hxxps://mr-lolklo[.]itch[.]io/free-bobux

Resubmissions

18/10/2026, 22:21

261018-193zrahy7p8

18/10/2026, 22:13

261018-15f97abs5x8

Analysis

user interaction
yes
max time kernel
81s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://mr-lolklo.itch.io/free-bobux
Sample261018-15f97abs5x

Score

8^/10

defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
161	4712	chrome.exe
31	4712	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 3 IoCs

pid	Process
2260	robux.exe
4420	Setup.exe
3300	WebCompanion.exe

Loads dropped DLL 1 IoCs

pid	Process
3300	WebCompanion.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Users\\Admin\\AppData\\Roaming\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2576	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1636	cmd.exe
2680	cmd.exe
2796	cmd.exe
4332	cmd.exe
212	cmd.exe
100	cmd.exe
3480	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WebCompanion.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WebCompanion.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	WebCompanion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	WebCompanion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	WebCompanion.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4960	chrome.exe
4960	chrome.exe
4420	Setup.exe
4420	Setup.exe
4420	Setup.exe
4420	Setup.exe
4420	Setup.exe
4960	chrome.exe
4960	chrome.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe
3300	WebCompanion.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe
Token: SeShutdownPrivilege	4960	chrome.exe
Token: SeCreatePagefilePrivilege	4960	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
3300	WebCompanion.exe
4960	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
4960	chrome.exe
3300	WebCompanion.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4852	LogonUI.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 628	4960	chrome.exe	86
PID 4960 wrote to memory of 4712	4960	chrome.exe	87
PID 4960 wrote to memory of 3836	4960	chrome.exe	88
PID 4960 wrote to memory of 3836	4960	chrome.exe	88
PID 4960 wrote to memory of 4980	4960	chrome.exe	90
PID 4960 wrote to memory of 4980	4960	chrome.exe	90
PID 4960 wrote to memory of 1248	4960	chrome.exe	92
PID 4960 wrote to memory of 1248	4960	chrome.exe	92
PID 4960 wrote to memory of 4656	4960	chrome.exe	91
PID 4960 wrote to memory of 4656	4960	chrome.exe	91
PID 4960 wrote to memory of 4604	4960	chrome.exe	97
PID 4960 wrote to memory of 4508	4960	chrome.exe	99
PID 4960 wrote to memory of 4508	4960	chrome.exe	99
PID 4960 wrote to memory of 464	4960	chrome.exe	103
PID 4960 wrote to memory of 464	4960	chrome.exe	103
PID 4960 wrote to memory of 1988	4960	chrome.exe	104
PID 4960 wrote to memory of 1988	4960	chrome.exe	104
PID 4960 wrote to memory of 4068	4960	chrome.exe	105
PID 4960 wrote to memory of 4068	4960	chrome.exe	105
PID 4960 wrote to memory of 2236	4960	chrome.exe	106
PID 4960 wrote to memory of 2260	4960	chrome.exe	107
PID 2260 wrote to memory of 1636	2260	robux.exe	110
PID 2260 wrote to memory of 2680	2260	robux.exe	111
PID 2260 wrote to memory of 2576	2260	robux.exe	112
PID 2576 wrote to memory of 4672	2576	cmd.exe	113
PID 2260 wrote to memory of 2796	2260	robux.exe	114
PID 2260 wrote to memory of 4332	2260	robux.exe	115
PID 2260 wrote to memory of 212	2260	robux.exe	116
PID 2260 wrote to memory of 100	2260	robux.exe	117
PID 2260 wrote to memory of 3480	2260	robux.exe	118
PID 4960 wrote to memory of 3408	4960	chrome.exe	119
PID 4960 wrote to memory of 3408	4960	chrome.exe	119
PID 4960 wrote to memory of 2800	4960	chrome.exe	121
PID 4960 wrote to memory of 1504	4960	chrome.exe	122
PID 4960 wrote to memory of 4596	4960	chrome.exe	123
PID 4960 wrote to memory of 868	4960	chrome.exe	124
PID 4960 wrote to memory of 868	4960	chrome.exe	124
PID 4960 wrote to memory of 4872	4960	chrome.exe	126
PID 4960 wrote to memory of 4420	4960	chrome.exe	127
PID 4420 wrote to memory of 3300	4420	Setup.exe	128
PID 4420 wrote to memory of 3728	4420	Setup.exe	129
PID 3728 wrote to memory of 2248	3728	chrome.exe	130
PID 4960 wrote to memory of 724	4960	chrome.exe	131
PID 4960 wrote to memory of 724	4960	chrome.exe	131

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4672	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mr-lolklo.itch.io/free-bobux
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdefc2c728,0x7ffdefc2c734,0x7ffdefc2c740
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,1346904717179546341,10375694531884143765,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,15308580830073724234,9180604517632739789,262144 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,1423897111229775729,9752508700164922171,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9252440830676372170,15786158815303403462,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,2244836295643302176,15910424283375890761,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,11861720669257227183,3888291744311700347,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5456,i,2366184800839214442,3426282853237317976,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3196,i,11195471013133042481,2178655850101244730,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3508,i,15917326700264577585,8690800353211786682,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3560,i,11761257192230273063,13415688472348394416,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,10450871539886629276,2912777711434260077,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2236
- C:\Users\Admin\Downloads\robux.exe
  "C:\Users\Admin\Downloads\robux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wxy" mkdir "C:\Users\Admin\AppData\Local\Temp\wxy"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wxy
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\wxy
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6380,i,146085592866139717,12562829253875143105,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,18165199346577306157,7982316506749334474,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3196,i,6263944299980116466,214136893542734528,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3152,i,18256010937617038510,17588854618166090564,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5832,i,17129164383677662861,14156024416890515850,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,10543428113794733477,8002738729585474746,524288 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4872
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
    "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall --geo=
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN260901&campaign=22379301727&
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdefc2c728,0x7ffdefc2c734,0x7ffdefc2c740
      4⤵
      PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4504,i,16427361816709508577,1149701035890622411,2097152 --field-trial-handle=2028,i,9629487909263884684,4633271210440654391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3112

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6040

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3951855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4a18ee0b-acc8-43d6-8d1c-007eceffd565.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4a18ee0b-acc8-43d6-8d1c-007eceffd565.tmp
Size 131KB
SHA256 1baa4be8e68299f1c250f74b454ec04fcb2769897d40868080255d59e1a8da0f
MD5 af04c03ec61fe0af9f917c502a2d27ff
SHA1 33fda8f338d5a30f8da140dfb40730833fc87c7c
SHA512 a958b8866a7cfac05438b5386612d7fb27dbf52b08d2d93b120f024bbfedc76f0e6b52e0c51d0a1025d0d7217732c608df8c66fb951a7b6ff0b4c7a83153c7de
SSDEEP 3072:Ju7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:Ju7+hFD+7t56OD9ZfSApprr
TLSH
T195D31232AA95D87BC9FD6541F247A300DE66A8ED41DE3A09444A5F8ED09FD4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ef91050-c809-4905-b5b3-cad93a669934.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5ef91050-c809-4905-b5b3-cad93a669934.tmp
Size 130KB
SHA256 69e59caf4611f8f7bce34c40af1aef397d924e4d9dfcb4acec1d94635e7f4f4d
MD5 7a5165cc7944192ded6eb9c2d40a8aaf
SHA1 319f76b22c37f0c2c0c49863626daa086510dca0
SHA512 4e3ce36a8714ec6bca4a3290098bb43b749770c6972f11bd9b5cdc6b60069414cf73258badf2d3388d6ce53031da6dcd3c6afba546db3ed0adc9e92cdeac1f96
SSDEEP 3072:dMa+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dMa+hFD+7t56OD9ZfSApprr
TLSH
T192D31232AA91D8BBC9FC6541B257A304DE666CED41DE7A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

826ece80-be76-4477-9893-40d9490865ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\826ece80-be76-4477-9893-40d9490865ab.tmp
Size 131KB
SHA256 ba2d890d987a6eb1e06d118e2f858a24fa4576616c7a2f205d10d72563ba13e9
MD5 0e25615693a2d0bc34581a365e351b87
SHA1 efcbc8d05e5913368402e62b019b6f4f77cf3b7c
SHA512 97bedefdd4643b970ed6a4ca2499a81f5d3f25b941b29376e285b35aaf0c83c67fa18092f36e32ba9803369d142283e238b17e955a679f904c4467158ce932e8
SSDEEP 3072:iu7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:iu7+hFD+7t56OD9ZfSApprr
TLSH
T14CD31232AA95D87BC9FD6541F257A300CE66A8ED41DE3A09444A5F8ED09FD4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
MD5 6ac2bdb5618eb33217283a8c2a2bbea7
SHA1 929bbd0ea4faacadcd10729d56f75f85718fe818
SHA512 210db67eaa7e247fa4c61bc2e2b4275f8573062e567be16ef70acddac71222e128e021da8a6e8867a5b5f1507c9fa736ffd85aef609528eb4c496e58ccdf5830
MD5 SHA1 SHA512

Submit Download

0ae70c52-d3ab-483d-a5d2-825bba703bcb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0ae70c52-d3ab-483d-a5d2-825bba703bcb.tmp
Size 11KB
SHA256 eb38daad12a716f0ff71d6006e6784ce8b61bd153b7522f7c93b2aa740e61adf
MD5 c1e4b7f21ca4108ab66970bd62275ced
SHA1 00a9007fb5fc8b1120ba6feba43695fd8ebd4810
SHA512 c2dae187e733855cdbf9be9f2b20beff95081a2560c58ff89f4e1d0070dac7ff860a8a73537f574a4b8ba256bfb815d6cf41d90d0fdcf58105bb3c95630e0cb2
SSDEEP 192:XRYED/Yv71vAPRp2Vle9IHsb+WNnvFv0L2FDY8BVyIsnAUge:XRYEjE56XN2wt02VRe
TLSH
T11842A42DB920763B5CDBD22AFA61B757D7F6006261992E84E6FC883C14EB5CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11a1fe96-03d4-4c32-9b77-519b32984a40.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\11a1fe96-03d4-4c32-9b77-519b32984a40.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

17455f4a-96a5-421a-b289-b0d1d6c781a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\17455f4a-96a5-421a-b289-b0d1d6c781a2.tmp
Size 11KB
SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
MD5 c653853b21659f0f1a17088bce964c32
SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
TLSH
T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45c457f7-8a73-418b-93e9-203600c88435.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\45c457f7-8a73-418b-93e9-203600c88435.tmp
Size 12KB
SHA256 ea1f540dd972e78e35eab80f3d0a9d800d57d77fb1a328fddb576c575d4090a6
MD5 350463e7aaf9b819bd5c31f4f9298404
SHA1 de166186f7ea678e9a7d011f3f8f4889b8ac801c
SHA512 46221ffa1845a0ce5b8639b374759cf7edd1b5d48b80cdfccb62aa7e77f0d5b0ec56876078c09fa7206bf8661a72ccffe57fb9254b7138bba731a16ec04279c7
SSDEEP 192:XRYRD/iv71vAPRp2VlTw9IHsb+WNZovFvX0e3DY8AVyIsnAUgE:XRYRju56XT2wAMezCE
TLSH
T17442A52DA920363B5CEBD22AFA61B757E7F5106261892E84E6FCC93C15EB5CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d29b235-456e-4ada-bf95-4ac0c13b169e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d29b235-456e-4ada-bf95-4ac0c13b169e.tmp
Size 13KB
SHA256 871efd06b2bcea898492db5c7007fb5fafc4cf7a314435721538187217547391
MD5 926636dfaa8b7773064adf6a9550e01f
SHA1 5e97b45f9729c5a200be45eaf1231d89a98af20c
SHA512 50b8088f0d31df8e1f0fdfa77e8206e1eec43acac4e932d257a5d2e7562e5a3a6629b807537df9dd40cf763bafe8af39d502dba3f9d1cc51190a78d064bb5774
SSDEEP 192:XRYRD/Kv71vDPRpjVlT39IHsb+WNkR6yvFvX0yDx2YDY8EPyIsnAUgE:XRYRjG5DXP2wSMc2OME
TLSH
T13C52D72DA920363B5CEBD22AFA61B757D7F9106161852E84E6FCC83C15EB6CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

802a100f-c436-4544-b6e7-85a290abba99.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\802a100f-c436-4544-b6e7-85a290abba99.tmp
Size 11KB
SHA256 31ec0fd01e0ff2647774097c471052965bb758041970771fe44417a6b695f950
MD5 143c0ffba406d2d2a381c12e28b4785a
SHA1 e2c93f5e82af7e1a484fc156234e48fefcd60fac
SHA512 2c9cd34060e35e63391aa2c5220e1177b432e766b36514171f0ca8969b0f6db5aa8d537a266b80c41fc23f5a9b8bc2b691de0e599a867b09669f280b5114f39d
SSDEEP 192:XRYED/iv71vAPRp2Vle9IHsb+WNnvFv0L2FDY8BVyIsnAUge:XRYEju56XN2wt02VRe
TLSH
T1A842A52DA920763B5CDBD22AFA61B757D7F6106261992E84E6FC883C14EB5CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89903a09-917e-4245-aa3d-ab8d6a816b20.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\89903a09-917e-4245-aa3d-ab8d6a816b20.tmp
Size 12KB
SHA256 eef910dcaf6bd9583b1b6210b1bf28bc1b40067f6c580c2faa22cf29c91782bd
MD5 4265fa4998605f32a455e1b387484b5b
SHA1 1da1679f8022a763c123881a79b2b2ec040f0ae1
SHA512 7ea304cd7c31bebf3455c03a610a7f1456a3096bc18af29428822cdb1cfb38dba2adc19ef216068ce195f69ccb129389161bdd859cd722bcd14265633b7fb074
SSDEEP 192:XRYRD/Kv71vAPRp2VlTw9IHsb+WNZovFvX0e3DY8AVyIsnAUgE:XRYRjG56XT2wAMezCE
TLSH
T1F742A52DA920363B5CEBD22AFA61B757E7F5106261892E84E6FCC93C15EB5CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 74KB
SHA256 dc1389c0ac3e91e01f404d0fc70b530d6a7239cd2cabb3fb2fbe29df037e23bb
MD5 e9ae46a176bf7e8feeedb63ab6347203
SHA1 0ff268e9aeed86164b9118eb2026a64e7505eb24
SHA512 bf81b95f58255aba72f4ec566acaa1bcbe0e22f3f68660ffc458cc1f85b9fc06fc3240b7d701f77303741eb27ed41508a887e5a19a32267b1069ed1110fcd6a1
SSDEEP 1536:aC/QZj7koOvCrro7MKa4DP9Ql39EE+01DWRpH1ti9/E863qE6g7H41c53:aC4VIoVk7USPO3f+mMkCuErbJ53
TLSH
T1007302EE28CDE5A4EE5E33B42D72D548227105B2B279C8859CF121C6D5834EBCE45FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 24KB
SHA256 458883ae85fc05fa4e305b6299e8955785a4842872097af4ea5bcba58e740564
MD5 18b163541fb1bfa265949601cd3ec6fe
SHA1 a40941f330f274313e0461f8ba6eca3708dc1308
SHA512 0b5ebc915c19d2b0b0b93fa2ec64181cdc5e85f75fc7e1f7e8dee3f7e1c2a3fed89dc649a259f114278fc96a0041f17bcae03eedd1d1cbf58ca2ad5e55c45a67
SSDEEP 384:gNPmb4cgtdfMts+h4FxySseaTI8LqJZ+4XBpMNqkjI040RXvCdfXIQ6ukWohAfjX:gNmscgXMa+h4XygpNED4tvIcjxJ
TLSH
T151B2E0B08B4D0F1DF0E2C07A90B0299B7B211A5322BCF21D55BBB48B22453594A52FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 501KB
SHA256 1b44d0da9b3727df3139a25adc6f4da1a424d16dd60e96394758825fa40a0aed
MD5 0971ddaa3a9713d42bec7697be178beb
SHA1 d51774352e4176421ab15520d54e673161ef1449
SHA512 04ec7ecdb59bbab6e36e204ddd7f6baff007f360e10db6e6b9f000eda430636a9312caf7e8d1ae8cdf8443a2d779632279786820507d6182d76afcb33035ca2f
SSDEEP 6144:i2TveGyEDAhj7FtC7b+i4lGM9sRcwwbhEa93DmSzOHkAimky0F9/:i27DAhu7b+iBp9imk/
TLSH
T105B43ACDB3D6746293A2F478903F018BA57B29A2B44CC995F189DCE42D74A9A0133F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 162KB
SHA256 5dd641c6b9e4742a73b6db161c80887b847946ab903b157ea769e68596573ed6
MD5 4600b3bd9f14d678fb77f799f1fff9c3
SHA1 05528627a5104cc4b45dcefd49e1422b5ab27c96
SHA512 02d258c4fd5aeece30fa1178157f9d4c081a69eaccaf3dcb3a19e40496fcc8893512e122dd1db07390ef71ace63c61ca648e5061149d264d1f555aa39bb4581e
SSDEEP 3072:4zFF3kHEO1mW3FgZ9Q1f2G7LtcTxEX/LEPVhMH06OzCIgd0jBrPvlbfZ:BtZ3FgjQ1f2eLKw/gPVaH06z+L9bfZ
TLSH
T1C6F3121DB9D73C938A88DB87D017387AB7268AD1AD76CFA4F300DE95B46C616C01539C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Size 164KB
SHA256 fd69487be8b9feca38d76e494c82f267842a0b5e084e639d66a54a4687c25030
MD5 2bdebfae183d2bad50f9817224f9b530
SHA1 b27afea3237ab9723fb28f215d4a1bb8739dbc53
SHA512 6c50dd5c33f33c9ea8d915630b5fe1fd351f721df193be6e5e554b3fa9c745031cb70957cec05ff21af4603b604a5d35d3d18d6eda1891379889cc1ff96fabbb
SSDEEP 3072:lVqzpoDtsb/K0okxZxhQ+VFDXaKpWaQhqoK0tLor58+nLYuTO/PG8K975bLrlPfN:lVqY07fLXtAdhLRLor53LYuTOX2LTD
TLSH
T1E6F312133907951584CA88026B1B23DD4FF1401E6C35ED35C3572BFEAAF642AC0BEBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 16KB
SHA256 53c7c08337b4f5be6f7942897b364afd73bf4753786664659d303b5e660b118b
MD5 9830fb86af17e1952070d26eaac42196
SHA1 4e12ffa4ffa6e553032bb751c66a6da416561880
SHA512 a8bdf80580813515b71e15ec369cdc2c436972f4fa09e72d1314b007c9ebb9e396638081265852b6e09365f8940f38f90404766c903d4e2d8ac34cd6894dd13a
SSDEEP 384:XTir8ItJp0ygYyZ03GIXp7LsQyN0LcS6/NueyF:D7MdgaG8sQygLFF
TLSH
T1A672E099B782FAF42C2E30B5868E2D7EA02274C9A5F5938243D01F902119A1826F31F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 136KB
SHA256 8efdb51c1909660846d05a6885e5602ed622dcf4fc8cc40a62b64718a34ec124
MD5 d63bc90bf9ae4845031db4719db8903d
SHA1 6ed42e959c2b7c38bb768557887d881764ddda35
SHA512 0fd2baa923c54e3792892ede26bccf6ef05da1d844bc8fa6e2b9d62a7998db03734ff0ea62d9066ea3459b652c5e30a675fc3cbb5c995b71892ef76b95a6e5b2
SSDEEP 3072:LbB0sm+4I6RnnxuthgKizSBLMi1Um95wgnyRU1IVG75PCtl9soI9q+9:Z0P+4TnY8Fz2MqbbLyRUBNsep9
TLSH
T1EED312B6F963437A13DB829724B2D486C7C7B34B24685BEC11289C58925C4DFDABCC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 18KB
SHA256 97722715f92bfef1cccdf80f1dcee232f79e48a4b5612305ca2b864c352f0274
MD5 407076dbc5bf0c366ba40a25b3c5827e
SHA1 5cfcd188250e174f6aa12dfa636d1ffee0109225
SHA512 de64d6aef8d383f936f2045576c202978fc20a7b6cd72a2c59e766f47fd7b5fe32c22eba27c31eeaa0b4d0ea53f034a22ce2e39deea227e45dbdbe55ea230a94
SSDEEP 384:9txbJGcjnNmvi5cnwn2o/YFkaGE9YHt/1TpWCtqPn0:zxbJG6nNmvhAYkk9O3WCMP0
TLSH
T1BC92D0F989055288DD2980B868EF4D5989442826051ABC54E4FF7638276BF7831F5E3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 b7288830394c12309dc6f8878fba8be538a19f1ca2556f0618acd70fde7d114d
MD5 b93b6eae7cd2d1b7eb53b1b24ab82c6b
SHA1 645162bf811023b2e0cbc837f88bd4f0c12c4859
SHA512 0c081af9414601e31a97b3f6c68f143c2ee31fdb04f34ffe84cb48cf4920b79f5b5b4f43b73eadd7aec9eca2cdc164ef9630b563e86a915648faf4a2064657a3
TLSH
T1472176442AC96973EF170339997B0DF0E933409AB4012F8F40EDB578D143BF065B0926
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 60a85f1225ca25550cd007204e23bb1cc99fbefd867f713a2e2924682a16596b
MD5 304ebd8e91952f4c8a7e77a7c98970f5
SHA1 f50954a2dfa4f122bba51d63fd88df111dd5674a
SHA512 6f37f6817e4d00ffcfa4460e531b8adf0a058ab58db03dbd0122a687c06ddd2ab032693af6d52be0944fd8db82e19b99fbd6d81b235af407da3f8520f6b1a3d6
TLSH
T10D21514426C97DB3EF1B433999AB08B0A233404AB4012F1F8489F5BCD547BF0A6B096B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 e7084c894fde18d56114c27faf8c828f6f817a2ccb8be9dafa7c297da1300f6d
MD5 24c719f8b579dcd8dd650c2b5a010f79
SHA1 3058dff73e89ce9b1fb272147f4515b2124c98df
SHA512 38d06f1d4cdd98af14b52a824a7329c12efe345851210c01a84b7992a339add7d395c619f4b199c75be76f9e66c0895968184f135ba5aafadf724de850ab29b9
SSDEEP 3:MsEllllkEthXllkl2zE/l6lt:/M/xT02zH
TLSH
T1E5440405FFC01517C54051F44053C3501370D414071357D7347174735CCFF400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6658a405-5b7b-4191-9f5d-5911cd76cc95.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6658a405-5b7b-4191-9f5d-5911cd76cc95.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d903cc93-8a67-4c30-87e1-71a90e198529.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d903cc93-8a67-4c30-87e1-71a90e198529.tmp
Size 1KB
SHA256 2da046fe7f99c9c26293667bdc110a155973a95eb322851863b85b8d57348e59
MD5 4d39f96935a64675ee9aaa715e4cad29
SHA1 18cf53da028dbf67e96a6a2cb4c0e224724a9dad
SHA512 eb05430d975825f0b72cc5cff3a5e05d14654cef1a4e2f9d88dd134c6c7471a45338b319bda02a7f11f44eecaa3920080e237ba68afda0cc4ba7fbc58ae43307
TLSH
T185316897D2BEB56B107E08F71D04784A59B6B8304182B4F5DFAB42ADB0C58B70B1247B
MD5 SHA1 SHA512 TLSH

Submit Download

e17bf4ba-44ae-41a0-9aab-9da46fad7664.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e17bf4ba-44ae-41a0-9aab-9da46fad7664.tmp
Size 12KB
SHA256 f5e1fc4163697e93f76d9f682902b0054f8d41b7b93cbe22b5d494c00ccc0fa6
MD5 9b0241ab262a6059c5bacdd00c377bdf
SHA1 aff17892fc61533f0d6fa396ae8e455ce466fe30
SHA512 d451832cb02f129c59b542c0a8e04142bc14cb77620e37e825c7d74de9513a90faf32c89addfdc46124a547a8491414f7bb1dc8c6ef87af008d036cc3fb22ea4
SSDEEP 384:DjTjP5PxejuujIhlJpjJJjn9MGWnwaIaEdphjpjmjsjhijjjtyj08Bj8jUMj+eG9:XVpgzg8gwO
TLSH
T1DD429EF7C3E4852DC91156F46B153E2BDF6E091903683D1A8CE8AF8B93E18B1E34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f1633382e72b897c5202a2072d8e338015926def2138d7986ce27fac82681da9
MD5 a8debe0d02586fdd02f65620c7153110
SHA1 b5c13556d547167f2d6892f620fd548ee7bf2cb9
SHA512 b38ce2eb888a5a1176a6cc8dfd7825bfb89a171d5e20a110b068e6db5d57870b7ef7ef02abf19fe04e5bef59f74b67b2e7062d718a68c2e1096377b3e6cbd2f1
SSDEEP 192:XRYRD/Kv71vDPRpjVlT39IHsb+WNkR6yvFvX0yDx27DY8EPyIsnAUgE:XRYRjG5DXP2wSMc2XME
TLSH
T16B52D72DA920363B5CEBD22AFA61BB57D7F5106261952E84E6FCC83C15EB6CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1f8fbd4-70a2-42a9-9ed3-84d6c9418fcc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1f8fbd4-70a2-42a9-9ed3-84d6c9418fcc.tmp
Size 414B
SHA256 7bf2e01c5cfd285458d3b07e5fe25b47065fe2fd91d2cd688444735f89b501ab
MD5 e1a5912ae62431ac6fa37311223b0e54
SHA1 999be8866af1f84af1b7a0bcc77cf2137ec85915
SHA512 3a6812066dcb18f53e35d009a4026a2b6ca41b5a20b3b03ed0d6d16e24761b0e799ad9cab0263ccc02d3b1535013bf227a4362c37f105ea0a55585f5cacee936
TLSH
T1F7E02BF9CD35DC2719FD071950514746EE80135B2682564F363CD54D8FB537A4A96C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 205KB
SHA256 ad883990ba9e18180b178effaf26fb03f37b2fdbfc86f732bc2ece472ec36922
MD5 56331a1249ac63c436a37f9897abf7a7
SHA1 310c85891d9de86c6f3aa7f5ec57fee65f675a35
SHA512 695da0d3cb2b6b1475189ce4cb2b6f38251f30d60f9cc76b2d2a5ab097bc39305200d0ea4cad794cfdf6677e49b338fa6ea3ea1f9e72bacef24c55d54186a96e
SSDEEP 3072:JXxS5LuKxQjoS+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:JXiueS+hFD+7t56OD9ZfSApprr
TLSH
T19824127276A68D2BCEB81510E387D304DEA2ACE696DE3F0984455F8BD11EA4C0777933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b812495a-e19d-4f84-9329-3b2308be1d3c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b812495a-e19d-4f84-9329-3b2308be1d3c.tmp
Size 170KB
SHA256 f41839be183dbb97cb049327eb76322b5b653dbbb340b014c7b2fe66bc5da0eb
MD5 d8044e6c0dc3dbc8f4e22b0e392be58d
SHA1 fcaeef1cd2e0d2f668e2ca66ce9031c4be0fc674
SHA512 5d389c5bb2c68ecdc897e65b0eaec01e0c24897e85544143cc1ff820fb36310242e0cc54e1c0dd565aa7b8f835e7caa9d4904eef09a150b45b50f2ea3fcf57cb
SSDEEP 3072:JXxS5Lua+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:JXiua+hFD+7t56OD9ZfSApprr
TLSH
T1300412737AA5CD7BCDBC6140E397E314DEB2A9EA8ACD3A0880455F86D15E94C0B73523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd4d30d4-d7ab-436b-aaac-a50eebad9666.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dd4d30d4-d7ab-436b-aaac-a50eebad9666.tmp
Size 132KB
SHA256 46cf2116a36e63e2cb94ccfa49835413b65f4c0ad799e516b33c923270ddf196
MD5 9058803afbe637c6959bfb807e7fef83
SHA1 e5a102d600d095bbcfcde26c6753df12d0e6b1c0
SHA512 4c68442f563d351c17bd289d63e829d2c01f05863a14484ee9f320e7c366188166225c39e72e4d63beafcc754846bddc43dd4bdf0bdc5b81adce3eff66285656
SSDEEP 3072:J1T+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:J1T+hFD+7t56OD9ZfSApprr
TLSH
T197D31232A995D87BCDFD6541F247A304CE6668EE45DE3A09444A5F8AE09F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion.zip

Path C:\Users\Admin\AppData\Local\Lavasoft\WCInstaller\WebCompanion.zip
Size 4.1MB
SHA256 ef3269261696141b81018f00a6b07a6b7de204354c2c6c70340a767bc172ce03
MD5 6474c1dbf4a9003600a48bd011976070
SHA1 01adb48f0da815066b77dea570ba7556ffd14a93
SHA512 e9a795fcec800fd2dd10b6a545a16028ead0616f6386b813d4152eaf9960e2b9e8ee03e7722fe2f730b1340e6382d8271b00c8fd6f9f9cf4760f2c8ed8375c5c
SSDEEP 98304:1VRJUo2d6KqgY37t7ysPA4ygpK7KQbOFjam9QjRD5:1V0fCNA4hK7KQbOD2F1
TLSH
T1CE1633E78A04F0A9B43F8B7321FCA0913A626978D2E42D456F3534757A954BCD9C08FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webcompanion.log

Path C:\Users\Admin\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
Size 3KB
SHA256 b38051662dd707bf74a688b2eb053fae3a08eb3288dccae5639bac2bf3385b3f
MD5 11677e025e95880519e2fafb16903144
SHA1 74ba475dfcc678729e662d9ac1f2a27dd00346c8
SHA512 4a26b136d3a100f6bbfebd97014211406fcb8ee6b1211b0394268b35b480d8d416e9d73fce4b3d05dc53c2ca838393e6b865d69846a531286dede412fe41e55a
TLSH
T1FF61FE1C2E15F02281F9D5E29B1AC958F53123B6AB48987C23DDBDC03117615BF2F8BA
MD5 SHA1 SHA512 TLSH

Submit Download

webcompanion.log

Path C:\Users\Admin\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
Size 4KB
SHA256 777d4b4c707175911a5d590a7faa8800b148a606978b83f82ba4199cfecfb850
MD5 da17683e4f0b2ca745f75e1bb2d7579a
SHA1 050a4a8d4d07f8380a204b5b8a76462f09986fd5
SHA512 bd31a7aeae4e168e404e5af09f8f5a734ec2d68b5ad2c41923380b1836df25090163d344e32e921d6155abfcc0d69f4e5eef1e58e4d8d9e7184074d22c7316f1
SSDEEP 96:7d8mhgeHKrKpGD0el0Yi+0atXatXQnXQRQzQ5NjoUr+WRwUrNobUQK:0hlJbbg+sTn
TLSH
T1CCA1DB182D19E02292FAD6D3AB1BC948F93026B5AB48947C23EDBDC13147545BF3F876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4yvqvyny.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\4yvqvyny.newcfg
Size 1KB
SHA256 47c725b8daa01de513872de9cd8537bc49ebed02610eae6689ce8cc67bb5839f
MD5 87c4e74d6d71ae886c057faae67d89f8
SHA1 87bd298084f83b31fe1ffad6b66aacdc79c51f5d
SHA512 3a20da51e6499ae28e41e2c11089e856f4bd5cab306001987d5d349ebab939a7917b135fb285bf42f90041ccc067c916f64d20d85199f93b9f5772fda765fa24
TLSH
T19631460CB1C1DEAA517A6A35E73152D1EDA005634177B0F0B8ED21635F71CEA0AE73A5
MD5 SHA1 SHA512 TLSH

Submit Download

5mevwruv.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\5mevwruv.newcfg
Size 741B
SHA256 892144fe5756d513cc3a401d7938d671f83fe4ae7426999cea07724f7f67778c
MD5 8652c298c5e7186814bca3fd49e11de4
SHA1 a912508f256d4b5d8f7a9c68c0c41a2501488b1d
SHA512 51aa32c47b5c8ce84828dbe7c8319c5213d08849a44d8bd8e95e2d0c949d6f166243746cd053653f36244aee626f9d9c3fa939f1d4c7684d1e58e2981b89d5f6
TLSH
T124014F0CA1C09E9F61725635E7355281EDA015639177A0F0B8ED22734F718D90AE73B1
MD5 SHA1 SHA512 TLSH

Submit Download

5vfmvgp0.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\5vfmvgp0.newcfg
Size 2KB
SHA256 6a994de625d63eeed8d14810d0fe26c767b1f129ede4265056000d1278dcc232
MD5 12e25d7213702b623222c49de87f398b
SHA1 a871ce2fee4ccd5380c735d10085535e22b7ac8c
SHA512 04d973fa5d359e0a7c5b449390f03b194b2ba1a1152395131d1b5b8b211b33dd90e6fdabb8ed1bff2107c86571e0a489387c15ef564de64dae6b054de8a8abeb
TLSH
T1DA51660CB1C1EFAA51766635E73152D1EDA00663117AB0F078ED31636FB0CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

a2vsvr3o.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\a2vsvr3o.newcfg
Size 1005B
SHA256 d657298f5ee38dc5d67b6d3743d2e3cd4a1476ac5ce83fccc6303ec80ea60037
MD5 9c7d7cbbf07bce3bc30fd099bbe28280
SHA1 de747c706b14d7805c1e0cd2245fb8f4d53a83c2
SHA512 c79c7eb94c4db11cb099befca67703a9c2f7729ca643b4662865d5838f44bf83ac5860973d18a36f21da258d96d2c2d79a43ec416a7f8098b2d73ab8d785839a
TLSH
T1C7118C0CB1C0EF9A51366635E73552C1EDA00563417BA0F0B9ED22735FB1CDA0AE33A5
MD5 SHA1 SHA512 TLSH

Submit Download

dapaswiu.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\dapaswiu.newcfg
Size 873B
SHA256 495944b59e2404d4651f219a0bd0412713bb4579af13a02997ec5b83d162e497
MD5 7bdf19c0ba607333169815c2d32ddac9
SHA1 8de36a4686e7c930c927d4126c0c988945fd2816
SHA512 76f5740be47bfde6535e861e2c8b7138378cfa9b261824dcf37e5ceadf9c48294a1eb507a5b4affd0f3752b21ef9e38e42e61e3d0666d2afcd9df7ad59708683
TLSH
T16E11780CB1C0AE9A61366631E7355281EDA015638177A0F0B8ED22635F718DA0AE33A1
MD5 SHA1 SHA512 TLSH

Submit Download

ejnum0k0.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\ejnum0k0.newcfg
Size 609B
SHA256 2b7cc7f6f717124c5e2b8730ca12d46c1bd13a5715de233f0d87c82d9f512f05
MD5 62c93f68c4457d025e8015c94c87654a
SHA1 5c378de242668ede9ac6b78cf2d083e8d76afff9
SHA512 cecbe658e6424399af140189360e00a8bfe961d5495e2fb39d641e3c57d97f7b517e03896a3af93a90cbca866259095fc857c1ba6f51c0ab7e0047ee690f5a0d
TLSH
T13DF05E0CA1C09E5F51725A31D7354282FEA015A39077A0B0B9AD22734F718C91AD72B1
MD5 SHA1 SHA512 TLSH

Submit Download

es4jomdi.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\es4jomdi.newcfg
Size 1KB
SHA256 68c6b3b93c01270a95e60a86aa5ec2b2f662721fc9850dd4364d3e066b4fc67b
MD5 0db2e939b24ce45cf9461cf15f42453b
SHA1 5290c0dc52b617d78a76276c860aa1efedddec46
SHA512 cfb01f5dae3985b8476ce9cb26911f1ba5b313f336e835601159516846a2bd460f176de5b31673f1fc4c620cb25bff76a4f77c2344759da2fa152bd337684783
TLSH
T1F421AC0CB1C0DF9A51766631E73542C1EDA005634177A0F0B8ED22635F71CDA0AE73B5
MD5 SHA1 SHA512 TLSH

Submit Download

f3klrvfj.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\f3klrvfj.newcfg
Size 1KB
SHA256 7028557df7c523fd4dce9a49c4be386162900c0ba2cd1fedec266813e683a485
MD5 71fd65cd636e13e7090b598e7a5f733f
SHA1 a0eb4a691ff7d2f5ed61f26fbe342b02579f8ba7
SHA512 35f03ba4d6ea4cbcf3d08ddb8729383fd6dbb7a4d58451889cf0ecc0c67a765dd9cb8a1797c995fcce8985f0f1dbec6582c2a2163a1e985f660a2f2c8215817d
TLSH
T1F931660CB1C1DE9A517A6A35E73152D1FDA00563417BB0F0B8EE22635F71CEA0AE73A5
MD5 SHA1 SHA512 TLSH

Submit Download

fcnemy23.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\fcnemy23.newcfg
Size 2KB
SHA256 d80e209fceb820f7161517399eec5e4086feafb09e4465391f7447781be77c79
MD5 8188e5ddc61a78a3c42a7af9e54e282b
SHA1 fc01f8eae4a33ca6a0624007226a029e754c4e6b
SHA512 f03d4d99b9e375c6f1af9dc92e123d529a01037edaf66c2dce7b78baf92d7852487260aa2730f6e538c947c45195c8240ab7a4bfff0d1c4bd0441d8e4d6bbce7
TLSH
T13F51760CB1C1DFAA51766A35E73052D1EDA00663117AB0F078ED31635F70CDA4AE33AA
MD5 SHA1 SHA512 TLSH

Submit Download

klgynapq.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\klgynapq.newcfg
Size 3KB
SHA256 a6986a015cf9067d06191f16b28c7fdf1299a1fb792dfc36d97d12884b53e530
MD5 844fd769026255e11748de775b9af839
SHA1 be396b4620c2810e7d1806d633229aaf943e5149
SHA512 7c690bec4e4dee92ca93498fca43e5b26fc0f2c7d17815839068fb95c4d61552ddb23ab8d186d7782cbef6879be26a19d055e7235746fa0f26ce093dbff9d82b
TLSH
T14B61580CB1C1DFAA517A6635E73152D1EDA00663127AB0F078ED31636F70CDA4AE33A9
MD5 SHA1 SHA512 TLSH

Submit Download

l2e5dosv.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\l2e5dosv.newcfg
Size 1KB
SHA256 e7d76ee95d9fdffbb7c7d31d23a87cf821fa4fb29f800ba46b0dfbe6aa052321
MD5 d500213899ed7f464f37af312a633c7d
SHA1 cb4412aa8e78945cfeda74f1c779602881c144c2
SHA512 817809b0cc07716c44d11060166a9b4eb3fbf3ed38769664655483ff4a14793b807af73476ce7f378e72b142c968d10528aa4688ba48108ac2146aca52f015c8
TLSH
T1C021880CB1C0DFAA61766635E7314281EDA006634177A0F0B8EE22635F71CEA0AE73A5
MD5 SHA1 SHA512 TLSH

Submit Download

qkxy2nei.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\qkxy2nei.newcfg
Size 2KB
SHA256 d60fd64bc29c2ad0971ae20e57f1bbbcbbb7e258e2854c7f2ed47f67ae68bbd9
MD5 832776e84c1e2855ce9e0e8fac7c0522
SHA1 49c8332a59ccd959b17888cfd0d8052d1c4977c5
SHA512 1f825b3ea48ea3918cafe4dc6bccb31dd5b64b559ea0b02a31abfb64fcbc59ad73194c8d8a24a1e20ac99786a458b4eed37a4171c39bd1d925c728d25039342b
TLSH
T19E51560CB1C1DEAA51766A35E73152D1EDA00663117BB0F078ED32635F70CDA4AE73A9
MD5 SHA1 SHA512 TLSH

Submit Download

sv4lowvk.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\sv4lowvk.newcfg
Size 2KB
SHA256 e20cddad15b25a21271e183873b6f6820d83098ddd01986f6546882bbe380e32
MD5 e077462d48885002266e255777a8fdf6
SHA1 7aee44a33327ade89f1c0bac39be961fae7af27e
SHA512 30a2b42619e7e6cdd58e088414e97f38d6855affd9e56a1a1928e2156d5c257bbd2df20554551af685cf30ce2849ce7e3bedf3af9c103d7a3d4cafdd21f39ca5
TLSH
T15B51670CB1C1DFAA51766635E73152D1EDA00663117AB0F078ED31635FB0CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

t2unvpql.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\t2unvpql.newcfg
Size 2KB
SHA256 66c6361174e864463c7616512b45d84f5e89d32ffd7662dfeaf1689d83496cce
MD5 3a8423b3d780a16ab1aaea687ca463ef
SHA1 72570733d69f00331febd423dda8ab63225fd66e
SHA512 41e46cfeace17e087bd5573b8c291323b39b8651842afbb95b14ff23024551acb9f8ddc1312aa1cbba51ae1c9f30ee6bf93b722de8370ef0ebe16db4e0155d1b
TLSH
T17851650CB1C1EFAA51766635E73152D1EDA00663117AB0F078ED31636FB0CDA4AE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

uo2y4xsy.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\uo2y4xsy.newcfg
Size 2KB
SHA256 df004afabda9762e4d97ea508bd904a0c17a3a065727446ddad0ead7e29fd1cb
MD5 83c6546c27edae018bb6ab3ce324a69c
SHA1 3ed50aeee99c16b5b844d7a5d498423a22e379fd
SHA512 8c4c574070161ec6a46f5995d87a388f96ff3eb27a548dee6ecc6d86bcbcf7d935cc47263b53b49906d9880fd734dde8c608b5eab0926e8543826bc40cc92f32
TLSH
T16141660CB1C1DEAA517A6A31E73052D1EDA005631177B0F078ED32635F71CDA4AE73A5
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\user.config
Size 338B
SHA256 19af84c48a15820c94367390d58588ddad8164b0ac4056c258a766c726329550
MD5 0a35fbae99f45bc0dccdb777ecfd0436
SHA1 65e295fde91f90d55b107680e060895654fe66e4
SHA512 db3a0973a373c039603c750f0f196cbf65553cddb83739f1942402eaacbe178a775be87c4b034feb706830ae69d20158c3e3ecad8d5d3febc45146b487c3c42c
TLSH
T104E0120851D05D5B51715A22D7294684FEB02A93D0776170FA6D27734B614852BC73B1
MD5 SHA1 SHA512 TLSH

Submit Download

vgvjlzlu.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\vgvjlzlu.newcfg
Size 3KB
SHA256 23eed13a9a8344c1590290454c24562be8955f1cd0105a710b5f02d0bc072fae
MD5 ebea23960f9969876e94206b0a0cc0b0
SHA1 da6a1f2f3bc2d5832a6adb376928d031af906d7e
SHA512 aa32bf4558c6ad28249cc1c3537e487e4bc11fe3b322f4d651c1cabe1e888045acb7671f99be8a9c59594b211dfabe6cfdd5122b9eabbf698294675b76727ec2
TLSH
T13061680CB1C1DFAA517A6635E73152D1EDA00663117AB0F078ED31636F70CDA4AE33A9
MD5 SHA1 SHA512 TLSH

Submit Download

xbazulsc.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\xbazulsc.newcfg
Size 2KB
SHA256 4cb36f86f6516abe2fd4f945a4aceec478041082d7b0acfbf83917f9d712ce60
MD5 175e89b536514f38534d0e7b4d22761c
SHA1 ff298424aa64c607b8ffef32b58704de1cabfc6d
SHA512 b350d8f23ea6797a5a809cf3d09665fa7c3ced7686d0449164fc7869730fc0b324e2801202de04685ef81d7634c552b2e793f9ab351960cd3b8c80f30d919fe0
TLSH
T12141550CB1C1DEAA517A6A31E73052D1EDA00663117BB0F078ED32635F70CDA4AE73A9
MD5 SHA1 SHA512 TLSH

Submit Download

xmmjuczn.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\xmmjuczn.newcfg
Size 3KB
SHA256 533710a77574a985ca3f46e8565999b43b4d12c45d749dd3366f2f91c3c48964
MD5 c05fc73f78052934b0a29769208f6bbd
SHA1 fab6fc1568fa8072f8594029834ef051aa450aae
SHA512 4e159bc8894f5ba09e149b981f87004c27fdca6f438a4b9f22fefa20dc8274fe22edc68869f33173511f15e900ed4f7d8199cd37f6a5b1788a0008581e6ba490
TLSH
T1A451880CB1C1DFAA517A6635E73152D1EDA00663117AB0F078ED31636FB0CDA4AE33A9
MD5 SHA1 SHA512 TLSH

Submit Download

zpc0gkyz.newcfg

Path C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_kleyaxrtenldtfqjmu2cbjmsn1otpqzk\14.905.30.48908\zpc0gkyz.newcfg
Size 2KB
SHA256 d30fcbe769abf1145aa1c1a77f6d0fd6a6965c3aebd2c28010968af4926b59a5
MD5 9c7e9de27578a71de30eeada432bc2f5
SHA1 b356bb17af69471e21d5ea5973bbc4aba374c34a
SHA512 946d7df9397e33ba677090815de3fed402b2ea0c72f13a0bb359ea78624b6b671153ca622b306438f858b6a4fa82a4ca9c655f9c2f7f9068d1b0a3c9053fb571
TLSH
T14551650CB1C1DFAA51766A35E73152D1EDA00663117AB0F078ED31635FB0CDA4AE33AA
MD5 SHA1 SHA512 TLSH

Submit Download

is64.bat

Path C:\Users\Admin\AppData\Local\Temp\is64.bat
Size 181B
SHA256 e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559
MD5 225edee1d46e0a80610db26b275d72fb
SHA1 ce206abf11aaf19278b72f5021cc64b1b427b7e8
SHA512 4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504
TLSH
T170C01215B349C95844D4362F14B2908EA6BF058A75F4EB500B91C4A694C2419E7F5213
MD5 SHA1 SHA512 TLSH

Submit Download

ICSharpCode.SharpZipLib.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
Size 200KB
SHA256 c287e9b07a8251828f35914364c89a37db606b0c1d64457f9eb8fa2258f0dee3
MD5 d59ef46a5f01ddfe7eb691e6c725a247
SHA1 edf2ab9ee284fa21dbb55e93d082848e800f068b
SHA512 8b5b622618ddc32695cef8f0744c548e5068a908794caeef3286f5a2f521ee2bdc91fb63e37ce211147dc1feb8777da1e029f0ae8c6dd04b061753832fea55db
SSDEEP 6144:E1uYsjrFIzmuxpOI/1MvCdRbpSISC8j7s:LIzm6pOIgvr7
TLSH
T1E0142924B7FC4A67F6BE97B8E475908087F5B9A6313EE75E5C0094EE1C56B6089003B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LZ4.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll
Size 49KB
SHA256 80206b2f6a20aa6337e642feb7475e86aef03a01313e3661fc33950d391747d2
MD5 e630c18daea3ac1b86d1b62f1214f7f2
SHA1 29c3b54082a3742236eb85b857c772835da71ec0
SHA512 ddd8ad748c388529f283409340ed6062afe37a2a47906bda5b3f97928aa9057c2adfd6329ed6b6ca6043f0272dfbfcf04ff3dca73ff6e0e517b95e42c56468ec
SSDEEP 768:NU/9xwrB5acdEFUOI2QpNKSkqh8SmIuQsqkITDQINw/R5Yi+0OrA+hL5/p:caycozI3pAXbIpxOtf7+Np
TLSH
T134334B9567D8A856F7F70E30ADF49089873A7BFBAC76C74E3100442A1E21BC09D21797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.AppCore.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
Size 93KB
SHA256 42ae4a251bbb0cee293556755ff59eb21db8adfc236e0cad7c9f31a770727cf5
MD5 3e0438c08ee861035395b5acf8082e78
SHA1 9e92de14c3ac399a8c7ca9452a41bb42a68b1486
SHA512 e8716500f3ac0d7280522cc58316e0b58de514ec4feebe667c220316721b0e98e56982d3f528fd063bcf2ec9b44213c5f90dedd6f6ae14b425244a88d481dd74
SSDEEP 1536:IDm57HwVkmDzk0pI2LNZp6bEtUhPI/K5PQqtHAW7+kv:n57WkmDzk0bZp64tUhPI/KZQqtHAWjv
TLSH
T18B93092537F48629F3FF8F70B9B4412C4976FA4B6921DD6E059A604E0933B449DA0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Browsers.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Browsers.dll
Size 112KB
SHA256 fbb74ae4725eea078d96d95da0ebdef6d218e3f2c28c9d279570f7ebd682cf61
MD5 d7e0d1aba8615f5fff57c2af70406ab5
SHA1 36b26370752c95202293805277fe3bdbf5d54743
SHA512 b0ec970392b0a8c7d8cd8b8ae8368dc5411f011b7a4237e8e744c9bec18fabb114c930ac4ee1a0157a010c5630cf4c4835243fefef26d5328dac8ea374baa405
SSDEEP 1536:YRf+B8km2AbDdJ/RkLcxM/PsC+RHBD7WZLnAGEYdTgKTMERtUiS6637+:Sb2yRXkJPmRhD7GAc9TM2t3S663
TLSH
T14BB33B6A37FD4A15F6BF5F71B43451620A76F68BAC12E28E0944B49C1E33748CA50BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Companion.Foundation.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Companion.Foundation.dll
Size 131KB
SHA256 929caeefc201c603db1a7e90af2831ae31175b17c5ba51b5b6bd5748e9cf9cc5
MD5 9e464149100742fc41ad551ed331c232
SHA1 fe1ed60527187c9d39bd462cd623e797a8438dfd
SHA512 da8beff4f7ab332474269be4b0217f8044e80386cbb06dc27a8fdbdf34e6edeca09d4a4f000ad564cd7bd81027915f0eea2a0f1f049ddcb730c193d978c964d9
SSDEEP 1536:OWs5n6SgPgmOxecXY5x68V2/iTLl0OIJq5TWoEGWgMO27WRHCCm17+1:056Ss+eMG682/i/4Jqzy5cHCj1y
TLSH
T19CD3F72167E8912EFA2F33B5BFE4E576C62AB2CD5112C57B389C74CB071170166227B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Companion.Platform.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Companion.Platform.dll
Size 44KB
SHA256 1d6664ecd8928c8f9ad55e5bf1a349b28bd2c5fc3b69b628f4d55f3866bdcac6
MD5 a181c9ba9e4d9b9e0b11f8683b5c7c42
SHA1 4df5647f5822788297c299f73477d395a986fd26
SHA512 20e33f032fa22435a6f943a6d8a4d3b114fcecfcb344c0e17cbdd9cef19ff495e10c2e16b049ba6ad52f90b7965f8a611ce73049b84cb9e4dd3c3158a1759070
SSDEEP 768:J/WNEC7Dakii2ZXvbPhMo4y8laAXKuC/5Yi+yZmrA+hLS5:J/Wthii2ZXvbPJZAox7+yZ5
TLSH
T14D236B0117F88624F5FF5F70BDB145120EB9BE856D31EA1E0A84D49E0AB3781AEA1377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Companion.Services.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Companion.Services.dll
Size 172KB
SHA256 75912b177a8f359e7ab4e4f29efef0604f9ff6635fda555bd6d47009b79e6089
MD5 d95921a4b486ad80dc38099c507d98d7
SHA1 52b80ac42dd67d501bc8bcd5aa784f888116d097
SHA512 128eeca8b7a917e9ce016102c2daa46980d746c2f2c118c7e26db70a81dead4d6f62e19819862cb763d44b1f1e76c786f85dc648e17225819c2affb302b224b3
SSDEEP 3072:cV4uBIhuG+U72cD+6bV+fDgmjZRbuLuRXtcPwcoHMwOn:cHBIzhq6bVeMX
TLSH
T17004295527E88A18F6FF2FB8B87001158FB2BA67E972D65D0EC5508D0932784DE507B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Companion.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Companion.dll
Size 2.2MB
SHA256 5a8d734389609b4198bf52cffa7342dfc0116e9175f8cb82a6bb6b4cf841af2f
MD5 d12b804001e1d7314cfb4b41eacb0f77
SHA1 34d41dca44867b52979d80838b342b0410fd19be
SHA512 9aa564192be2a3ab6efc09b2ecd6a46fa4a6b0a43f6667078a92257a9c0bcea4403e69edf140042c7ae2a62e1a3c3c22b9973f8e4db0264d8464bb5c05f2811d
SSDEEP 49152:AZknpUEtNW0bz8jrDfulrQ18TpysdlJvcyy8ypEPkCKi:iknpUEN0DGl8ItJvcdNjv
TLSH
T166B51202E6B43425D2BF5F7064A5104199362EC3A5E0CC5C3ACE9C8E6F567C5BE2A3B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Events.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
Size 131KB
SHA256 4668766adfe888313d1cdb66852d738d316bd2d60eba2edcc548bbdfddf686ce
MD5 05e216a0ca6e5e2cd7f30038c8e16103
SHA1 4fe33fde0bcfa6a94cd4cada928db23e9e19e24d
SHA512 943ccef18c9479344ce66bfd9e3473a97dae313a616555aebe9bd4aac48659948ef25d38767f61c884e51d6b9903d78da7574316c0916348563e45a477f5ae30
SSDEEP 3072:pbarxoVQnvajX7+HDuPNTyBAL/JjI644iQybZf8GG:xbqnvajXaHDu82
TLSH
T14ED3B71117B8C35DD6EF4A34F23448354F71A549B561FAB5EB80EC9D3AA2702B4C0ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Notifications.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Notifications.dll
Size 416KB
SHA256 d2b2430572035bbcef0d8d58d44e1fadcf8bae8c3bfa32095ecaa161fbf497b9
MD5 fbccc5146ca739e42640f9e36891a409
SHA1 f6e02ba80d9f58d9c982ba15d5f879023f898d33
SHA512 dc9067effbc3d47c8b4110433b0ef05c03d4c48f62f22629c7dd861970c08e60621af2b2787393b1d8fb2ad93c4d0bc76b2b03f045ecd9812fce9e68624f5178
SSDEEP 12288:9ePgNd+IMyA9T9DIisQaHp9KDYHWrzDs0Pv9JaC/7aDvsi4EJ:9Vpi7JDQaUfDkA
TLSH
T1EA946C11365D162EF8AB37B05D188254AA3AA2D911C2CD6F345E388EB797305C7733BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.SysInfo.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
Size 18KB
SHA256 45d6e8f62d783ef2f95de0e0fe0bda891c5e78c30c6594b9e9844e85f43180d5
MD5 f36c7e2fd2db361b96c8764712ca48bc
SHA1 6910e9fe848b876c010132fb35e6284021d1c3f4
SHA512 dcc8b5fa468e95870291ac4f3edc466c393964f78279e13a83902209cabec7070f25925023df01cedc1a176353d9ac45c96d45bf704c53df3022df2954322bc3
SSDEEP 384:dH8gM9RwHQIYiBGRDFfrA+gmL4nNyTVa:dT6Y5Yi+RrA+hLna
TLSH
T1EF827E33CBD44C11DE2B8D74B4E182339AB5BA866ED1C2D7614DC2190F613866FE93B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Utils.SqlLite.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
Size 22KB
SHA256 b6c2392862432234eb3bf0111ae78b0a0a2b3fd064672fe31e52fb0b1d67a477
MD5 4730a6a8e928de7d013d60a32a7bb3df
SHA1 f37d318d40891b60358e303f9903a5e51599c29e
SHA512 2a72ba6bb061a6a0c53527a66af816f9580295330a2b432a725dbda966ea3d29467063cac60a0db6c4759d1074c0d076939371c860c75bf9cababf2e026d44cd
SSDEEP 384:Ex0RjA5mp2Z6We+tyM2JHQIYiBGRDF8rA+gmL4nNyADA:Ex0a5cy0HN5Yi+OrA+hL
TLSH
T1F6A27D4287E80D04C92F6F7474F1473656B2BA429A61C2DF188CD0679B627829BA73F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Utils.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
Size 93KB
SHA256 aaf68ce04bbff1aa92ae35230c975132f3921cc6a7dacf4dd8cf3b6f59fbcaed
MD5 8802411df0bd170487cfbb45464e8675
SHA1 58d36f02f266ee15064d7e21a64b3ce0df8dd69a
SHA512 b6049d5c6657167ecc5dff52574887ae1f8a3e5136f8b65ce990c6e23b4488904f644fe157c473c0f9c86738c40e9d5f5ce90162a1c7b3b60f4425e5f9735286
SSDEEP 1536:eCXQWbVjakjflC1vfiakC7j7mbsCct7t2wxGrlv51EheZp7+v1:eCXQWJWMg19z36bsVt7tRxGxaeZpO1
TLSH
T1C5936B1137F84A19E6BF4F3478B152254772F64E29A3D75F2984A0AD0E63782CE247B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Notification.Module.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Modules\Notification.Module.dll
Size 26KB
SHA256 e5a8cfdd948055a41f4555d0689369d51517ea119654d58f1afb4bb7fa193f29
MD5 ee80870eb3a8ad40e41c70ad532811e7
SHA1 2889029214f67698fac2831f65f0e254d057d9dd
SHA512 d923c01420b711b9a15a310226a63138d5caaa5ba5f73a87d98f23aa205d64591b11ab2b250f017d94ad647d29b49b8471d3c9a398155256a1f68eb469873fc5
SSDEEP 384:2IvDT3NwiJRwVDMb5A66qJGR1egqHdHQIYiBGRDFflpZrA+gmL4nNyfgq:H9wiwSdAdqJGR1eFHB5Yi+RlpZrA+hLX
TLSH
T197C26C1647F48529DB5F8D35F4B041314EF77E9B3A03CBD28A49F09E2E62343520A5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll
Size 283KB
SHA256 5dbe1880ff1a8952990245699aedaccb0cde8f98f59cb477083959e870ed85fa
MD5 dfa8d1fb66f62b64f2eaa8e2c5d05127
SHA1 c4c1fd51f5c388be0cd5f0fe9a5bc4d03e310369
SHA512 32494c137e47028602cc2404a522251c9e12534c75f4ef09195dbc71a12325f1164754422484e7ed4a0407e03e94d8917f624858dc680cb1783d4cbcce64d95b
SSDEEP 6144:AjM6Mb15iJrFxrFPs2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFu:Aj0h56rtFNFaFeFOFwcGF6cmFWc0FWca
TLSH
T1A0543B6533ED1A0AE2FFA778F8B0165187B0F8964627D30D7CC060DE5D26B80A963767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion.exe

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Size 19KB
SHA256 81daa4e6e5641fec7e5a8b3b0afb24a9b6ba384555afef9b8db294b6b7fa0c74
MD5 8f110c4909a8abe91a5714fd87537cec
SHA1 40ea0e3153e50e44d20090fcd9fe7ccbb65b8817
SHA512 6b7658133f40ff08d05b0b84b599c74235aadf8aca55979eb6127fc4ce7547baa99a488f0b38d125c0850f712b73a6c55032d01abb70a9689013b64288ffd15b
SSDEEP 384:ut4hVK2OIzYcHeMnHQIYiBGRDFKrA+gmL4nNyDn:g2DzYcHeMH5Yi+grA+hLZ
TLSH
T1D7926C5345E41921EA334D3178D59332FF79BB565D90C2EA300CC61A2F623879BA72FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanion.exe.config

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe.config
Size 11KB
SHA256 20f5a049439d5b5792d8db2298e377dd17a79da798824ee31c7a87ec7d4b4bb6
MD5 f1883e0674329ad012dd34ce5f2c4409
SHA1 dd06f7a443355bcd8a92fb300056fcd23e9094cd
SHA512 d9a07e7681d3e6b5ed2322ec5731f51a4849408f6198cdb02ec89b2f4090d03fd7200c2009b6f56989c404a339b73eb2827344924d24461f6ee8e7d4fd2ddde0
SSDEEP 96:TrDVIiINMvAvJvHvvVyU5ToF4FkDdCAvpNAvbAvubhGvvgJ1oraAvkAvPvovOXiV:TrBZ8HZg0w0gXUjrYdnB1Bf5+Dzvd5
TLSH
T18E42380CB1C1AEAA11766631E73152D1EEA00673127AB0F074ED31676F71CDA5AB33B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCompanionIcon.ico

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionIcon.ico
Size 23KB
SHA256 9733ed5e1e2caeb0986f1d46a052b2d4bd8cd6b041b9f57216f12410605e8455
MD5 1dd04466644e96e0ad308d1e637e9621
SHA1 0c7f688ca482fcd1fc9aa7d7518a5bc844875cff
SHA512 a92ff0a1b92b5b689bfc36a807f02d79b8dc3dd99971b3528aafceb8c1fc2dbc67bd170990723b34b26ac4ee7516efa6b218c2ed1d422a422ede7cf5fb9a3da1
SSDEEP 384:Zw3ziy+PnXdyyyyyyTOh3axqTS1mH3dS4w:Zw3zeG3DSG3m
TLSH
T111B260937ED6A605D82A1134D872CD7103AB7EC78463B417A9E5BE3B762B40390B0D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lavasoft.Companion.Foundation.resources.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\Lavasoft.Companion.Foundation.resources.dll
Size 40KB
SHA256 775d34e05dc861277631451cba0ab5f1c5ebb9c84ca5353a54288e29984e4b42
MD5 893a541e767f6d99ae895f337b05803a
SHA1 e7e441c318f09a0c1ac1047c355a2ceea997ee21
SHA512 9c9d7cbb016426a34bf3705ec207cbd9ed46631d546a8f6bbd9ce1c8c9bf409366d39887dc10456a4fc5c3251251bd1794da8dac20f9f670a61a1a375a1cd7cb
SSDEEP 768:4EFkZNh8HRvO/sKVWG7Q7txmSoeoWJpQ0qere5Yi+CzrA+hLkQ:w9ShoWJ+0q+U7+o
TLSH
T18E030726B2D8313EF52235B1AFC9E6BAD766F1E58303843A301EB61B17419427B73179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll
Size 308KB
SHA256 62aae1e0233cca4c8fb0c638c0130ba1c96ab603e75f02c222ca5633cc3efdf1
MD5 7a448d7112462aa6f27e8127eec96440
SHA1 3aa5ed6a87173a5769ca4e05ac176f7df30e9676
SHA512 0dbba3a571674b50ce3c0136c4e29166e6404dc631a5657d1e19c83200c0dfa0aa330a6b22d67503456780e3354200a0ccd437bdd5d22d1e737de2828fc65abf
SSDEEP 3072:CXxS1BlhpHVH29lf9VkYguiOZdASSqBZY5osy2GzyVV0fDVMnIt71txeNjagRXh+:Cx+Sko3io2GzydAtMwgRR6+8Ow
TLSH
T11D64181527FC4B1AF2FF1BB4B530151246B6FD4AA83AEB8F9444A4EE1C63B4498507B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLite.Interop.dll

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll
Size 1.1MB
SHA256 c3415a80d0e41e06fc7f46fcbabd4d6f4751e3a5659106f9643ac054920a9250
MD5 d4ab2205f78a021cb3b631e2078e38fa
SHA1 dc8ea7baa6ce618f2efe9811eaec6871589deb11
SHA512 4c41a4cc8ee4ecb7f1c90f90d7685d9095255dc7e0010b7ed737b33c6471e262a21de8507ed5a57558d917c35bd75335d5ca0df9bb0ee2f50c1a5b243d4d6198
SSDEEP 24576:T1smp+W5MPcaLeaO0PWRgBidFqXlNFwfK:BsiaBO0PWOZ
TLSH
T1B0357C87F2AA01ECD5AB8178CA568607E7B1744803309BDF56D0DBA92B13FE5667F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiveFeatures.zip

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip
Size 349B
SHA256 caf5cad9dd6166c4d1f2a55816d856655ab627a9ef15516e38306dc084da7d60
MD5 37c996359ba17e4748083b1938ef131e
SHA1 f6ee012be91b05638d78696bfaec019dca34a74e
SHA512 2916f5aec5efc1e4cad77dc31f1432dfed852c98c7e7f92e8450d2bdd84b0fa023cd7c6f5a4312230342521d9e9c596853b412b4f5c28b0b1808bae07b4dc013
TLSH
T1C6E0C6E103C69980DEAB01F840720AF82FA7E49A2812E9631124480805AD7DE2C0A2AD
MD5 SHA1 SHA512 TLSH

Submit Download

FeatureActions.zip

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip
Size 166B
SHA256 41e279432081268dc6bba1ab9c0beb0e62b12961ea140c1d0e31ace61ea79aa4
MD5 268f98d2ebfbc8511dc160c8a4573b57
SHA1 fda3dbdadf08c18fe288ad74c36fc37a69939a94
SHA512 8548f48eb207ad42f06011b2627fa67e291747c4031db92b553590d95ce686ec47e1c1f5efe0042a407fcb907340d632c6d8e1d877fdc92e4b71d49f2944ea00
TLSH
T109C08C0A072110C2C48B63308BD74ACC2E349D9E0A22228B0A681010CC533FA2DD7A49
MD5 SHA1 SHA512 TLSH

Submit Download

FeatureActions.zip

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip
Size 552B
SHA256 e18c542b6fe0db8db4ca48d1aef7387945cc6ff9640db03d066d59b85f9f025c
MD5 4e3cc773afa72591ee5d8ea7d7692f7c
SHA1 ca2f9375d03c067b74ccdf0019db5ef30e6b254a
SHA512 f4f4f1c4e7781608ecbfe4dbf4132e1e359c1eee3b83d92c60a5c1a973a8b7033ea536fda90dae15894b1e75f1586e63525daba57d18f10d03b1a0cd71cac560
TLSH
T162F0264E56B310CBD48E94B244D715FD7D8385034621016F1A9D001854EF29F49C9161
MD5 SHA1 SHA512 TLSH

Submit Download

Language.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt
Size 20B
SHA256 05a960000c74ca2f31fac1800e5156e2e4d04a78873f005218aeeb8fbacbbff6
MD5 3e682eb51baee9f27b0775287510ac6e
SHA1 0c62c14b2d05af414cdc225db43b60e79ec7b280
SHA512 885ffe4359bf0fd7793b304312c7c6c3e36e767490d0ee542be5b41a74e8c4a2567c4929bb0c4bf8021a3f07ed97cf05f3feac224b79bd76a0aac9f3b1bd3a06
MD5 SHA1 SHA512

Submit Download

Partner.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Partner.txt
Size 59B
SHA256 98286bc1c1598b77019f3afcbd9405aceaee7f6d23f658f22f8b89e6a7218b93
MD5 4959fdc170f886dfcae94fa7b34e1645
SHA1 0c485bf0fb97e13869db5a678bd519ecda25770f
SHA512 db4310d1dcd88a2ddd7b3d138e49bede0589e34a4408b331e5414b6a4d3605a06aedbca65f3670c08cb2e2f2914ed41266b4a3e12e4dbc002603b244355603ba
TLSH
T1BCA0028529D2581125564ED78A33496530A30F5F19995498649C3F72946F825015159A
MD5 SHA1 SHA512 TLSH

Submit Download

ServicePartnerInfo.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
Size 202B
SHA256 eef236a5ca691ca724e768525c19951d802e3a7f668bcc1648d2a7871e067c6e
MD5 59fe5f87a06e1d89673a14a892d40f35
SHA1 71b2840f8faff9b6cb35a93f160210053b2073f4
SHA512 2675e8ba78058d62de1535a66b20734616e18dd794dd290e6e6eb5f5f6bbc235a8a06a38d2b3490455b5f7976f95caf381cb01158d06a364414557e9f5f902d1
TLSH
T169D022032A4BD8F0E4E045C6AA084EC42DF37A66A0E82899AF4BA2740C280390902A0D
MD5 SHA1 SHA512 TLSH

Submit Download

Statistics.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt
Size 56B
SHA256 17d925ce27cab02f44e710770dcd938cbbfdc9ff7668bdc5320ea3d56636f622
MD5 b1273fae264363c006fc117847a9907e
SHA1 a45465ef692e912df7a898ed6281d8f7c40d69a4
SHA512 0f463c964246d8da1e86ca1c235082270c9b7080bec2d0a6b5862af26292eeedc88d88e0579a12d349616a13839416a47d610f94d59daed6072a5ea34f050447
TLSH
T1B29002005282382978D09B2042576116494307A23C0200831D820953575F9552741BEA
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateServer.txt

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\UpdateServer.txt
Size 26B
SHA256 50e3bd90035ca49b3c57050681449c20953f4efe5711bf4e02e23f2b63968388
MD5 cf85989b75515ff6cbaaa6dd23d3882a
SHA1 3fbbecbcc28e2d4de5764388bc544db47ae9957d
SHA512 77ac3fa88b08c136c29b907cb1c9b096ee7f97bde3ec8d6c9382ca9e74060a065ef9aefc488a5319e9d1570522056584250be7abd5ed582e8b4d16f4143e7527
MD5 SHA1 SHA512

Submit Download

statistic.db

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db
Size 2KB
SHA256 fbc1b48ad065ffc621802c8785bc4477adde475f5c2e384b1126eaff018554fb
MD5 82ed8abe176448368bd9153b92bf4002
SHA1 59a481ef7f065ad1a0aa7bdd3fc78a65f7790f57
SHA512 bd96f5e546680ea4affd157cf4aa9357e73fde6e861a2aa04277c9c87b982f45f6030f2dccc01d6ffce08d63ef1e2e6cd91a2e9ee811a2d53b55bdac01ed41c3
TLSH
T11241CB0902C12ACFC6F341B280C282C246BFC619C80BD02A27D604898A82B8D3F0B664
MD5 SHA1 SHA512 TLSH

Submit Download

notification_bllist.txt.tmp

Path C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\notification_bllist.txt.tmp
Size 175KB
SHA256 744fa55eb19f6e88e6abcfcf9c83c43a31482ac1b507f194d0735afca7620924
MD5 0f3ca545680194aa07e79662aac094d3
SHA1 a6856da5cc8f2d501f1c872484d962177e2803b3
SHA512 718a48b6e391328190be385a2c2c223a56abc6d0e489c8097089d963b52f1d222ab5845e4409626b4995eb030906581499250c6ba8c96c974272734aa0ad2e29
SSDEEP 3072:n/KrPEZjF6WXCfTjtAJD1OD28zmiJn9X/EcZRM/xwbjltvo:3F6WXCNiD1qNzmiv/EcKxwbjXvo
TLSH
T124044C8F8D282AB927B20579245D278F1E05052A8457EDEBFDFD8A053141ECD31F4BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02b376d3-8f55-4a8f-96e7-b5b933fc390d.tmp

Path C:\Users\Admin\Downloads\02b376d3-8f55-4a8f-96e7-b5b933fc390d.tmp
Size 4KB
SHA256 e93ef867380dbfec22c5683cefff218cf7f38c2fd3632875923c3cce12da88ae
MD5 fbf5c946a9a71e093bca6e4c495151b2
SHA1 db15e005321630bcbcef76a9506ede82b45ff6b9
SHA512 e8baa4009bb6604076a8735edc021826e3b2765e0f916c1992f9d84e93f7a503b8d7ecba86f0bef2114fed8a20c1db81d1146895cd71905231c5540df0f89c79
SSDEEP 6:idqgHVg3F+X320m7/fCewtTVchftelXfsgNEAvlXZkel8lX97W:e31GSGweYGhV6Xkgj9X260X9y
TLSH
T15B817D9B87C05FF1F20C2175460B424033D9E4341AEF830B4DCD01262EEA4981CB5E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dd95903-c895-4c0c-9bed-e6d7cc09ca76.tmp

Path C:\Users\Admin\Downloads\6dd95903-c895-4c0c-9bed-e6d7cc09ca76.tmp
Size 13KB
SHA256 5f8c390ca54d34bc339ae88753b9222ca90c769f89c318d4cf38e292bb2735db
MD5 5c20c54eaf8462a261bccf6566dd7a5c
SHA1 e8ee8181c3fa34b5a9accaac958b2618cb95e0be
SHA512 8388719e824f8c1f7023a83163a448bbfb694ef758f765cd9f13432aba74d5e7cb3ce4ec9e7f0fa4ae254abfaf1666b24140b41384652aa2c1b31a067874b94a
SSDEEP 192:K7MFAlSWN5OsEL66wdL0ixcLmOLCDvFe0quIdyDV18BP9LND4OgucTQrBaEy+v:FAJ2PwhcLmO69e0qfwyvgDCBzv
TLSH
T1B0525F1D965C1A0BC36F41FFD087264AC3F868632784D7E49ED240F4CAA7BD38945BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\Downloads\Setup.exe
Size 664KB
SHA256 e60746c900b3e92b981944d94b82b3f91ded39fa15cfec5ee17c700e3a354390
MD5 ed4248b5b9e7fb447d4dba7528b1c98f
SHA1 249a0c6fdb7e49a51114ea807a0e7363b6aa9c86
SHA512 0bba447cb754483d6c7600c8fafe221496ac63da6d8aff2b60537863ab99b808e40f782cfcaf93fc837d1ef68f70bc330f2a56c2d397672db40a0cb02ee1ab62
SSDEEP 6144:Nf9ndbZ+fy6g3IuFKUIw4cbfkiTMoWsHiGYhTdBWg0Zrt021uYsjrFIzmuxpOI/H:9vt6G3BCnwMoWzQFgJIzm6pOIgvr7
TLSH
T1ACE46A50A7E80739F1FF8B74E47568558BB1BC53653AEB5EAA0168EE3D22341C921333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robux.exe

Path C:\Users\Admin\Downloads\robux.exe
Size 80KB
SHA256 6fe846b39eb02a7906d157eb5303cf02b8d3768faf53266e88e915200cada84a
MD5 3ac452a86970a5dcd7872e77fb41a7c7
SHA1 c26230ab4aec704d354dca5d09ebe47e4bea07b6
SHA512 5c7d44d2ffb99300954155a02cc5359769c27d858220fdd56773993efa578902a05311a2682dfabaaf12ba29acecfa4823c5e4edd4ebdfb2cd05eeb1b11e1487
SSDEEP 1536:x8KU95KLwKNw0KPwQrDBt/mBd/BVafU/oBRUX:x8n95KLwKwPwQrWdpofU/ozE
TLSH
T14F837C02F394C572E5E7417212608FFF8A7DB13631022543E364EDF12E7A696991AE4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3300-812-0x000001F079C50000-0x000001F079C58000-memory.dmp

Download

memory/3300-446-0x000001F079160000-0x000001F0791A8000-memory.dmp

Download

memory/3300-431-0x000001F078B40000-0x000001F078B6E000-memory.dmp

Download

memory/3300-433-0x000001F078B70000-0x000001F078B8A000-memory.dmp

Download

memory/3300-435-0x000001F078BD0000-0x000001F078BF4000-memory.dmp

Download

memory/3300-541-0x000001F0792B0000-0x000001F0792D0000-memory.dmp

Download

memory/3300-429-0x000001F078B10000-0x000001F078B34000-memory.dmp

Download

memory/3300-437-0x000001F078D80000-0x000001F078DB8000-memory.dmp

Download

memory/3300-427-0x000001F076A70000-0x000001F076A8A000-memory.dmp

Download

memory/3300-421-0x000001F078DE0000-0x000001F079014000-memory.dmp

Download

memory/3300-425-0x000001F078260000-0x000001F0782B0000-memory.dmp

Download

memory/3300-882-0x000001F07BC80000-0x000001F07BC8E000-memory.dmp

Download

memory/3300-707-0x000001F079C00000-0x000001F079C0E000-memory.dmp

Download

memory/3300-419-0x000001F0766B0000-0x000001F0766B8000-memory.dmp

Download

memory/3300-444-0x000001F078430000-0x000001F07843A000-memory.dmp

Download

memory/3300-558-0x000001F079260000-0x000001F07926A000-memory.dmp

Download

memory/3300-518-0x000001F079CA0000-0x000001F079D54000-memory.dmp

Download

memory/3300-486-0x000001F079970000-0x000001F0799DC000-memory.dmp

Download

memory/3300-481-0x000001F079280000-0x000001F0792A2000-memory.dmp

Download

memory/3300-459-0x000001F078BA0000-0x000001F078BC6000-memory.dmp

Download

memory/3300-458-0x000001F0791F0000-0x000001F07922A000-memory.dmp

Download

memory/3300-729-0x000001F079C10000-0x000001F079C20000-memory.dmp

Download

memory/4420-333-0x00000264E83A0000-0x00000264E8448000-memory.dmp

Download

memory/4420-334-0x00000264EA150000-0x00000264EA188000-memory.dmp

Download

memory/4420-336-0x00000264EACA0000-0x00000264EAE62000-memory.dmp

Download

memory/4420-337-0x00000264EB630000-0x00000264EBB58000-memory.dmp

Download

memory/4420-338-0x00000264EAC50000-0x00000264EAC58000-memory.dmp

Download

memory/4420-347-0x00000264EB440000-0x00000264EB478000-memory.dmp

Download

memory/4420-348-0x00000264EB400000-0x00000264EB40E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads