fada94ce484be31f0e0d90456c5a629aa300761940bf3f140d
MD5 1238ded203b11df1ef10c1da87efd006
SHA1 4d962f92d91c4256f42592cf4bff19fb36c323d0
SHA512 db02f552941d735a53731e59b1971032e5c05f686cf8bed0c2fd0a6506390c33d13ecff6cc633c0f3f3333460c61ce607d9b46b10974193c883bad1c49543d40
TLSH
T157016D0CB1C09E9B51766632E33442C1EDA016635177A0F0B9ED22735F728DA1AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

f3isas1b.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\f3isas1b.newcfg
Size 2KB
SHA256 b4e15ee9d84ae090ae396da7fc3106d674b1078af9359b0fbd4d056471776e93
MD5 769838ba6361a78b1b4513e819027543
SHA1 c6452abd3066b5d9126dc18558627b4fd7e16d8c
SHA512 009fc17ec0e9e7032fa75768e9117c86badeee051b020f06a31b1d88e312d3424ffae390c4e7d7f2aeff8c68b8e7f357907bd5ebcd7b73d8f53328e78339e2fd
TLSH
T1AA51380CB1C1DFAA1176AA35E73142D1EDA046631176B0F078ED31636F71CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

fpzfotoh.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\fpzfotoh.newcfg
Size 454B
SHA256 f305911e737d7ab3a8a59ee6b4ac1af25ae0da0b808acd8272fe580265bc9325
MD5 a962818ff27052b007bddfac09a8d96d
SHA1 a6f9c9e1cbfebc1622387366444a324bef58ed24
SHA512 e77a77033621641681318350ab889f21712d2451d501149da4c4e6f17bb01e9141f7144da511a323e657e0ebec00f695805e3467f7874137f267e3ca24c7bd6e
TLSH
T18DF04F0DA1C05E9B92762B31E7348285FEF02A53807760B0B5ED26734F328D91AD73B2
MD5 SHA1 SHA512 TLSH

Submit Download

hokty2kd.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\hokty2kd.newcfg
Size 2KB
SHA256 cfb01ef5f232fe2311bb4eedeae5a7f736e6f4b290ac23a46be6e162cccffe30
MD5 d97a46b12f7ef8a36fcec4329738dec0
SHA1 9bbf50aabd9480755ff8fd4fc5bb25d0222fdc16
SHA512 f82c8a3d10a8e933f59046d69c124b687097255fdf1a53e91fa1b7bcee77fc7d8d70887bb86151862c1481ff877f06d220c3cb31eb90e84a96797f4e0474da18
TLSH
T14F512A0CB1C1DFAA51766A35E73142D1EDA006631176B0F078ED31636F71CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

i5vcx4rj.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\i5vcx4rj.newcfg
Size 2KB
SHA256 a0198393d16ba99229516ad29504c113c7f1e62db52aa242df7f210086671772
MD5 44ca4a15cbf41e31df6a09660eba7c02
SHA1 ae70ff7d17ae6ab2be21d833eb6892d8ccab21d8
SHA512 f86cbd35a2526c6d8a85fe4de4be821df7ffda6dd87ace5f58c637d2cf7e6f843bce9b01d6b590e307eb04fd4203fb97d6c95c38aaba8c87e1a7afc43afa2d61
TLSH
T18051290CB1C1DEAA517A6635E73142D1EDA046631176B0F078EE21636F70CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

lxe0ivpr.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\lxe0ivpr.newcfg
Size 2KB
SHA256 d02ab38229eb0a2bb85d072f0f11afbfc78eb9fc34570f0e0bb600ac93fa7a84
MD5 7a438022b881b954badd65c60ab8cf34
SHA1 fe8179e4b24b863fc4f6c43609355e8fbbb82312
SHA512 ae308497610c9a46405150207017c5bfc0ee4df5be23bb4552dc37ffb75fd52df513dde81fd714cd7dcd5cb6c35ae135bbea6dbab6a3ff59a8199e56034aa22f
TLSH
T17941270CB1C1DEAA51766A35E73142D1EDA00A631176B0F078EE22635F71CDA4EE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

pbbc1rvc.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\pbbc1rvc.newcfg
Size 1KB
SHA256 1e5f5c558012ee947924bda393745052f1fd74c2a5af0fcfc7e0eb644b1a5d0d
MD5 eb9af398fe1e7db322a96e08dbbb905c
SHA1 31ed76a102cf00e9f5097b452fa33ca2deac9569
SHA512 5e93016f5186ded7b7ee1188cf21d3c117621da568618ced3ed1ada6e542f24a742bf15a54028df794d9fd49f29f94676ce86cec572a293611844389feba3f2f
TLSH
T1A8215B0CB1C19F9A51766635E33542D1EDA006635177A0F0B8ED21635F71CDA4AE33B5
MD5 SHA1 SHA512 TLSH

Submit Download

r45gv1wk.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\r45gv1wk.newcfg
Size 2KB
SHA256 0a47242cf5349bee6213349ec40969525925f240f975ba667cb2acb18802d55b
MD5 fc843d19cb97ff928f5900bc956482a8
SHA1 1e21464e5d31489ffd740d6df39e59a2abd8662a
SHA512 65e884f08344d4d4bb7ebeb064950ce66abf13fc804464dbf6d04fd80661fc7ad0340b80673b8528279afab147a156ba32015fd359602fc3b23a098b53318f06
TLSH
T1CC41260CB1C1DEAA517A6A35E73142D1EDE006631177B0F078EE22635F71CDA4AE33A9
MD5 SHA1 SHA512 TLSH

Submit Download

rviaexnj.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\rviaexnj.newcfg
Size 715B
SHA256 072484d486bcf2d3be033c33faa038ace07a405d20b86c5279d46cb8f5113f8d
MD5 a79be6c992c905622c348417d635f411
SHA1 5fdeef5fa3308a8272e8f5a3715d73f46871789d
SHA512 c439769264144c944773d491a680a86fee6f397cc83d8ab7688bff48821a1f115a9fb844828b6584c642d408975a5b5dce1c60aa5f82fa0da0a539ce2c195335
TLSH
T133011D0CA1C09E9B51766631E73542C1EDA016639177A0F0B9ED22735F728DA1AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

tpqdgg0t.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\tpqdgg0t.newcfg
Size 2KB
SHA256 4aae75a59edc1c93152819d56dafc4182f8acf80287a64f53922cc18551ebc7b
MD5 a67dd2a465c312188a628443e8c0ab8f
SHA1 b9e89746e45c4015678a9c42f3c8b9b6c9201740
SHA512 f78fe569fa5d4690d09c2cd1942d8c082bee4b462b587499ee504c5cc94fb02bae34b6fe2652e3855180ea75741bf8b82f5370979dec907e4561eccc7a126176
TLSH
T14651290CB1C1DEAA51766A35E73142D1EDA006631176B0F078ED31635F71CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\user.config
Size 2KB
SHA256 5db26b2a83aef1081d50c91c6518f1477af4b01880ea68c44ddf4379421043a6
MD5 4bcc69d4ba93297d8c0433afc709177c
SHA1 c5d2f4246bd8ca6054dfe6c8353cee6eed1759bc
SHA512 e5aead716803a41b2ad4c96e82cd2afc302e33db402ee57e0917f7294063094ae86645aa8dca837ba5da90c41fe8b5ece7809ce5a809a837ecf1075d99a195d7
TLSH
T14851390CB1C1DFAA517A6635E73142D1EDA046631176B0F078ED31636F70CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\user.config
Size 322B
SHA256 bf2eece5399c0e10192f4d8ac7328c4001b5c6e71ca4d5f6adfaa2bc7d087159
MD5 1127efb8926fe4bc2e355897751cec2b
SHA1 3845991c80629d93c14c8e007746d5920c43ba97
SHA512 a91a79c291c86dec3d9b45d2ccaac429aabddb530f3bf2f3ce4e7f5a88e4553a644cef998bfb9ccf02d0a8d4fdcbb15d3d3d5865b3fd0720218e80edee508823
TLSH
T10EE05E0990800E9B92722B22D7248685FEB02A93C07361B0B67D27734F324D52FD73B2
MD5 SHA1 SHA512 TLSH

Submit Download

v2p0gvsx.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\v2p0gvsx.newcfg
Size 1KB
SHA256 88646e789e0db2919581e6d0c4ac221196732e3605f26abd02d8cd50ef60bfa5
MD5 3bf14fceda19bfcee775ab991d560b3a
SHA1 af85550aedb77241da29615e47a6b1e847adcbbe
SHA512 a061529a1521d1bff5022b16f2b69c4910e281280063000a565239d4b4854150fd1ff66e7953279a67ed2802b857481104f3ec42b247ec890e53fcb4fc75cdf4
TLSH
T14D217C0CB1C09E9B51766631E33442C1EDA006634177A0F0B8EE21635F71CDA1AE33B6
MD5 SHA1 SHA512 TLSH

Submit Download

xgeyqdzw.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\xgeyqdzw.newcfg
Size 1KB
SHA256 84e41c5a96e06de962c8be1ba59958f5f51e75fd85039f2b17172d6db4ca575f
MD5 5429dafb5865ad4f452f206f799dd471
SHA1 c30be41e8744258d98d536bb134c1c15d6f92f36
SHA512 a2ab17d3380de41c5381082ab765dc1e0098b6f1d15ec29662b72ba0454259899c99609e9d304dc06f5a20f204a2f563947ee550df541396c09f58974324eb92
TLSH
T19A31260CB1C1DE9A517A6A35E73142D1EDE006635176A0F0B8EE22635F71C9A4AE33A9
MD5 SHA1 SHA512 TLSH

Submit Download

xgy2awn1.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\xgy2awn1.newcfg
Size 586B
SHA256 f7e882cf84dc515ff9464cf2cbff665cc3f7b65bbf0511af3071b565ff41b016
MD5 e11fc9e92ff2c1e95b6d1c703e8ced2a
SHA1 7966d123ca0bab5557f1e9a0b8d5bfe8721860ab
SHA512 2e7405f327f1ae59fce5b80ca927a784cb4d4a24d4c6a30ffec916343aaa2cb3cbfc85c72dbff5f4127bad4327cc68ed118003d182709a77219abc6d30dcbf7c
TLSH
T124F0120CA1C05E9B51765731D73442C5EDA01653807760B0B5ED22734F728D51AD33B6
MD5 SHA1 SHA512 TLSH

Submit Download

zdet5pni.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\13.900.0.1080\zdet5pni.newcfg
Size 2KB
SHA256 c42d55adbdaaec57ed92b2c255d8ea59635299edbc7d2470186a4984e4538183
MD5 13533949c36152c94755edd99ddf87c6
SHA1 abed3f042b39fe9f36d0197c79c80b212719752c
SHA512 cc7241e48137852e1f62d41cede02ef40474d586594b92797550a3b0efd858f9804765760f4670f5091afcdcb584b1ddca77ab8f0c1298d934c9c5f3e552b1ab
TLSH
T14351290CB1C1DFAA5176AA35E73142D1EDA006631176B0F078ED31636F71CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

ICSharpCode.SharpZipLib.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC15A98C9\ICSharpCode.SharpZipLib.dll
Size 208KB
SHA256 56fdfd148f0d60805b2873a5a49739909001d11789b75dab2b0ea8e55bc60913
MD5 0cfe19791546a96c6699657a94604596
SHA1 5d1a1b74cca9f74fffebcb583661c02e4ca626dd
SHA512 586cc695a2c3c03008d0a1032c221cd3384b5f4363e83c9d903753fb1dad65b340bc8cd0659f7f891a641f8bd7535c9b889219842045854aa98cd380f0fe4aa3
SSDEEP 3072:LK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Q:Ge9OAQsFtJrGPBnmIRZUL
TLSH
T145243724A3EC4B1BF5AE4B78D0745461C7F0BA92B76EE79E8E8084EE0C577909D10363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC15A98C9\Newtonsoft.Json.dll
Size 428KB
SHA256 4f0ec6439b24652f16df066f4a38b64518b5a874080eda63de45968545830f67
MD5 461c476f474a5f13d2ea9344ae6f70f6
SHA1 8f74702b99f08277d4514c63956e2e69e8090073
SHA512 e69080c205cd82ea2c056fa1328bbec4c03ca3fdc3ee381c4fb44cb356247be5fe4b8add53036dcb19cac2c6d59b8e02f81932320ea534b5ba50db80a0647017
SSDEEP 6144:fHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonYy:fHerIacuKUtOkESbKQrvB5+qy
TLSH
T1F3945B11A7FC8725EBFE2F31A0701A255BF1F806A67ADB9E5E40A5EB1C5774088407B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion-Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC15A98C9\WebCompanion-Installer.exe
Size 428KB
SHA256 2f86eb0d3902a11da1f534d9734dabae37d33e2c57b03f968198a1cfc2e652a9
MD5 a27f9713db1688d03d2082bfa1827803
SHA1 b8df4649659003609419d052757166499d2322e8
SHA512 f952c6792f10cb60ca3ecc00b317c33aadb65c8471d106171660ec0fcb0603c8d18b8ad2a90aacda6581d342647290099af0ed0fdd897edb390d5bf9209ea905
SSDEEP 6144:p0CMChRMg/ZytotgM7/J/NMFkl619WTRIlY57pMF9v2aiSVRlY/8a:CGhGI1Wo/J1l619WQY57pMfi8a
TLSH
T11C947C0027E80A39E1FF5B38E07458114B7B7D47A691E7AF16857DAE7A333028960B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion-Installer.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zSC15A98C9\WebCompanion-Installer.exe.config
Size 2KB
SHA256 ea7747d876307b0022f055c311c4f8f8112fdde380e0848fd35508c00edf8e7a
MD5 e3d3aa100b93504676414b9268dfbad4
SHA1 a7d1e59c9d8c48dfe259d2973c13b0e2965e67aa
SHA512 9470e0b4784ce3aa94248ddbd9c17bca988b6a680754511cbe1f1c368270f6d18c75ad1ea0f3a438ca5bb1a12e55e8745f68f2ebc9f78c68b373a6541ac9efbe
TLSH
T1FF41CF7EE2D068F2AFB3412BDB335D08D66552B7508A10C474EE70476FB6C4565AB183
MD5 SHA1 SHA512 TLSH

Submit Download

WebCompanion-Installer.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC15A98C9\es-ES\WebCompanion-Installer.resources.dll
Size 6KB
SHA256 af899c47bde2a325f3f9f22772f4e305f6b50eaf040670de508226fefbed649b
MD5 a22c9231a5562dca9f0bc186bda3348d
SHA1 d4d281a596e272a482c6917dc3ca67c150e72fcb
SHA512 c140934bf63aadb01f7c0a1a4a7e89fb7cc6deaa5219bbcb64eb6fb9d29f8139dc4a17c990373bb008a891436bd60e8b21cf748dab0fa263853663ad17ba9fb4
SSDEEP 96:wfMjBDbsPnpEaLv3lhC3E1Wb/xg/x9lt2EZdPolY:wEjBDbWnpEaLPlhC3fa9ZNolY
TLSH
T1A2D18615A3D8353EFE533BB56FCFD2498365F9E0E921C67F008A62271B901057BA2631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1352_2056299042\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

FeatureComponent.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll
Size 150KB
SHA256 42087b3045c86316d2b85fa23466a0bb84935b52d0537d9b2a6c857dec4eda38
MD5 76f9ff88bfab074cf3657e8cd007c858
SHA1 06da56379c0819cc2a46e7a60de79c00f1cf2956
SHA512 74a2ea1008318629a9e275360bdeddf23ad375b8b1d0cfd8c9d064acd0cbbf1a06f124af1003adf523f7cfe1d1b2944b6033e9287b86ceca7c3220a8801bec4a
SSDEEP 3072:/dbds0zUe6StgUR9x719hVqVOT+tJZ67g5hNusMb50ftbeyMSXFHuRKxbJA:5zdYfZ6E523b2jhxbJA
TLSH
T1A9E34A2823F48710FAFE4F76A174522D57B2F54BAD06E39E4A8164ED2C73310C958BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ICSharpCode.SharpZipLib.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
Size 208KB
SHA256 cb51d070c1e2bde393f2a65db17e872c395b55d0e3c47e5cce49a8a1ed4d69fb
MD5 beb11bf49e70f87b3dfc3b5a51266e48
SHA1 927b448f4d02cde7920b2ea2417c4d4784c00a91
SHA512 9b70e5acabbffc58bfac5c310ddf1baed4290753859ba05b4386f71989e59a821a3341ddf6c1d3df3d37d92d9a58cb37a306fd82996525140d0490b184356dd4
SSDEEP 3072:6K1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4f:He9OAQsFtJrGPBnmIRZfR
TLSH
T186243824A3EC5B1BF5AE4B78D0745461C7F0BA52B76EE79E8E8084EE0C577909D10363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ionic.Zip.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll
Size 464KB
SHA256 2cb3dd4e6cd2bd6dc4aaeeb48ce47bb5ce3e2c67c040aff388e9165e655b06a2
MD5 ae643bd347eb6bf2e3aa05608924782b
SHA1 c46380bb4c5dfeb71f36b57a59dfa51f672fc015
SHA512 4adbc05558fc0d34ae30240699f63b7c15894d408d3f3b28f37072558bcaedbbf4e8c61e2b42f3bff3b610f9f4f2ebdfefccaafb768733965e2c104adb88e8a3
SSDEEP 6144:GeSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IYp8:TJBdBS4msNUCe65frHMnz2R9b8
TLSH
T17FA4BE0023DC4A6AF2FE5B35D4B78265C3F2B815793ECB8F9D8464EE191A780D6107A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.AppCore.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
Size 118KB
SHA256 890f09a222b8a6e2f70035b8bea140965c67b974d1ace67252fe58518f6e587e
MD5 cfecee7a0dcfb3fa24cf1927562a6acf
SHA1 7fa9e9275efec1b7a139e612b916884c18b20cdc
SHA512 97241f04d7811303e1f92728d3a191825818bc6eec24ac095f627672ebcc16286e820041d40556d1d8ec1f9f3af93e25a6a78049a2d0a373b799c4c9e9e3b724
SSDEEP 3072:TFwKZCLT2UDvIYjfrtlFfyUSt29I9Thu4jtYxptHhGrKj:T2LICBbVo295/j
TLSH
T17CC3290037F88B2DF5FF4F79B97059154976FE5AB922D66E0A91508E0933B808D20BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Events.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
Size 137KB
SHA256 2cf1f139036c9160a2acdfbe48a47a6d7b4baaabe5ef66ba102402ddb066b0fb
MD5 6bc835697a34037cf6ab77089ee5910a
SHA1 7f97d93cb024507c03e13cdfabd2e61dada6dfbb
SHA512 87c0afed8a7bd2bbc91abd915c5e2e83ca46e30fdaac903e91201369aa4fee50dd694a1628975dac9d011855a7c13a655a2d0521b40f50414dc685ff79e3a560
SSDEEP 3072:/6DoLrAcIAW4ifEUkgpbDmEJjLiQybZXMmpoKC:/XLrA4OJb0LC
TLSH
T1ADD3D82113BC832CF6FA4638F8744D394775F549B521D6AA4BC1ACBB3563782D4C0ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.SysInfo.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
Size 37KB
SHA256 bccda5db0d6ef7b99533e209c7ce3ffe2706d96afee79eaea957470ab77e8e84
MD5 d155dfd9f27e340fb3e47d28159e02f2
SHA1 85ab8c8f2284f69378660f96e09f774a36ad4149
SHA512 b337b685205af08ff7f9e3d2a96a91095fe93ce6fadeabbe1309185ce1a59b229d3a48b59694cce1558581340409b046512b40f311f7f6ce122524aa9f8c2163
SSDEEP 768:is3+Ri5DCowECTXMdWmarOgKxnVbiY6XmgAMxkEo:/DwHXMdW1OgKxncVVx8
TLSH
T10F036D161BBCD33ACEEE5F35B4A1413203F2E3C87952DAA25B74F6897E223016415A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Utils.SqlLite.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
Size 22KB
SHA256 c8d28b60de8663606c96f845e487625cfa0b477e695f0b8d1a1d131f8fb1365f
MD5 889d4b9110f1071e52a6f4b8f2013cff
SHA1 c9c1a3fa499e584a3b5e82500a95ff71fc51927f
SHA512 fc8b589c98c721ad94b0ea74ae1b61444f8f417d208f5c5724c1d45b2c3ed32cab025855990759474c0cd7fc798610990392a2899bd4acf590a6d537ad02fab8
SSDEEP 384:pZy6clyR4MRpEFP27xWkVbiWgpQ6LWj5j8uV5AM+o/8E9VF0NyTd6l:zyZi4CpgKxnVbiY6Lyjl5AMxkE2
TLSH
T156A26D46D7E85A11FDEF9F31B5F586260FB1F785BA82C68B0184C0329EA33416A5237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Utils.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
Size 108KB
SHA256 927f01c4e87ce5398eab9a16afb46d0ffa4d7d3ece446925c79c5cca112ca7f9
MD5 f25adfa3039a29edb5cb74189904f788
SHA1 c23b88625c2615a15e08838fd74181a280cf786c
SHA512 0ad529a688ffa6299c7a80f05c31cb31f330c707c2ebc06d9389f65787618606c1c919c84cc8508d2a355dc6df017a6023a52d6673ab439910ebddc348ca771b
SSDEEP 1536:c8xZ7Y57qcDoJPiFVInZz6bRNxPtgYxy2RWaiZBgKxnch5xP:cSqUdamnZ2bvxPtTxkJZeK6
TLSH
T1AEB34A1037F88600E5FF0F3A68B945219B75FE456822E75F1A88A0AD1E33745CE25BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MozCompressor.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll
Size 65KB
SHA256 e41d0bf274d8de7fb27f74f90eb64ac1d51f546077f2a0a88fcbcd1fde3d2ea2
MD5 e870dbf328208aca0fed55f8b4fb1063
SHA1 41957f491b48944995b4491404a086524552d122
SHA512 ff16fb50bf44ce3a86fc12df642e6f47e4f99b0ab9002f86ef26ce8235a71db5f56fe9b5d82136e1d75d129e3b140d5fb1723c1cecb019435cb39bdace04308e
SSDEEP 768:NrBX7I72YM1scqDAntonP1ZlojsSQobxM9gKxnVbiY6LgLAMxkEO:Nrd7IkYd3on2gKxnchGxy
TLSH
T185634B44279CCAF9D6EF853EA9B0C114D937E8ED6FB68AE7B24181960C113C3A536343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
Size 428KB
SHA256 19edf009ded32747460c806ec42cb3e04afc24397c8fa6e9f8c26c0d03292c48
MD5 6e5c9f66ba81fe1bbd9bc1f74eac4c3f
SHA1 a086b924140d48669ea4d68f9f71629795a4638d
SHA512 a4023f8c61d08aaa01d61f0ca7b9646322712539b170fab01036809d4e35b660c2793dc01f4861884c15ace8b381ea9b3dab07a42a21c928f9f46d5ef136a99e
SSDEEP 6144:+HerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonXA0:+HerIacuKUtOkESbKQrvB5+J7
TLSH
T150945B11A7FC8725EBFE2F31A0701A255BF1F806A67ADB9E5E40A5EB1C5774088407B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll
Size 284KB
SHA256 7ce90c260fe55275bc91b53a4c01f50ccd6a699c31d220cc83f6b02f92839f65
MD5 b2736d639e98021b4b881a7b7da8eb1b
SHA1 4c8c87206ccfa086bffc5bd667315cd895020705
SHA512 2cb512cbf004830f05a474ac6a8dd9fcd7ce0b1bf63bceac9a155d7add689433a0faf35a6b25c1f228d0a198f28655941d596a359d6bd5dd9051261a0bd77810
SSDEEP 6144:kjM6Mb15iJrFxrFPs2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFM:kj0h56rtFNFaFeFOFwcGF6cmFWc0FWcg
TLSH
T1BD543B6533ED1A4AE2FFA778F4B0164187B0F8964627D30D7CC160EE5C26B80A963767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140D.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\VCRUNTIME140D.dll
Size 106KB
SHA256 648ea8b46db5eda404b6d8006ab3a731f27528ce9f8eb9969d3b3531a26ec809
MD5 6efe34e639c8204dcfd47c901c845cb6
SHA1 05336741d8a6068e6739985e08476d2dee18ca8a
SHA512 4f0222dc3e06047a3e613328f83bd3e809bc66b3a8cb4400a421fa34f0ac19bcacd6c65d79a31662917138a9e731c6c2ef6e59d95de4dfcdd4d7fe20183f7e2c
SSDEEP 3072:tCLsZSFMEPCl5ikSF+GbTib1iecberxMKP:tDEPCl55E+GbTib1iecbeLP
TLSH
T192B35B01B201D07CF9FB00FEEAEA5A1A06386A7A679400D77FD916999F91BF27C31503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion.exe

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Size 3.3MB
SHA256 38b605a45b286c4827327bc6e10d08afc71e5dd8d2c9b4f717b1d8039e0f92c8
MD5 d5180525e08932a69dd1903ab30313ef
SHA1 4a7981b66fe6185177de6d001ad9ce77d2a437ec
SHA512 ee7324000acaef8c40e5f8d9397fe5a1ceac5a4888808a33758a350fa9ab2783d8421164e8de34e61c74cb1e013f0b3e0cd777b54bfa2e97877dec9f3f1e5b4a
SSDEEP 98304:0pUEN0DGl8ItJvcdLDKEu5v365hiz2Jh33GS0:FEPl8kJkdPdI365hiz2Jh33GS0
TLSH
T198F5E102A9652827E00E2B7147650548DF3A519372C2DE5B389F2CDE6FCD3E6CE631DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion.exe.config

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe.config
Size 11KB
SHA256 bf61730717f05b95c4f43d425b6d7d15deac39d53e28eb302e5723c7a9b7b0b2
MD5 cd4e494e258c7eb0585fe76ebe9e6233
SHA1 e93eb57e6c38e496fda92dbcb31021b34ae47cfe
SHA512 413b3727a71126e3f35551232607d95f8bd79342526c0144cbca929e6dd3e65aab56b2d1f37baafad53ea23dca4c55bdd363cd45d0c54792c3118726ea45c07c
SSDEEP 192:urBZ8HDg7wlXUjrFknBUrqPFUvurGMNpo:u9Z88loI
TLSH
T135427C1CB1C1EEAA11766631EB3152C1EEB04173116A70F078EE31572FB1C9A69B73B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblz4.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll
Size 133KB
SHA256 77762787949dab142218c7b6848991ac04ddae42c0d24c0497e9a13209494f1f
MD5 c19ad979210347af77e81f1143ed202d
SHA1 f98d00fe7568a70b8f9bf418ca9e61dc02a696f8
SHA512 cc54cdbcde5124004719314d242b43b57ff89a329e6f52b3bd67fa19b56819aa79da115f732773adb6b0c18222b91ec71908773634ba452f80e9b5e17a37332e
SSDEEP 3072:fcAPIq7L/iB8HVC4Gom8luKyldZsKI4jZKS:UAPIq7Lc8By88HfjMS
TLSH
T1A1D36D95E7D354E5D9574A3882C3E33F4638A640C221EEB3EB489A76EE333526D1931C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll
Size 316KB
SHA256 3ceb7c1ae8dfc9892cb671f98f775ebbc14a94f8c77bdf64cc232aa86d789b72
MD5 4181e0070f4d57ef36dfa1970ff79bcc
SHA1 5f74e8f9af08c73d40fe83615ec0b47f100ce6d0
SHA512 88eafc0ed5c2de287d4df445616c3b93664add5a2a8a3d40eff35b179bd7ac9dd32cc98374b5f7e7cff84674e6be85166f4be60fac9ef7cdb4606611f7be9200
SSDEEP 3072:/qc3k4mtsi40XigRvjAIg8J911rTJZq4+wYxEwKbEAfKQPL5ds6vOn7GGkXnEcGh:B3CX1AIg8JRfJYmYxEwna5dY5u+
TLSH
T16564150427F80A19F1FE5BBEA871850187B8F956AAAFD30E5A9450FD2D33790CC507A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbased.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll
Size 1.6MB
SHA256 d2d54155de04a91248841e32ac0bb04b3753277f1e3fc896c43decae666233ef
MD5 0ecedcb3eb14eb6ce8194338bbcd3628
SHA1 05c2e0f4c368b12f467735a9256cff7275f47c95
SHA512 abd876e099cffbaa2d459e5a7ecdd495b526fe1addd5717405db922aeea080a92d2921dfea8ade9667bac431cacf67c0a1892d7e5f9e702b13537e173af12c50
SSDEEP 24576:3oYsYW6Fixna2BNy4ra7hsXZPa1P0i6Q6335lL3BhdJXmNZqByzYZ4Km:IYWxla5P0i6DHXLv7Z4x
TLSH
T1D4754A01B691C024F9FF16FA157EB278983D39E11F6484DB33C127EE5968AE45C31A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLite.Interop.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll
Size 824KB
SHA256 a501a8c2c5c42d02064b220dee8d440b2f67fe66c352063f8142425c1fe82ca5
MD5 5214d9ff559fc297c8e30f63def15fe7
SHA1 b69dc38127efd00e8155b6d3c1f5e0d31d834340
SHA512 b4b4798b70123b2e3d3745880a01b69f583cca86a0c5a41094d2bfa6838a3d45c895d26ccccb3368e62f95e644517d5b63c6d147ef5da932117b9b588848dad9
SSDEEP 12288:gr9shsglMJF15Yj43MNB2Yldq3+ZeW45+6/rcxJ9RmlJDs9GtL:49VRJF15Yc3SgN+4z/UYkYL
TLSH
T18B05ADD2EAD3C0F0EA8921B952FB5B3B1E3556054322C4E7AAD02D81DEA11F1B77F245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiveFeatures.zip

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip
Size 405B
SHA256 a9ab351ae85a6dd2ca7be34dae8a34113e81b52110c238c6d1f3b64710cd5900
MD5 425e3c406fa1b8060a54f110d4b5a179
SHA1 7b17d666b7a8519d37ffa280df550f361b2570b9
SHA512 57b1fb18dd39b374719a45c08fd35ffe8a18cd88e4229e194a32ae5aedde8480e03a016dc8d31417a4afe0e702f08c0b54904077fbd0e78dd1709458157e75e5
TLSH
T1C1E068ED839F2282DCC7AD7D4A9303DABD6AC097902DB1D32C687980AC089D31E1524F
MD5 SHA1 SHA512 TLSH

Submit Download

ActiveFeatures.zip

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip
Size 405B
SHA256 cf6a175b9de6060c073377fc387f3413943f07eec4bc3e1e3b705a7aa23683cd
MD5 adc734eaec74f6ffbc6f602149636aea
SHA1 c7564f860bd73adeeafa7c3ff81a93155286ee18
SHA512 460f4304212a5413c008488fe6df8499164c95f25801abae4e475f75b86243f5653a3a4e23c6bf5b6ab40a5ac6738a2860ead9f3f223dfcdcc7d74370115ecca
TLSH
T189E0686CA3FE17C3E14A0E7DD51203D8ADC585C7C860D75F60282D26BC0D9CB4D6A11B
MD5 SHA1 SHA512 TLSH

Submit Download

AppSettings.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\AppSettings.txt
Size 332B
SHA256 7afe6a8c5bf14cace6e9bb2d40df2adb5f31325fc024f448138106cf7b63f7c1
MD5 590fd86ad024f2b655deec8333e240a9
SHA1 f1946050248dd1aea834f139063ac8eb3e41677e
SHA512 c19bf730552e548b6caaa27f5ff2c5b34d34ac9408b3b6e388361635ddfd4f619b9205fad76b9141f2804b8dd364cd843dcbabd4d9d7b7b712f320f6729d87ec
TLSH
T15CE02607581434BB578B8372729A8DACC1654A5944A804387DDB1C0E1636A3B224A82D
MD5 SHA1 SHA512 TLSH

Submit Download

CData.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\CData.txt
Size 209B
SHA256 f0665e0778658b1b74a325299077a690f72955ea4d5d0507ffdb8e88d01ab2e9
MD5 c8cfe587b87407114f9c1436389ebcb9
SHA1 7c7df6a1024d9a2b0f421971ce5afc6b08e216f3
SHA512 f7e61540ca436e4e10c5d58b14a364be2f31cdae0c3cfe1dcc9e8a0486da5786e63becb854f97bd1439064cbfc931a34cdd93a18c5c460eb396959d91ae2666e
TLSH
T1C4D01203E9918C7F56B84605958C8585F4A2036FD345181B75F4690D1F34D3064D9868
MD5 SHA1 SHA512 TLSH

Submit Download

EData.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\EData.txt
Size 207B
SHA256 64675c67dd1c1fa09a8952897d583870da39bd0f2c83195782c7f1f954c409eb
MD5 56b00246fdd704005a631528ab2afcab
SHA1 588c81ac2269bafa678d7888be57749e2825c9c5
SHA512 8bb3411b27a60eef9127474bf1543f7da81bb1a31217ecc7c92eb1181fc82bc156440b1ed26373bf43d19150efd82fb33335cab4af9009f1740f8ad44cbce59a
TLSH
T1F2D01203D9514C7E56B90606958CC945F4A6035FD245180B71F4691D1F34D305499869
MD5 SHA1 SHA512 TLSH

Submit Download

FData.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt
Size 208B
SHA256 7e29d0943b0ce8d88264b24e4015df2d8f4723d29c2c2a432790fce17b080656
MD5 198b6e7e0749eacb7d037be4b33349a8
SHA1 81b087211a2f07e2595c719166353bf3a50399af
SHA512 97a45e9d5c293b49247e0634665f0c23507eb5fc424248632d9dbdd3b1b58cf2444590463cf15c3507a99da7779cf6663c9a9e6159cc85a7d11225be89900327
TLSH
T10BD01203E9518C7E56BC450554488585F8A2036FD345181B75F46C4D4F30D216499864
MD5 SHA1 SHA512 TLSH

Submit Download

FeatureActions.zip

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip
Size 656B
SHA256 9e5b18bc2ed868ad875f9bdc5bc87f0b33fe7fc85f5728b686dce1fc34ce684a
MD5 279c33fa1b851412cb102b5747914048
SHA1 cbd47a03f7f24a957a3129d34bf7215a558ddd2d
SHA512 3bf87aa9a19bde83118c660470ac803dfbf309b2455bc4ed3ba169cc159ca159df15af3ab2d228a05d9e8dddf4f9052431d04b782fc1d1c7af93f8726adfa27e
TLSH
T15DF0D37D93993812C9858DBC0B0223CD9790D155A08B70FBF065D657BD2117D582F4B4
MD5 SHA1 SHA512 TLSH

Submit Download

Language.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt
Size 20B
SHA256 106f8b485053abd8ada34b95977495aef74a54260736d8f1764cf943d22466a3
MD5 e8072addacf95058de46856b9b62e871
SHA1 4b4f79e91f0f03df25ea11d90ddbb8b33002c962
SHA512 2b79e9bf6e7b95735f930bd8f50fcf771f7e47314dc7f625b5558eb634701090fdbfd7e08cd01a4cffc6fd464b48ee02408a8adb835c78a5d60d336e1e29218e
MD5 SHA1 SHA512

Submit Download

Partner.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Partner.txt
Size 59B
SHA256 5b772aff4f2923f93262868dd866256c8d4fda1fa13b8b71e1629831f5e78120
MD5 c0b924c4db7704e999e5ce2b629e60e4
SHA1 62ece7d9191cd889cbd8b2f6abfd4adfc9403ace
SHA512 59c271d90ff16900ee85c6509788254a24d5f55ce4e66dbefc6fd60f4cd2ad97e0bd0f5db0a114cd2dd61192c058471ce49468c2a415c1275101678096cd9085
TLSH
T180A0025D1BCA581251830FE15A764DA131831F4A1695404820D91B79D15C5350601997
MD5 SHA1 SHA512 TLSH

Submit Download

ServicePartnerInfo.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
Size 185B
SHA256 1f3ca9b0bf01a1ed7c05ec6dfa97291ec7127bf2918aabbad7ecd9322732e96a
MD5 9695a2f3893de2cf144b55fc68dbc125
SHA1 a872abeb9b1b1276eaefcd282cd7790f94c0f507
SHA512 9ae2be6425050191db3f7ee57e2dce8d540ceff96499934af92ceda3b0de35d11a2a02f123aa503301dd6fc135224a6fc8b0a11c6001e5a6834a3556bfc81d0f
TLSH
T1C3C0C00F378FCCF450C0174361244F8031933F5050CAFCCD5947C4604E31035250410E
MD5 SHA1 SHA512 TLSH

Submit Download

Statistics.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt
Size 56B
SHA256 0c8fcd3777adae9a3f4119a8aaf021cff7f96a27e981193bc3a714bac9e880cc
MD5 05f56c14bcfe48c16fcbd23a7a93f01d
SHA1 e0b27ed2da8db079e47a5b0fa39d3e27f5980091
SHA512 a8edffd38dac2b94e5be708ac22c9c8d0c6f02666d80f4454e6484bd801e6542cc67c27ad581730a1836e780935663ad310d2a0dd16b0a9d7ce145d4744aefc6
TLSH
T1F99002F461010916999156185227106818038A311650A1A61586510012AB70735625C5
MD5 SHA1 SHA512 TLSH

Submit Download

WebProtectionConfig.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\WebProtectionConfig.txt
Size 308B
SHA256 b578ec7cfe4cdf6690c83daa66b068fc585a8b35fc3a8722e29f2dc0fabb26e2
MD5 0cb1cc6ebd3113ffa4d08cb8e611b0c1
SHA1 c084178a890875d41c400e8950537e1f8a58a50f
SHA512 c86f4c9a16249313e1a4e0561dc6241e931c5d382a830b64e3aa9d1447734716417bc2f08e4860edc0d2945cc5091170b90039194c90985395d33a36662fffec
TLSH
T17DE0C28F8382376F77D34783100E9C99B26B861C0CD5D30AD8A1DC4B686C462326F0AB
MD5 SHA1 SHA512 TLSH

Submit Download

statistic.db

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db
Size 2KB
SHA256 f8ae752ce80ecce718e0d68744dcd0d94fa86d8b8cf8da0a916d4826e8fbd991
MD5 c2896d016b0bf947303cd06c379d075c
SHA1 53a8f9e89ee6c8a2b6c5546aef974c234cc5610e
SHA512 58be541cd5ee68c101e27535475853557d0336c0660851eb4588145c085aaf6736cfaab61fc1a47d4b5f92cae701ff6fbddfc91b323ca0992251dcea7d8f76b6
TLSH
T1E541DBDD75C1E95ADEE35276C0B147C94A3687568047E17F12C306C5459764C3B6E188
MD5 SHA1 SHA512 TLSH

Submit Download

statistic.db

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db
Size 2KB
SHA256 0a1c121a897c15efb4768e63612874c77eede6cc4feed569905b4fbebd725ecc
MD5 c81f7bba32724d15ea99b382ef754955
SHA1 bc4683ccc7747ef7380d9260778e9e481ea2efb8
SHA512 15a596ce1876ee2ae20cfe5ebac7df2b6a5f72b719a00d9d37f70f26baada9894dfd135efb54322d76eb4dae543fd963c17d17249f69786e5dd5fa786c38896a
TLSH
T17C41DBDE71C1E647EDE352B6C0A247C949768796804BE16F21CB05C54593A4C3F5E588
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2132-71-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/2132-47-0x0000000006200000-0x000000000626E000-memory.dmp

Download

memory/2132-32-0x0000000073902000-0x0000000073903000-memory.dmp

Download

memory/2132-34-0x0000000000380000-0x00000000003EE000-memory.dmp

Download

memory/2132-1541-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/2132-35-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/2132-36-0x00000000055D0000-0x0000000005BE8000-memory.dmp

Download

memory/2132-37-0x0000000004EF0000-0x0000000004F40000-memory.dmp

Download

memory/2132-38-0x0000000004F40000-0x0000000004F52000-memory.dmp

Download

memory/2132-39-0x0000000004F60000-0x0000000004F9C000-memory.dmp

Download

memory/2132-40-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Download

memory/2132-69-0x000000000AAA0000-0x000000000AAD4000-memory.dmp

Download

memory/2132-41-0x0000000005200000-0x000000000530A000-memory.dmp

Download

memory/2132-42-0x0000000005D30000-0x0000000005D70000-memory.dmp

Download

memory/2132-58-0x0000000008380000-0x00000000083A0000-memory.dmp

Download

memory/2132-59-0x0000000008370000-0x0000000008378000-memory.dmp

Download

memory/2132-48-0x0000000006990000-0x00000000069B0000-memory.dmp

Download

memory/2132-49-0x00000000069B0000-0x0000000006D0B000-memory.dmp

Download

memory/2132-50-0x0000000006D80000-0x0000000006DE6000-memory.dmp

Download

memory/2132-64-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/2132-63-0x0000000073902000-0x0000000073903000-memory.dmp

Download

memory/2132-51-0x0000000007150000-0x0000000007252000-memory.dmp

Download

memory/2132-55-0x00000000070B0000-0x00000000070B8000-memory.dmp

Download

memory/2132-56-0x0000000007E00000-0x0000000007E92000-memory.dmp

Download

memory/2132-62-0x000000000A8F0000-0x000000000A8FE000-memory.dmp

Download

memory/2132-61-0x000000000A920000-0x000000000A95E000-memory.dmp

Download

memory/2132-60-0x00000000083A0000-0x00000000083A8000-memory.dmp

Download

memory/2132-57-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/2260-1428-0x00000158CD190000-0x00000158CD2B5000-memory.dmp

Download

memory/2944-866-0x0000000009AB0000-0x0000000009AF6000-memory.dmp

Download

memory/2944-846-0x00000000094D0000-0x00000000094DC000-memory.dmp

Download

memory/2944-875-0x000000000A080000-0x000000000A088000-memory.dmp

Download

memory/2944-586-0x000000006A370000-0x000000006A382000-memory.dmp

Download

memory/2944-845-0x00000000092F0000-0x0000000009346000-memory.dmp

Download

memory/2944-991-0x00000000661C0000-0x00000000661E2000-memory.dmp

Download

memory/4348-583-0x00000000661C0000-0x00000000661E2000-memory.dmp

Download

memory/4348-213-0x000000006A370000-0x000000006A382000-memory.dmp

Download

memory/4348-188-0x0000000005BB0000-0x0000000005BD2000-memory.dmp

Download

memory/4348-189-0x00000000063A0000-0x0000000006408000-memory.dmp

Download

memory/4348-177-0x0000000005600000-0x0000000005608000-memory.dmp

Download

memory/4348-200-0x0000000006480000-0x00000000064EE000-memory.dmp

Download

memory/4348-181-0x0000000005660000-0x00000000056A8000-memory.dmp

Download

memory/4348-196-0x0000000005D50000-0x0000000005D78000-memory.dmp

Download

memory/4348-425-0x0000000008B10000-0x0000000008B1C000-memory.dmp

Download

memory/4348-184-0x0000000005AC0000-0x0000000005AFC000-memory.dmp

Download

memory/4348-554-0x0000000008EB0000-0x0000000008EBE000-memory.dmp

Download

memory/4348-553-0x00000000093B0000-0x00000000093D2000-memory.dmp

Download

memory/4348-167-0x0000000005530000-0x000000000554E000-memory.dmp

Download

memory/4348-185-0x0000000005A80000-0x0000000005AA2000-memory.dmp

Download

memory/4348-529-0x00000000661C0000-0x00000000661E2000-memory.dmp

Download

memory/4348-212-0x00000000065F0000-0x0000000006602000-memory.dmp

Download

memory/4348-159-0x0000000002B70000-0x0000000002BC0000-memory.dmp

Download

memory/4348-163-0x00000000053D0000-0x00000000053F0000-memory.dmp

Download

memory/4348-473-0x0000000009900000-0x0000000009EBA000-memory.dmp

Download

memory/4348-326-0x0000000007F10000-0x0000000007F88000-memory.dmp

Download

memory/4348-384-0x0000000008B20000-0x0000000008B54000-memory.dmp

Download

memory/4348-437-0x0000000008C80000-0x0000000008C9E000-memory.dmp

Download

memory/4348-435-0x0000000008BE0000-0x0000000008C56000-memory.dmp

Download

memory/4348-155-0x0000000000340000-0x0000000000688000-memory.dmp

Download

memory/4348-171-0x00000000055B0000-0x00000000055D6000-memory.dmp

Download