Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1465336
MD5:	a081cff1d93f1bcc478835dcb98e7c47
SHA1:	00e6cb7c41860aeb346958192c68eb86b4015fb2
SHA256:	c0db81c7d38819926df96d6fb3adda34fb8783acede83d5f9bc0b681f2287845
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	34
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Modifies Internet Explorer zone settings

Modifies Internet Explorer zonemap settings

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Drops PE files

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: IE Change Domain Zone

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w7x64

Setup.exe (PID: 236 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: A081CFF1D93F1BCC478835DCB98E7C47)

WebCompanion-Installer.exe (PID: 2924 cmdline: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080 MD5: A27F9713DB1688D03D2082BFA1827803)

cmd.exe (PID: 3264 cmdline: "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone MD5: AD7B9C14083B52BC532FBA5948342B98)

netsh.exe (PID: 3288 cmdline: netsh http add urlacl url=http://+:9007/ user=Everyone MD5: 784A50A6A09C25F011C3143DDD68E729)

WebCompanion.exe (PID: 3348 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo= MD5: D5180525E08932A69DD1903AB30313EF)

WebCompanion.exe (PID: 3608 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall MD5: D5180525E08932A69DD1903AB30313EF)

chrome.exe (PID: 3712 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131& MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 4060 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 --field-trial-handle=892,i,15230702887778315927,1336726020721977328,131072 /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

WebCompanion.exe (PID: 3544 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize MD5: D5180525E08932A69DD1903AB30313EF)

WebCompanion.exe (PID: 3880 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize MD5: D5180525E08932A69DD1903AB30313EF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, ProcessId: 3348, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion

Sigma detected: IE Change Domain Zone

Source: Registry Key set

Author: frack113: Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe, ProcessId: 2924, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\*

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 3, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe, ProcessId: 2924, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2301

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 29%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.2% probability

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to behavior

Uses 32bit PE files

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3b791073-dd82-435f-9aca-0188b7edabec}

Jump to behavior

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

PE / OLE file has a valid certificate

Source: Setup.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.208.152:443 -> 192.168.2.22:49324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49370 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.213.94:443 -> 192.168.2.22:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49448 -> 104.18.26.149:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49505 -> 104.18.26.149:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49570 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49591 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.SysInfo\obj\Debug\Lavasoft.SysInfo.pdb source: WebCompanion.exe, 00000008.00000002.500116290.0000000005882000.00000020.00000001.01000000.0000001E.sdmp, WebCompanion.exe, 0000000A.00000002.687625687.0000000005A17000.00000020.00000001.01000000.0000001E.sdmp
Source:	Binary string: neMicrosoft.Win32.SafeHandles.SafeRegistryHandleonent.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/h,C:\Windows\System.pdbg source: WebCompanion.exe, 00000009.00000002.698165299.000000000734B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdb source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498778135.0000000000A22000.00000020.00000001.01000000.00000013.sdmp, WebCompanion.exe, 0000000A.00000002.654266966.00000000009D3000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\FeatureMainComponent\obj\Debug\FeatureComponent.pdb source: WebCompanion.exe, 00000008.00000002.498923676.0000000001272000.00000020.00000001.01000000.00000016.sdmp, WebCompanion.exe, 0000000A.00000002.654889215.0000000001323000.00000020.00000001.01000000.00000016.sdmp, WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdbwork\v4.0.30319;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe--minimize source: WebCompanion.exe, 00000009.00000002.653291843.0000000000711000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdb source: WebCompanion.exe, 00000008.00000002.498822779.0000000000BD2000.00000020.00000001.01000000.00000014.sdmp, WebCompanion.exe, 0000000A.00000002.654743759.0000000001202000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: symbols\dll\System.Configuration.pdbt source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A68000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp, WebCompanion.exe, 0000000A.00000002.654028439.00000000008F9000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdbp source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.653939764.00000000006EB000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdb source: WebCompanion.exe, 00000008.00000002.498756804.00000000009B2000.00000020.00000001.01000000.00000012.sdmp, WebCompanion.exe, 0000000A.00000002.654146400.0000000000940000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: HP/h4C:\Windows\Ionic.Zip.pdb source: WebCompanion.exe, 00000009.00000002.699775735.00000000081EB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/h@C:\Windows\FeatureComponent.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: u.pdbQ source: WebCompanion.exe, 00000009.00000002.699775735.00000000081EB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/hHC:\Windows\System.Configuration.pdb source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: WebCompanion.exe, 00000008.00000002.500224324.00000000061D2000.00000020.00000001.01000000.0000001C.sdmp, WebCompanion.exe, 0000000C.00000002.674654255.0000000005F12000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdbX. source: WebCompanion.exe, 00000008.00000002.498822779.0000000000BD2000.00000020.00000001.01000000.00000014.sdmp, WebCompanion.exe, 0000000A.00000002.654743759.0000000001202000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdbX source: WebCompanion.exe, 00000008.00000002.498756804.00000000009B2000.00000020.00000001.01000000.00000012.sdmp, WebCompanion.exe, 0000000A.00000002.654146400.0000000000940000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: @;h.pdba3a\System.Configuration.dll source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdbh- source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\SourceCode\TFS\MozCompressor\Debug\MozCompressor.pdb source: WebCompanion.exe, 00000008.00000002.499691802.0000000004B75000.00000002.00000001.01000000.00000018.sdmp, WebCompanion.exe, 0000000C.00000002.672124304.000000000558D000.00000002.00000001.01000000.00000018.sdmp, MozCompressor.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdb source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdb!U source: WebCompanion.exe, 00000009.00000002.686500640.00000000053B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140d.i386.pdb source: WebCompanion.exe, 00000008.00000002.501581860.00000000699A1000.00000020.00000001.01000000.00000019.sdmp, WebCompanion.exe, 0000000A.00000002.710914240.00000000699D1000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A68000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: @;h.pdb4e35\PresentationFramework.dll source: WebCompanion.exe, 00000009.00000002.653121001.00000000002C8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4 source: WebCompanion.exe, 00000008.00000002.500314844.000000000661B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdb source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.653939764.00000000006EB000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: @;h.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\FeatureComponent.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/h@C:\Windows\Lavasoft.Events.pdb source: WebCompanion.exe, 0000000A.00000002.695522692.000000000912B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.CSharp.Utilities\obj\x86\Debug\Lavasoft.CSharp.Utilities.pdb source: WebCompanion.exe, 00000009.00000002.688986564.00000000055A2000.00000020.00000001.01000000.00000021.sdmp
Source:	Binary string: .pdbRw= source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbework\v4.0.30319;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPow source: WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HP/h,C:\Windows\System.pdb3 source: WebCompanion.exe, 0000000C.00000002.681810767.000000000762C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdbm source: WebCompanion.exe, 0000000A.00000002.684568151.0000000005100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdbl< source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498778135.0000000000A22000.00000020.00000001.01000000.00000013.sdmp, WebCompanion.exe, 0000000A.00000002.654266966.00000000009D3000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: WebCompanion.exe, 00000008.00000002.500224324.00000000061D2000.00000020.00000001.01000000.0000001C.sdmp, WebCompanion.exe, 0000000C.00000002.674654255.0000000005F12000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: HP/hLC:\Windows\PresentationFramework.pdb source: WebCompanion.exe, 00000009.00000002.653121001.00000000002C8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb`: source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, WebCompanion.exe, 0000000A.00000002.712675127.0000000069B00000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb$ source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp, WebCompanion.exe, 0000000A.00000002.654028439.00000000008F9000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654645669.0000000001269000.00000020.00000001.01000000.00000008.sdmp, WebCompanion.exe, 00000008.00000002.499788626.0000000004E22000.00000020.00000001.01000000.00000017.sdmp, WebCompanion.exe, 0000000C.00000002.671846119.0000000005519000.00000020.00000001.01000000.00000017.sdmp
Source:	Binary string: vcruntime140d.i386.pdb+++ source: WebCompanion.exe, 00000008.00000002.501581860.00000000699A1000.00000020.00000001.01000000.00000019.sdmp, WebCompanion.exe, 0000000A.00000002.710914240.00000000699D1000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: ucrtbased.pdb source: WebCompanion.exe, 00000008.00000002.500784594.00000000621E1000.00000020.00000001.01000000.0000001A.sdmp, WebCompanion.exe, 0000000A.00000002.707636454.000000006228B000.00000020.00000001.01000000.0000001A.sdmp
Source:	Binary string: 0__b77a5c561934e089\System.pdb source: WebCompanion.exe, 00000008.00000002.500314844.000000000661B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, WebCompanion.exe, 0000000A.00000002.712675127.0000000069B00000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdbl source: WebCompanion.exe, 00000008.00000002.499868136.0000000005470000.00000004.00000020.00020000.00000000.sdmp

Spreading

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Directory queried: number of queries: 2031

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 470Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 421
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 531
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 669
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 538
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 505
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 538
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 511
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 550
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 489
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 550
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 481
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 543
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 483
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 543
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 498
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 543
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 514
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 541
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 536Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 514Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 545
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 510Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 546
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 514Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 484Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 541
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 546
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 509Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 542
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 492Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 503Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 502Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 502Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 466Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4686Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Launch&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 423Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 326
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 326
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1801Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 623Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 497Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 621Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 7931Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 490Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 485Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 443Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=CompleteInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 399
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4705Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 550Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1021
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1020
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 7931Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: GET /api/Partners/get-partner-by-id?partnerId=IN240402 HTTP/1.1Host: partners.webcompanion.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1020
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Error&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 2148
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1021
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /bitmask/allmaskvalues HTTP/1.1Content-Type: application/json; charset=utf-8Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJmYjk0YjJmZS0xZjYzLTQ0ZDMtYTI4ZC05ZWM2YjQyNzBjOGEiLCJpc3MiOiJBZGF3YXJlIFNvZnR3YXJlIEluYyIsImF1ZCI6IldDIiwic2NvcGVzIjpbIlB1YmxpYyJdfQ.7Wb-S-I8rPlTShlI_hfcQbSovgz0VpLDMpx0BoKo9NoHost: sg-bitmask.adaware.comContent-Length: 87Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1021
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 723
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /bitmask/allmaskvalues HTTP/1.1Content-Type: application/jsonAuthorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiI5Zjk3OGVkZC1jYTY0LTQ2MGEtYTc4Ni0xODU3ZjI1MjBiNmQiLCJpc3MiOiJBZGF3YXJlIFNvZnR3YXJlIEluYyIsImF1ZCI6IldDIiwic2NvcGVzIjpbIlB1YmxpYyJdfQ.d-8z6Qb8U0Bwm7-DbsImRo7ho9td4VcWgB_s1fqMVr4Host: sg-bitmask.adaware.comContent-Length: 93
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1021
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 716
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 716
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1021
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1021
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1806
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1806
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 542
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 723
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1806
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 716
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 716
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 549
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 716
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 402
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4255
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 478
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 300
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402 HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_wb HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ab HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ac HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /version_logs?json=true&version=13.900.0.1080 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.19.177.52 104.19.177.52
Source: Joe Sandbox View	IP Address: 104.18.27.149 104.18.27.149
Source: Joe Sandbox View	IP Address: 104.22.57.245 104.22.57.245

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /en/install.php?partner=IN240402&campaign=20541619131& HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lib/bootstrap-4.3.1/css/bootstrap.min.css HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/58290800-cf5c-4f05-9ec6-18c67ae77b2a/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/custom.css HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/icons.css HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lib/bootstrap-4.3.1/js/bootstrap.min.js HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/58290800-cf5c-4f05-9ec6-18c67ae77b2a/58290800-cf5c-4f05-9ec6-18c67ae77b2a.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/adaware-web-companion.svg HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/footer-logo.svg HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /inspectlet.js?wid=897777169&r=477733 HTTP/1.1Host: cdn.inspectlet.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/icomoon.ttf?4wnbrd HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"Origin: https://webcompanion.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://webcompanion.com/css/icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202403.1.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10846925175/?random=1719839029837&cv=11&fst=1719839029837&bg=ffffff&guid=ON&async=1&gtm=45be46q0v893262754za200zb811825413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwebcompanion.com%2Fen%2Finstall.php%3Fpartner%3DIN240402%26campaign%3D20541619131%26&hn=www.googleadservices.com&frm=0&tiba=Web%20Companion%20by%20Adaware%20-%20Prevent%20malware%20infections%20and%20privacy%20breaches%20at%20its%20source.&npa=0&pscdl=noapi&auid=312263457.1719839031&uaa=x86&uab=64&uafvl=Not_A%2520Brand%3B99.0.0.0%7CGoogle%2520Chrome%3B109.0.5414.120%7CChromium%3B109.0.5414.120&uamb=0&uam=&uap=Windows&uapv=0.1.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlqHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag/uet/355013479 HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/Partners/get-partner-by-id?partnerId=IN240402 HTTP/1.1Host: partners.webcompanion.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /consent/58290800-cf5c-4f05-9ec6-18c67ae77b2a/018fc5a2-2a11-721f-88b0-05e7662f0e9d/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G111&gcd=13t3t3t3t5&tag_exp=0&rnd=100857169.1719839031&url=https%3A%2F%2Fwebcompanion.com%2Fen%2Finstall.php&dma=0&npa=0&gtm=45be46q0v893262754za200zb811825413&auid=312263457.1719839031&frm=0 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlqHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/0.7.32/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=816915db952c44919b77342e2e1099f8.20240701.20250701
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10846925175/?random=84722761&cv=11&fst=1719839029838&bg=ffffff&guid=ON&async=1&gtm=45be46q0v893262754za200zb811825413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwebcompanion.com%2Fen%2Finstall.php%3Fpartner%3DIN240402%26campaign%3D20541619131%26&label=oqrCCIrowZUDEPfim7Qo&hn=www.googleadservices.com&frm=0&tiba=Web%20Companion%20by%20Adaware%20-%20Prevent%20malware%20infections%20and%20privacy%20breaches%20at%20its%20source.&gtm_ee=1&npa=0&pscdl=noapi&auid=312263457.1719839031&uaa=x86&uab=64&uafvl=Not_A%2520Brand%3B99.0.0.0%7CGoogle%2520Chrome%3B109.0.5414.120%7CChromium%3B109.0.5414.120&uamb=0&uam=&uap=Windows&uapv=0.1.0&uaw=0&fdr=QA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbEC&pscrd=IhMIjtCz1fOFhwMVrx2iAx2BFx0IMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd2ViY29tcGFuaW9uLmNvbS8 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlqHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202403.1.0/assets/otFloatingRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202403.1.0/assets/v2/otPcTab.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202403.1.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/10846925175/?random=84722761&cv=11&fst=1719839029838&bg=ffffff&guid=ON&async=1&gtm=45be46q0v893262754za200zb811825413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwebcompanion.com%2Fen%2Finstall.php%3Fpartner%3DIN240402%26campaign%3D20541619131%26&label=oqrCCIrowZUDEPfim7Qo&hn=www.googleadservices.com&frm=0&tiba=Web%20Companion%20by%20Adaware%20-%20Prevent%20malware%20infections%20and%20privacy%20breaches%20at%20its%20source.&gtm_ee=1&npa=0&pscdl=noapi&auid=312263457.1719839031&uaa=x86&uab=64&uafvl=Not_A%2520Brand%3B99.0.0.0%7CGoogle%2520Chrome%3B109.0.5414.120%7CChromium%3B109.0.5414.120&uamb=0&uam=&uap=Windows&uapv=0.1.0&uaw=0&fdr=QA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbEC&pscrd=IhMIjtCz1fOFhwMVrx2iAx2BFx0IMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd2ViY29tcGFuaW9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLWj8enR-VK8Kix0SYG4593ojY69muha5gKyDEKcKSbwU2bXq2&random=3915161993 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlqHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/ot_guard_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://webcompanion.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/ot_company_logo.png HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/powered_by_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico HTTP/1.1Host: webcompanion.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _uetsid=5bf343b037aa11efa8b7a9c8d67427bf; _uetvid=5bf3db1037aa11efb7058d06ccb80f91; __insp_wid=897777169; __insp_slim=1719839029868; __insp_nv=true; __insp_targlpu=aHR0cHM6Ly93ZWJjb21wYW5pb24uY29tL2VuL2luc3RhbGwucGhwP3BhcnRuZXI9SU4yNDA0MDImY2FtcGFpZ249MjA1NDE2MTkxMzEm; __insp_targlpt=V2ViIENvbXBhbmlvbiBieSBBZGF3YXJlIC0gUHJldmVudCBtYWx3YXJlIGluZmVjdGlvbnMgYW5kIHByaXZhY3kgYnJlYWNoZXMgYXQgaXRzIHNvdXJjZS4%3D; _gcl_au=1.1.312263457.1719839031; __insp_norec_sess=true; _ga=GA1.1.1855153085.1719839033; _ga_30HWN1Z1WV=GS1.1.1719839031.1.0.1719839031.60.0.0; _ga_156KYDXFJK=GS1.1.1719839032.1.0.1719839032.0.0.0; _clck=prnxv7%7C2%7Cfn3%7C0%7C1643; _clsk=179cbvf%7C1719839035081%7C1%7C1%7Ct.clarity.ms%2Fcollect; OptanonConsent=isGpcEnabled=0&datestamp=Mon+Jul+01+2024+09%3A03%3A55+GMT-0400+(Eastern+Daylight+Time)&version=202403.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&genVendors=V1%3A0%2CV2%3A0%2C&consentId=547c00ed-9ab6-4910-a253-ecb5d1509955&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwebcompanion.com%2Fen%2Finstall.php%3Fpartner%3DIN240402%26campaign%3D20541619131%26&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402 HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_wb HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ab HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ac HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /version_logs?json=true&version=13.900.0.1080 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive

Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp	String found in binary or memory: <td align="right" width="24"><a target="_blank" href="https://www.facebook.com/lavasoft.adaware"><img src="http://webcompanion.com/images/email/fb-icon.png" width="16" height="16" alt="fb" style="display:block;border:0;" /></a></td> equals www.facebook.com (Facebook)
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: geo.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: featureflags.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: flwadw.com
Source: global traffic	DNS traffic detected: DNS query: ocsp.entrust.net
Source: global traffic	DNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: wc-partners.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: webcompanion.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: cdn.inspectlet.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: hn.inspectlet.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: partners.webcompanion.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: t.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: sg-bitmask.adaware.com

Source: unknown

HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive

Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ad-blocker-update-service.lavasoft.com/update.asmx
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.693911868.0000000006C44000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.693911868.0000000006C44000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/d$0
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/UI/ResourceDictionary/checkmark.pngX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WebCompanion-Installer;component/ui/installationsuccessview.xamlX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WebCompanion-Installer;component/ui/installerfooter.xamlX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WebCompanion-Installer;component/ui/installerheader.xamlX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WebCompanion-Installer;component/ui/installerheaderextension.xamlX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DB6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://em.lavasoft.com/subscribe/profile?f=21&id=
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EE57000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://featureflags.lavasoft.com
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://feedback-service.lavasoft.com/feedback.asmx
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E48000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8F2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EF25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://flwadw.com
Source: WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo.com/fooX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/UI/ResourceDictionary/checkmark.png
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/installationsuccessview.baml
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/installationsuccessview.bamlX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/installerfooter.baml
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/installerfooter.bamlX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/resourcedictionary/checkmark.png
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/resourcedictionary/checkmark.pngX
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/ui/installationsuccessview.xaml
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/ui/installerfooter.xaml
Source: WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geo.lavasoft.com/
Source: WebCompanion.exe, 00000008.00000002.499788626.0000000004E22000.00000020.00000001.01000000.00000017.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com
Source: WebCompanion.exe, 00000008.00000002.498794576.0000000000B82000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digeY
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/ActiveFeatures.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/Silverlight_x64.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/aabrowser.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/chbrowser.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/FeatureActions.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IEBhoHelper.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IESPHelper.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/Silverlight_x64.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/aabrowser.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/adblocker.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/chbrowser.exe
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/extension.txtuhttps://staging-feedback-service.
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/preprod/v1/FeatureActions.zip
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/prod/v1/FeatureActions.zipkhttp://pp.we
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/v1/searchengine_v1.zip
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/searchenginetemplate.xmlQhttps://appdownload.la
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfService(
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfServicef
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/VPNService.WCF.Model
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/VPNService.WCF.Model_
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002859000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://staging-cloudflow.lavasoft.net/v1/event-stat-wc
Source: WebCompanion.exe, 00000008.00000002.498822779.0000000000BD2000.00000020.00000001.01000000.00000014.sdmp, WebCompanion.exe, 0000000A.00000002.654743759.0000000001202000.00000020.00000001.01000000.00000014.sdmp	String found in binary or memory: http://system.data.sqlite.org/
Source: WebCompanion.exe, 00000008.00000002.498838097.0000000000C14000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://system.data.sqlite.org/X
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/$
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:WebHttpBinding4
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/A
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/AddT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/GetComponentsInfoByProductT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/GetComponentsInfoT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/GetComponentsVersionInfoT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/GetProductInfoT
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetNotify
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetNotifyResponse
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetParameters
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetParametersResponse
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/Rewards
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/RewardsResponse
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPN
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNT
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetConnectionInfo
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetConnectionInfoResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetConnectionInfoT
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetLocations
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetLocationsResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetLocationsT
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/IsVPNConnected
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/IsVPNConnectedResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/IsVPNConnectedT
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/LoadConfig
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/LoadConfigResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/LoadConfigT
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/TurnOffVPN
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/TurnOffVPNResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/TurnOffVPNT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CopyFilesResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CopyFilesT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CreatUninstallInfoResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CreatUninstallInfoT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentHomePageIEResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentHomePageIET
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentSearchIEResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentSearchIET
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunProcessResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunProcessT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunasAdminResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunasAdminT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetAutoRestoreSessionIEResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetAutoRestoreSessionIET
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetHomePageIEResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetHomePageIET
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetNewTabIEResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetNewTabIET
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetSearchEngineIEResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetSearchEngineIET
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SilentUninstallResponse
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SilentUninstallT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/UpdateUninstallInfoResponse=
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/UpdateUninstallInfoT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SendEmailT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SendFeedbackT
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SendWCFeedbackT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/SignZipInstallerByProductT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SignZipInstallerT
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/T
Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/WcSendAutoResponseEmailT
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004D1F000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/components.asmx
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/update.asmx
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zi:
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/check
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/faq
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://webcompanion.com/google_chrome_incompatibility
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DB6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://webcompanion.com/help
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://webcompanion.com/images/email/hdr_main.png
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://webcompanion.com/images/email/tw-icon.png
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://webcompanion.com/images/email/wc-title-header.png
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://webcompanion.com/mail-report-reply
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://webcompanion.com/notifications/includes/wl.phpthttp://webcompanion.com/version_logs?json=true
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://webcompanion.com/unsafe
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/version_logs?json=true&version=
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/version_logs?json=true&version=13.900.0.1080
Source: WebCompanion.exe, 00000008.00000002.498794576.0000000000B82000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/).
Source: WebCompanion.exe, 00000008.00000002.498794576.0000000000B82000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: WebCompanion.exe, 00000008.00000002.498794576.0000000000B82000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Ionic.Zip.dll.2.dr	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DB6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://www.lavasoft.com
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DB6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://www.lavasoft.com/mylavasoft/contact
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DB6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://www.lavasoft.com/privacy_policy/
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DB6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr	String found in binary or memory: http://www.lavasoftsupport.com/index.php?/forum/191-web-companion/
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.501465250.000000006258A000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html4
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.webcompanion.com
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/D0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/T.:
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002855000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist1http://geo.lavasoft.com/ihttps://acscdn.lavasoft.com/u
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002855000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwhitelist
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://acscdn.lavasoft.com/urlnotificationlist.json
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://addons.mozilla.org/en-US/firefox/
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EDA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreT.:
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003131000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/D0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/T.:
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: https://easylist-downloads.adblockplus.org/easylist.txtzhttps://easylist-downloads.adblockplus.org/e
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: https://easylist-downloads.adblockplus.org/easylistgermany.txt
Source: WebCompanion.exe, 00000008.00000002.498923676.0000000001272000.00000020.00000001.01000000.00000016.sdmp	String found in binary or memory: https://eventstaging.lavasoft.com/v1/event-stat
Source: WebCompanion.exe, 00000008.00000002.498756804.00000000009B2000.00000020.00000001.01000000.00000012.sdmp	String found in binary or memory: https://eventstaging.lavasoft.com/v1/event-statFhttps://flwadw.com/v1/event-stat-wclhttp://staging-c
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000ED21000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasofP
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EA37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasofPD
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasofPp
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E920000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8AD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E92A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8F2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E916000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8E3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C26000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WC
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCDJ
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCw
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC4
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.comX
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.comd
Source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://feedbackapi.adaware.com/api/feedback;http://webcompanion.com/check
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://flow.lavasoft.com/v1/event-stat/v1/event-stat
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E48000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002870000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C14000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9A8000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E99C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9C2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9F3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9C0000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9E1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com
Source: WebCompanion.exe, 00000008.00000002.498923676.0000000001272000.00000020.00000001.01000000.00000016.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002859000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498756804.00000000009B2000.00000020.00000001.01000000.00000012.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc
Source: WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C26000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002E92000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EE57000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersionLR
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=CompleteInstall&ProductID=wc&EventLR
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=CompleteInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1LR
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wcH
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002DAE000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E851000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 0000000C.00000002.654788393.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1n
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000E851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1nd.
Source: WebCompanion.exe, 0000000C.00000002.654788393.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1nl
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C26000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002E92000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DD5000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=10
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ActivityInfo&ProductID=wc&EventVersion=1LR
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1LR
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Error&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002E92000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.654788393.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA29000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E851000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9A8000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9F3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9E1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9D4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E9C7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E942000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E95D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1LR
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002E92000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1LR
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1X
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E48000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1LR
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1ecur
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.655185747.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002E92000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.655185747.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava
Source: chromecache_288.13.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_288.13.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_288.13.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_292.13.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10846925175/?random
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: https://indonesianadblockrules.googlecode.com/hg/subscriptions/abpindo.txtxhttps://easylist-download
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://partner-tracking.lavasoft.com/api/Tracking/Decrypt
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partners.webcompanion.com/api/Partners/get-partner-by-id
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002855000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: https://ruadlist.googlecode.com/hg/advblock.txt(AdBlockAcceptableAds
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/Update/WC
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/feature/WC
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/ff
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003131000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/ffD0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/ffT.:
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/yhs/search
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003131000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/yhs/searchD0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/yhs/searchT.:
Source: WebCompanion-Installer.exe, 00000002.00000002.665272133.000000000490A000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.500314844.0000000006583000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.686500640.0000000005481000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.669401940.0000000004DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sg-bitmask.adaware.com/bitmask/allmaskvalues
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staging-bitmask.lavasoft.net/bitmask/allmaskvalues
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: WebCompanion.exe, 00000008.00000002.498816053.0000000000BCC000.00000002.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000008.00000002.498794576.0000000000B82000.00000020.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 0000000A.00000002.653246747.00000000003BA000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002D10000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.654672547.0000000000D32000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr	String found in binary or memory: https://twitter.com/lavasoft
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.705255441.000000000C86B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.705255441.000000000C907000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.706277541.000000000E928000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.698309558.000000000B873000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.698309558.000000000B5F5000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.698309558.000000000B75F000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.698309558.000000000B8EE000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.698309558.000000000B662000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/search
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/searchD0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/searchT.:
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe
Source: Setup.exe, 00000000.00000003.349525043.0000000002100000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002811000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.000000000280E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/en/help.php
Source: WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/en/install.php?partner=
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/en/install.php?partner=IN240402&campaign=
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&h
Source: WebCompanion-Installer.exe, 00000002.00000002.653508270.00000000004F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&pC:
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003121000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000337B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EDA4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000ED21000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EE57000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EBFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com:443
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.adaware.com/privacy-policy
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.adaware.com/terms-of-use
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003131000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/D0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/T.:
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EDA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003131000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.000000000332F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000003131000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.00000000030A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchD0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchT.:
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498954976.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com:443

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49500
Source: unknown	Network traffic detected: HTTP traffic on port 49336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49543
Source: unknown	Network traffic detected: HTTP traffic on port 49406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49540
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49539
Source: unknown	Network traffic detected: HTTP traffic on port 49361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49538
Source: unknown	Network traffic detected: HTTP traffic on port 49346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49531
Source: unknown	Network traffic detected: HTTP traffic on port 49587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49530
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49529
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49520
Source: unknown	Network traffic detected: HTTP traffic on port 49565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49513
Source: unknown	Network traffic detected: HTTP traffic on port 49268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49512
Source: unknown	Network traffic detected: HTTP traffic on port 49543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49510
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49587
Source: unknown	Network traffic detected: HTTP traffic on port 49431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49580
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49333
Source: unknown	Network traffic detected: HTTP traffic on port 49545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49570
Source: unknown	Network traffic detected: HTTP traffic on port 49316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49325
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49564
Source: unknown	Network traffic detected: HTTP traffic on port 49569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49560
Source: unknown	Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49317
Source: unknown	Network traffic detected: HTTP traffic on port 49499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49553
Source: unknown	Network traffic detected: HTTP traffic on port 49570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49550
Source: unknown	Network traffic detected: HTTP traffic on port 49465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49547
Source: unknown	Network traffic detected: HTTP traffic on port 49326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49380
Source: unknown	Network traffic detected: HTTP traffic on port 49487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49370
Source: unknown	Network traffic detected: HTTP traffic on port 49418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49365
Source: unknown	Network traffic detected: HTTP traffic on port 49408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49360
Source: unknown	Network traffic detected: HTTP traffic on port 49523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49590
Source: unknown	Network traffic detected: HTTP traffic on port 49501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49349
Source: unknown	Network traffic detected: HTTP traffic on port 49502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49297
Source: unknown	Network traffic detected: HTTP traffic on port 49297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49295
Source: unknown	Network traffic detected: HTTP traffic on port 49319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49292
Source: unknown	Network traffic detected: HTTP traffic on port 49354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49290
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49284
Source: unknown	Network traffic detected: HTTP traffic on port 49561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49280
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49276
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 49595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 49423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49563 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49585 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49601
Source: unknown	Network traffic detected: HTTP traffic on port 49462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49422
Source: unknown	Network traffic detected: HTTP traffic on port 49290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49421
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49418
Source: unknown	Network traffic detected: HTTP traffic on port 49384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49414
Source: unknown	Network traffic detected: HTTP traffic on port 49484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49412
Source: unknown	Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49410
Source: unknown	Network traffic detected: HTTP traffic on port 49323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 49588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49460
Source: unknown	Network traffic detected: HTTP traffic on port 49339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 49380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49457
Source: unknown	Network traffic detected: HTTP traffic on port 49327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49451

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.208.152:443 -> 192.168.2.22:49324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49370 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.213.94:443 -> 192.168.2.22:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49448 -> 104.18.26.149:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49505 -> 104.18.26.149:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49570 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49591 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Users\user\Desktop\Setup.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write

Sample file is different than original file name gathered from version info

Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs Setup.exe
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000002.653116782.000000000201D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000002.652947526.0000000000427000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000002.652967596.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.350079521.0000000002100000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.350079521.0000000002100000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe

Uses 32bit PE files

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: DotNetZip.dll.2.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: DotNetZip.dll.2.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DotNetZip.dll.2.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: classification engine

Classification label: mal54.phis.troj.spyw.evad.winEXE@27/380@377/19

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Roaming\Lavasoft

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Mutant created: \Sessions\1\BaseNamedObjects\AdAwareWebCompanionuser

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='EdgeSearchRemoveDays'n\Options\statistic.db;Version=3;
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002E65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='SearchNotificationDismissedAge'statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002E47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='FirefoxSearchRemoveDays'ptions\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='FirefoxSearchUsedDays'\Options\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='SearchNotificationDismissedAge'statistic.db;Version=3;
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002E73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM bwl_stats ORDER BY date DESC LIMIT 1t\Web Companion\Options\statistic.db;Version=3;Read Only=True;t-
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000ED21000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC95000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8AD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EAD7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E92A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000ECBD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E899000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='EdgeSearchRemoveDays'n\Options\statistic.db;Version=3;t-
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002E39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchRemoveDays'Options\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EC95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchRemoveDays'Options\statistic.db;Version=3;t-
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000ED21000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E920000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC95000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8AD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EAD7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E92A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8F2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8E3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E899000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='SearchNotificationDismissedAge'statistic.db;Version=3;t-
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='FirefoxSearchRemoveDays'ptions\statistic.db;Version=3;
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchRemoveDays'Options\statistic.db;Version=3;
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002D76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='InstallAge'b Companion\Options\statistic.db;Version=3;ompanion\webcompanion.log' because it is being used by another process.1,"default":false}]
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='InstallAge'b Companion\Options\statistic.db;Version=3;gn":"20541619131","wcyid":"WCYID10249","clidhp":21733
Source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002E98000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000A.00000002.654952379.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchUsedDays'n\Options\statistic.db;Version=3;ompanion\webcompanion.log' because it is being used by another process.
Source: WebCompanion.exe, 00000008.00000002.498954976.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchUsedDays'n\Options\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 0000000A.00000002.654952379.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchRemoveDays'Options\statistic.db;Version=3;ompanion\webcompanion.log' because it is being used by another process.
Source: WebCompanion.exe, 0000000C.00000002.692790600.000000000EAAF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E8AD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000E86D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC4F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EC3F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EA37000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EAFA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EB00000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 0000000C.00000002.692790600.000000000EBC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='FirefoxSearchRemoveDays'ptions\statistic.db;Version=3;t-

Source: Setup.exe

ReversingLabs: Detection: 29%

Source: Setup.exe

String found in binary or memory: RunProgram="WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080"

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 --field-trial-handle=892,i,15230702887778315927,1336726020721977328,131072 /prefetch:8
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 --field-trial-handle=892,i,15230702887778315927,1336726020721977328,131072 /prefetch:8
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: d3d8thk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: odbc32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpqec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: qutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ws2help.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nci.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: napmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pcollab.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: d3d8thk.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: shcore.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3b791073-dd82-435f-9aca-0188b7edabec}

Jump to behavior

PE / OLE file has a valid certificate

Source: Setup.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.SysInfo\obj\Debug\Lavasoft.SysInfo.pdb source: WebCompanion.exe, 00000008.00000002.500116290.0000000005882000.00000020.00000001.01000000.0000001E.sdmp, WebCompanion.exe, 0000000A.00000002.687625687.0000000005A17000.00000020.00000001.01000000.0000001E.sdmp
Source:	Binary string: neMicrosoft.Win32.SafeHandles.SafeRegistryHandleonent.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/h,C:\Windows\System.pdbg source: WebCompanion.exe, 00000009.00000002.698165299.000000000734B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdb source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498778135.0000000000A22000.00000020.00000001.01000000.00000013.sdmp, WebCompanion.exe, 0000000A.00000002.654266966.00000000009D3000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\FeatureMainComponent\obj\Debug\FeatureComponent.pdb source: WebCompanion.exe, 00000008.00000002.498923676.0000000001272000.00000020.00000001.01000000.00000016.sdmp, WebCompanion.exe, 0000000A.00000002.654889215.0000000001323000.00000020.00000001.01000000.00000016.sdmp, WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdbwork\v4.0.30319;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe--minimize source: WebCompanion.exe, 00000009.00000002.653291843.0000000000711000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdb source: WebCompanion.exe, 00000008.00000002.498822779.0000000000BD2000.00000020.00000001.01000000.00000014.sdmp, WebCompanion.exe, 0000000A.00000002.654743759.0000000001202000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: symbols\dll\System.Configuration.pdbt source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A68000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp, WebCompanion.exe, 0000000A.00000002.654028439.00000000008F9000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdbp source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.653939764.00000000006EB000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdb source: WebCompanion.exe, 00000008.00000002.498756804.00000000009B2000.00000020.00000001.01000000.00000012.sdmp, WebCompanion.exe, 0000000A.00000002.654146400.0000000000940000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: HP/h4C:\Windows\Ionic.Zip.pdb source: WebCompanion.exe, 00000009.00000002.699775735.00000000081EB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/h@C:\Windows\FeatureComponent.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: u.pdbQ source: WebCompanion.exe, 00000009.00000002.699775735.00000000081EB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/hHC:\Windows\System.Configuration.pdb source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: WebCompanion.exe, 00000008.00000002.500224324.00000000061D2000.00000020.00000001.01000000.0000001C.sdmp, WebCompanion.exe, 0000000C.00000002.674654255.0000000005F12000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdbX. source: WebCompanion.exe, 00000008.00000002.498822779.0000000000BD2000.00000020.00000001.01000000.00000014.sdmp, WebCompanion.exe, 0000000A.00000002.654743759.0000000001202000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdbX source: WebCompanion.exe, 00000008.00000002.498756804.00000000009B2000.00000020.00000001.01000000.00000012.sdmp, WebCompanion.exe, 0000000A.00000002.654146400.0000000000940000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: @;h.pdba3a\System.Configuration.dll source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdbh- source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\SourceCode\TFS\MozCompressor\Debug\MozCompressor.pdb source: WebCompanion.exe, 00000008.00000002.499691802.0000000004B75000.00000002.00000001.01000000.00000018.sdmp, WebCompanion.exe, 0000000C.00000002.672124304.000000000558D000.00000002.00000001.01000000.00000018.sdmp, MozCompressor.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdb source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdb!U source: WebCompanion.exe, 00000009.00000002.686500640.00000000053B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140d.i386.pdb source: WebCompanion.exe, 00000008.00000002.501581860.00000000699A1000.00000020.00000001.01000000.00000019.sdmp, WebCompanion.exe, 0000000A.00000002.710914240.00000000699D1000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002A68000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: @;h.pdb4e35\PresentationFramework.dll source: WebCompanion.exe, 00000009.00000002.653121001.00000000002C8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4 source: WebCompanion.exe, 00000008.00000002.500314844.000000000661B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdb source: WebCompanion.exe, 00000008.00000002.498586038.0000000000272000.00000020.00000001.01000000.00000010.sdmp, WebCompanion.exe, 0000000A.00000002.653939764.00000000006EB000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: @;h.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\FeatureComponent.pdb source: WebCompanion.exe, 0000000C.00000002.682231116.0000000007BEB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP/h@C:\Windows\Lavasoft.Events.pdb source: WebCompanion.exe, 0000000A.00000002.695522692.000000000912B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.CSharp.Utilities\obj\x86\Debug\Lavasoft.CSharp.Utilities.pdb source: WebCompanion.exe, 00000009.00000002.688986564.00000000055A2000.00000020.00000001.01000000.00000021.sdmp
Source:	Binary string: .pdbRw= source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbework\v4.0.30319;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPow source: WebCompanion.exe, 0000000A.00000002.684568151.00000000051B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HP/h,C:\Windows\System.pdb3 source: WebCompanion.exe, 0000000C.00000002.681810767.000000000762C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WebCompanion.exe, 0000000A.00000002.652774453.0000000000158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdbm source: WebCompanion.exe, 0000000A.00000002.684568151.0000000005100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdbl< source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498778135.0000000000A22000.00000020.00000001.01000000.00000013.sdmp, WebCompanion.exe, 0000000A.00000002.654266966.00000000009D3000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: WebCompanion.exe, 00000008.00000002.500224324.00000000061D2000.00000020.00000001.01000000.0000001C.sdmp, WebCompanion.exe, 0000000C.00000002.674654255.0000000005F12000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: HP/hLC:\Windows\PresentationFramework.pdb source: WebCompanion.exe, 00000009.00000002.653121001.00000000002C8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb`: source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, WebCompanion.exe, 0000000A.00000002.712675127.0000000069B00000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb$ source: WebCompanion-Installer.exe, 00000002.00000002.654788228.0000000002F0D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.498612442.0000000000542000.00000020.00000001.01000000.00000011.sdmp, WebCompanion.exe, 0000000A.00000002.654028439.00000000008F9000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.654645669.0000000001269000.00000020.00000001.01000000.00000008.sdmp, WebCompanion.exe, 00000008.00000002.499788626.0000000004E22000.00000020.00000001.01000000.00000017.sdmp, WebCompanion.exe, 0000000C.00000002.671846119.0000000005519000.00000020.00000001.01000000.00000017.sdmp
Source:	Binary string: vcruntime140d.i386.pdb+++ source: WebCompanion.exe, 00000008.00000002.501581860.00000000699A1000.00000020.00000001.01000000.00000019.sdmp, WebCompanion.exe, 0000000A.00000002.710914240.00000000699D1000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: ucrtbased.pdb source: WebCompanion.exe, 00000008.00000002.500784594.00000000621E1000.00000020.00000001.01000000.0000001A.sdmp, WebCompanion.exe, 0000000A.00000002.707636454.000000006228B000.00000020.00000001.01000000.0000001A.sdmp
Source:	Binary string: 0__b77a5c561934e089\System.pdb source: WebCompanion.exe, 00000008.00000002.500314844.000000000661B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.350079521.0000000002137000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.350112352.0000000000250000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.350139514.0000000001332000.00000020.00000001.01000000.00000004.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: WebCompanion.exe, 00000008.00000002.501254313.0000000062568000.00000002.00000001.01000000.00000015.sdmp, WebCompanion.exe, 0000000A.00000002.712675127.0000000069B00000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdbl source: WebCompanion.exe, 00000008.00000002.499868136.0000000005470000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

PE file contains an invalid checksum

Source: Setup.exe	Static PE information: real checksum: 0x8f918 should be: 0x88572
Source: WebCompanion-Installer.resources.dll8.0.dr	Static PE information: real checksum: 0x0 should be: 0xa6a7
Source: WebCompanion-Installer.resources.dll5.0.dr	Static PE information: real checksum: 0x0 should be: 0xc6c2
Source: WebCompanion-Installer.resources.dll1.0.dr	Static PE information: real checksum: 0x0 should be: 0x3e3f
Source: WebCompanion-Installer.resources.dll7.0.dr	Static PE information: real checksum: 0x0 should be: 0xcb69
Source: WebCompanion-Installer.resources.dll2.0.dr	Static PE information: real checksum: 0x0 should be: 0x4885
Source: WebCompanion-Installer.resources.dll4.0.dr	Static PE information: real checksum: 0x0 should be: 0x5659
Source: WebCompanion-Installer.resources.dll6.0.dr	Static PE information: real checksum: 0x0 should be: 0xd8a3
Source: WebCompanion-Installer.resources.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0xe72f
Source: WebCompanion-Installer.resources.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ab0
Source: WebCompanion-Installer.resources.dll3.0.dr	Static PE information: real checksum: 0x0 should be: 0x842b

PE file contains sections with non-standard names

Source: Setup.exe	Static PE information: section name: .sxdata
Source: acs17.dll.2.dr	Static PE information: section name: .textbss
Source: acs17.dll.2.dr	Static PE information: section name: .msvcjmc
Source: acs17.dll.2.dr	Static PE information: section name: .00cfg

Source: DotNetZip.dll.2.dr

Static PE information: section name: .text entropy: 6.825871161326248

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Frequently Asked Questions.url	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Web Companion.lnk	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Web Companion
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Web Companion

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Memory allocated: 310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Memory allocated: 9E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 1C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2A10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 980000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: C10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 4A0000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85799801
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299851
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100056
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210025
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86129916
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 180228
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86099745
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 180166
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86158916
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 181196
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86008484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85860237
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340065
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86249740
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86250130
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339940
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189710
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210072
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86129556
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86218665
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85769241
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339800
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85830658
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339908
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280035
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339862
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86040261
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 239837
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85919579
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 240289
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85799957
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299320
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100524
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299414
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100572
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 298664
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85831626
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 538485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85861453
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 538454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85801565
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 598389
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85621820
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 478549
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85921421
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 238651
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86161349
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 238495
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86071618
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281330
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86191598
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339924
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85799880
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299834
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86099917
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300177
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85920048
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300224
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85949906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 359941
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85979687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 180463
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86129588
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 240601
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039373
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86038998
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 271099
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86098996
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86038468
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 270522
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85739133
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 660306
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85589793
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 569748
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85649650
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 629574
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85737807
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 661070
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85618357
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 661336
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85738618
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 601400
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85468409
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 841766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85498424
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 691818
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85618201
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 691538
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85588451
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 691616
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85618466
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 631181
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85648090
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 601993
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85737979
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399985
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86310081
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100306
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86130414
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85980498
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 238885
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340080
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280082
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Window / User API: threadDelayed 383	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Window / User API: threadDelayed 9394	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 8667
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 1135
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 4408
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 2805
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 465
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 4599
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 4384
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 4549
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 2316

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	Jump to dropped file

Is looking for software installed on the system

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Registry key enumerated: More than 1333 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe TID: 3080	Thread sleep time: -780000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe TID: 3216	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe TID: 3216	Thread sleep time: -8400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 3308	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3376	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3432	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3432	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3436	Thread sleep count: 8667 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3432	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3436	Thread sleep count: 1135 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3576	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -85799801s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -299851s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3856	Thread sleep time: -4140000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86100056s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -210025s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3856	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86129916s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -180228s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86099745s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -180166s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86158916s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -181196s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86008484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -85860237s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -3369600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86340065s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86249740s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86250130s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86339940s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86189710s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -210072s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86129556s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86218665s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -151509s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -85769241s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86339800s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -85830658s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86339908s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86280035s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -172799968s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86339862s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -86040261s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -239837s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -85919579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3784	Thread sleep time: -240289s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3640	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1912	Thread sleep count: 4599 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -85799957s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -299320s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86100524s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -299414s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1912	Thread sleep count: 4384 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86100572s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2700	Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3372	Thread sleep time: -1890000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -298664s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3372	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -85831626s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -538485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -85861453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -538454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -85801565s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -598389s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -85621820s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -478549s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -85921421s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -238651s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86161349s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -238495s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86071618s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -58657s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86281330s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -118515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86191598s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4208	Thread sleep count: 165 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86399875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86399937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -86339924s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2880	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3920	Thread sleep time: -420000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4280	Thread sleep count: 4549 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4280	Thread sleep count: 2316 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85799880s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -299834s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4288	Thread sleep count: 224 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86099917s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4308	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4308	Thread sleep time: -3600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -300177s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4308	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4308	Thread sleep time: -1230000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85920048s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -300224s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85949906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -359941s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85979687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3884	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -180463s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86129588s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -240601s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86039373s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -120901s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86038998s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -271099s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86098996s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -151197s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86038468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -270522s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85739133s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -660306s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85589793s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -569748s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85649650s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -629574s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85737807s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -661070s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85618357s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -661336s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85738618s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -601400s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85468409s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -841766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85498424s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -691818s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85618201s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -691538s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85588451s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -691616s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85618466s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -631181s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85648090s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -601993s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4340	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85737979s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -1728000000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86399953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86399985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86310081s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86100306s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -119638s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86130414s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -85980498s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -238885s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86340080s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86280082s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86399937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -86399969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3920	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4256	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85799801
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299851
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100056
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210025
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86129916
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 180228
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86099745
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 180166
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86158916
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 181196
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86008484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85860237
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340065
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86249740
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86250130
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339940
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189710
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210072
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86129556
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86218665
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 151509
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85769241
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339800
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85830658
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339908
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280035
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339862
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86040261
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 239837
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85919579
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 240289
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85799957
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299320
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100524
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299414
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100572
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 298664
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85831626
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 538485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85861453
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 538454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85801565
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 598389
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85621820
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 478549
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85921421
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 238651
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86161349
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 238495
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86071618
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 58657
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281330
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118515
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86191598
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339924
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85799880
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 299834
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86099917
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300177
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85920048
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300224
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85949906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 359941
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85979687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 180463
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86129588
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 240601
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039373
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 120901
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86038998
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 271099
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86098996
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 151197
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86038468
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 270522
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85739133
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 660306
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85589793
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 569748
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85649650
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 629574
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85737807
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 661070
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85618357
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 661336
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85738618
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 601400
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85468409
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 841766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85498424
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 691818
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85618201
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 691538
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85588451
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 691616
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85618466
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 631181
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85648090
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 601993
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85737979
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399985
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86310081
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86100306
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119638
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86130414
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85980498
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 238885
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340080
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280082
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion	Jump to behavior

Source: WebCompanion.exe, 00000008.00000000.468271214.000000000158B000.00000020.00000001.01000000.0000000E.sdmp	Binary or memory string: #=zJcSAKVf2Oq7SX1AJhgfS4PSYmp4K
Source: WebCompanion-Installer.exe, 00000002.00000002.654788228.00000000028D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\en-US\WebCompanion-Installer.resources.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Internet Explorer zone settings

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 2301

Jump to behavior

Modifies Internet Explorer zonemap settings

Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost *			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com http			Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone

Adds / modifies Windows certificates

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 Blob

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	1 OS Credential Dumping	12 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Deobfuscate/Decode Files or Information	LSASS Memory	32 System Information Discovery	Remote Desktop Protocol	2 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Windows Service	1 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Software Packing	NTDS	11 Process Discovery	Distributed Component Object Model	1 Clipboard Data	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\WebCompanion-Installer.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\de-DE\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\en-US\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\es-ES\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\fr-CA\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\it-IT\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ja-JP\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\pt-BR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\ru-RU\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\tr-TR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCE0C9E1E\zh-CHS\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	5%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	12%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll	3%	ReversingLabs

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://tempuri.org/IVPNServiceWCF/IsVPNConnectedResponse	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/CreatUninstallInfoT	0%	Avira URL Cloud	safe
https://twitter.com/searchD0	0%	Avira URL Cloud	safe
https://partners.webcompanion.com/api/Partners/get-partner-by-id	0%	Avira URL Cloud	safe
https://staging-bitmask.lavasoft.net/bitmask/allmaskvalues	0%	Avira URL Cloud	safe
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureT	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/GetConnectionInfo	0%	Avira URL Cloud	safe
http://defaultcontainer/WebCompanion-Installer;component/ui/installerheader.xamlX	0%	Avira URL Cloud	safe
https://search.yahoo.com/yhs/search	0%	Avira URL Cloud	safe
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	0%	Avira URL Cloud	safe
https://twitter.com/searchT.:	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNResponse	0%	Avira URL Cloud	safe
https://ruadlist.googlecode.com/hg/advblock.txt(AdBlockAcceptableAds	0%	Avira URL Cloud	safe
https://completion.amazon.com/search/complete?q=	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SilentUninstallT	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/graphs/contributors)	0%	Avira URL Cloud	safe
https://www.amazon.com/exec/obidos/external-search/	0%	Avira URL Cloud	safe
http://aia.entrust.net/evcs2-chain.p7c01	0%	Avira URL Cloud	safe
http://tempuri.org/SendWCFeedbackT	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/searchenginetemplate.xmlQhttps://appdownload.la	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1n	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1LR	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/Silverlight_x64.exe	0%	Avira URL Cloud	safe
https://webcompanion.com:443	0%	Avira URL Cloud	safe
http://www.lavasoft.com/mylavasoft/contact	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedService/Rewards	0%	Avira URL Cloud	safe
https://addons.mozilla.org/en-US/firefox/	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1nl	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/LoadConfig	0%	Avira URL Cloud	safe
https://webcompanion.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	0%	Avira URL Cloud	safe
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-30HWN1Z1WV&cid=1855153085.1719839033&gtm=45je46q0v9126530201z8811825413za200zb811825413&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	0%	Avira URL Cloud	safe
http://defaultcontainer/UI/ResourceDictionary/checkmark.pngX	0%	Avira URL Cloud	safe
https://twitter.com/search	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/ff	0%	Avira URL Cloud	safe
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	0%	Avira URL Cloud	safe
https://feedbackapi.adaware.com/api/feedback;http://webcompanion.com/check	0%	Avira URL Cloud	safe
http://geo.lavasoft.com/	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SetHomePageIET	0%	Avira URL Cloud	safe
https://chrome.google.com/webstoreT.:	0%	Avira URL Cloud	safe
http://flwadw.com	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedService/RewardsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SetNewTabIET	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedService/GetParameters	0%	Avira URL Cloud	safe
http://webcompanion.com/version_logs?json=true&version=	0%	Avira URL Cloud	safe
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/postrun/preprod/v1/FeatureActions.zip	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/otPcTab.json	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/ffT.:	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1LR	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/blob/master/LICENSE)	0%	Avira URL Cloud	safe
https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W	0%	Avira URL Cloud	safe
https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&	0%	Avira URL Cloud	safe
http://tempuri.org/WcSendAutoResponseEmailT	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPN	0%	Avira URL Cloud	safe
https://ac.duckduckgo.com/ac/T.:	0%	Avira URL Cloud	safe
http://webcompanion.com/version_logs?json=true&version=13.900.0.1080	0%	Avira URL Cloud	safe
http://wc-update-service.lavasoft.com/components.asmx	0%	Avira URL Cloud	safe
http://pp.webcompanion.com/notifications/download/rt/aabrowser.zip	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=Activity&ProductID=wc&EventVersion=1nd.	0%	Avira URL Cloud	safe
http://crl.entrust.net/g2ca.crl0	0%	Avira URL Cloud	safe
http://tempuri.org/A	0%	Avira URL Cloud	safe
http://foo/bar/ui/installationsuccessview.baml	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/VPNService.WCF.Model	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/TurnOffVPN	0%	Avira URL Cloud	safe
https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&h	0%	Avira URL Cloud	safe
https://eventstaging.lavasoft.com/v1/event-stat	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/GetLocationsT	0%	Avira URL Cloud	safe
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	0%	Avira URL Cloud	safe
https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3	0%	Avira URL Cloud	safe
https://www.adaware.com/privacy-policy	0%	Avira URL Cloud	safe
http://tempuri.org/SendEmailT	0%	Avira URL Cloud	safe
https://featureflags.lavasofPp	0%	Avira URL Cloud	safe
https://eventstaging.lavasoft.com/v1/event-statFhttps://flwadw.com/v1/event-stat-wclhttp://staging-c	0%	Avira URL Cloud	safe
http://www.apache.org/).	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/CopyFilesT	0%	Avira URL Cloud	safe
http://webcompanion.com/google_chrome_incompatibility	0%	Avira URL Cloud	safe
https://webcompanion.com/en/install.php?partner=IN240402&campaign=	0%	Avira URL Cloud	safe
http://foo/bar/ui/resourcedictionary/checkmark.png	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SetSearchEngineIET	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
geo.lavasoft.com	104.16.148.130	true	false	unknown
partners.webcompanion.com	104.19.159.224	true	false	unknown
featureflags.lavasoft.com	104.16.148.130	true	false	unknown
flwadw.com	104.18.26.149	true	false	unknown
sg-bitmask.adaware.com	104.16.213.94	true	false	unknown
hn.inspectlet.com	104.22.57.245	true	false	unknown
webcompanion.com	104.19.208.152	true	true	unknown
wc-partners.lavasoft.com	64.18.87.81	true	false	unknown
stats.g.doubleclick.net	173.194.69.154	true	false	unknown
cdn.inspectlet.com	104.22.56.245	true	false	unknown
wcdownloadercdn.lavasoft.com	104.16.148.130	true	false	unknown
googleads.g.doubleclick.net	172.217.168.2	true	false	unknown
s-part-0014.t-0009.fb-t-msedge.net	13.107.253.42	true	false	unknown
www.google.com	172.217.168.68	true	false	unknown
analytics.google.com	172.217.168.46	true	false	unknown
cdn.cookielaw.org	104.19.177.52	true	false	unknown
geolocation.onetrust.com	104.18.32.137	true	false	unknown
www.clarity.ms	unknown	unknown	false	unknown
t.clarity.ms	unknown	unknown	false	unknown
ocsp.entrust.net	unknown	unknown	false	unknown
c.clarity.ms	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://flwadw.com/v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-30HWN1Z1WV&cid=1855153085.1719839033&gtm=45je46q0v9126530201z8811825413za200zb811825413&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	false	Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	false	Avira URL Cloud: safe	unknown
http://geo.lavasoft.com/	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/otPcTab.json	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/en/install.php?partner=IN240402&campaign=20541619131&	false	Avira URL Cloud: safe	unknown
http://webcompanion.com/version_logs?json=true&version=13.900.0.1080	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.19.159.224	partners.webcompanion.com	United States	13335	CLOUDFLARENETUS	false
104.19.177.52	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
104.18.27.149	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.149.130	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.168.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.168.46	analytics.google.com	United States	15169	GOOGLEUS	false
104.22.57.245	hn.inspectlet.com	United States	13335	CLOUDFLARENETUS	false
104.19.208.152	webcompanion.com	United States	13335	CLOUDFLARENETUS	true
173.194.69.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
13.107.253.42	s-part-0014.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.22.56.245	cdn.inspectlet.com	United States	13335	CLOUDFLARENETUS	false
104.18.26.149	flwadw.com	United States	13335	CLOUDFLARENETUS	false
64.18.87.81	wc-partners.lavasoft.com	Canada	21548	MTOCA	false
172.217.168.2	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.16.213.94	sg-bitmask.adaware.com	United States	13335	CLOUDFLARENETUS	false
104.16.148.130	geo.lavasoft.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465336
Start date and time:	2024-07-01 15:01:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	6
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal54.phis.troj.spyw.evad.winEXE@27/380@377/19
Cookbook Comments:	Found application associated with file extension: .exe

Time	Type	Description
06:03:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Web Companion C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
06:03:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Web Companion C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
09:02:14	API Interceptor	41840x Sleep call for process: WebCompanion-Installer.exe modified
09:02:59	API Interceptor	2x Sleep call for process: netsh.exe modified
09:03:10	API Interceptor	1523x Sleep call for process: WebCompanion.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.19.159.224	Setup.exe	Get hash	malicious	Unknown	Browse	webcompanion.com/version_logs?json=true&version=12.901.4.1003
104.22.57.245	Setup.exe	Get hash	malicious	Unknown	Browse
	http://www.corporateworldwidetransportation.com/	Get hash	malicious	Unknown	Browse
	http://dynupdate.no-ip.com	Get hash	malicious	Unknown	Browse
	https://blnk.in/x5i7j	Get hash	malicious	Unknown	Browse
	http://r.srvtrck.com/v1/redirect?url=http%3A%2F%2Fwww.pmi.org%2F&api_key=2787b73d6d1c026b48687320e239182a&site_id=0fb9199cb9ce464f9c82523578c269b4&type=url&yk_tag=84594d11e26e500a54db53029ff8eafb	Get hash	malicious	Unknown	Browse
	https://unitasglobal.com/	Get hash	malicious	Unknown	Browse
	http://Unitasglobal.com	Get hash	malicious	Unknown	Browse
	http://wlbendvmwdm4v1pendvutuuzvujvr.populr.me/3653864370828	Get hash	malicious	HTMLPhisher	Browse
104.19.177.52	Doc3.docx	Get hash	malicious	Unknown	Browse
	https://yagyatech.com/netpaymem	Get hash	malicious	Unknown	Browse
	https://yagyatech.com/netpaymem	Get hash	malicious	Unknown	Browse
	https://www.teamviewer.com/en-in/download/windows/	Get hash	malicious	Unknown	Browse
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse
104.18.27.149	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	APInstaller (4).exe	Get hash	malicious	Unknown	Browse
	APInstaller.exe	Get hash	malicious	Unknown	Browse
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	WebCompanionInstaller-12.901.4.1003-prod.exe	Get hash	malicious	Unknown	Browse
	WebCompanionInstaller-12.901.4.1003-prod.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
104.16.149.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	downloadnada.lavasoft.com/update/12.10.158.0/win32/AdAwareWebInstaller.exe
	Setup (1).exe	Get hash	malicious	Unknown	Browse	wcdownloadercdn.lavasoft.com/12.1.4.1003/WebCompanion-12.1.4.1003-prod.zip

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9288846bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ainjurylawkings.com%2Fwinner%2F13476%2F%2Fc2FuZWV5YS5rYW5nQDJzZmcuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Payment_AdviceHyperoptic.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Remittance advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
CLOUDFLARENETUS	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9288846bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ainjurylawkings.com%2Fwinner%2F13476%2F%2Fc2FuZWV5YS5rYW5nQDJzZmcuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Payment_AdviceHyperoptic.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Remittance advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
CLOUDFLARENETUS	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9288846bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ainjurylawkings.com%2Fwinner%2F13476%2F%2Fc2FuZWV5YS5rYW5nQDJzZmcuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Payment_AdviceHyperoptic.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Remittance advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
CLOUDFLARENETUS	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9288846bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ainjurylawkings.com%2Fwinner%2F13476%2F%2Fc2FuZWV5YS5rYW5nQDJzZmcuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Payment_AdviceHyperoptic.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Remittance advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.129.233

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
36f7277af969a6947a61ae0b815907a1	paediatric neurologist medico legal 68003.js	Get hash	malicious	Unknown	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Alinco Pipe Supply FE Product Specification & Drawing DESIGN.xls	Get hash	malicious	Unknown	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Product Inquiry_#466788.xls	Get hash	malicious	FormBook	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Alinco Pipe Supply FE Product Specification & Drawing DESIGN.xls	Get hash	malicious	Unknown	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	7YZlAbfKMg.rtf	Get hash	malicious	AgentTesla	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Product Inquiry466789.xls	Get hash	malicious	AgentTesla	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	fs-windows-agent-3.4.0.msi	Get hash	malicious	Unknown	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	PROFORMA INVOICE.xls	Get hash	malicious	Remcos	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	RY94HT.docx	Get hash	malicious	Remcos	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Quotation.xls	Get hash	malicious	Remcos	Browse	104.19.208.152 104.16.213.94 104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	ASCII text, with very long lines (426), with CRLF line terminators
Category:	dropped
Size (bytes):	67717
Entropy (8bit):	5.482181316443509
Encrypted:	false
SSDEEP:	1536:JikgBV52c41zBViHlKGqk6dYfmbLYQW0Bduu9gRZj+TGXY4Q7wk4Zr9ddd:T5wRUgvl
MD5:	F7094699F53DED6FB9A810A82E93BF03
SHA1:	7D7DAB5EA0120FBD1670D255CA9AC4B9DCF73923
SHA-256:	45C6CDB349CB54150584591FB24725B34B709A2B4248332F04329D140B9ACFBE
SHA-512:	D1ECA2A1311E83C8AA4EE386EACD1C51E1D93252292E7D60E6BF8C0A89FF47994F06CA4164CF2F110B78141BD02E798A707CBA897DBF0A7E830BFBF1326E0CB2
Malicious:	false
Reputation:	low
Preview:	INFO 2024-07-01 09:04:10 [1] [WebCompanion.UI.App #=zTY688A6jMj8KGHur5R$oUfHWnqjE] ------------------------------------------------------------------------------------------------------..INFO 2024-07-01 09:04:10 [1] [WebCompanion.UI.App #=zTY688A6jMj8KGHur5R$oUfHWnqjE] Starting Webcompanion with :C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --install --geo=..INFO 2024-07-01 09:05:10 [1] [FeatureMainComponent.Browsers.Firefox.FirefoxBrowser .ctor] Start monitoring FireFox Browser..INFO 2024-07-01 09:06:10 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Starting to collect ..INFO 2024-07-01 09:06:10 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Successfully collected information about all installed browsers..INFO 2024-07-01 09:06:10 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Starting to collect ..INFO 2024-07-01 09:06:10 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Succe

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213656
Entropy (8bit):	5.7590593524797615
Encrypted:	false
SSDEEP:	3072:LK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Q:Ge9OAQsFtJrGPBnmIRZUL
MD5:	0CFE19791546A96C6699657A94604596
SHA1:	5D1A1B74CCA9F74FFFEBCB583661C02E4CA626DD
SHA-256:	56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
SHA-512:	586CC695A2C3C03008D0A1032C221CD3384B5F4363E83C9D903753FB1DAD65B340BC8CD0659F7F891A641F8BD7535C9B889219842045854AA98CD380F0FE4AA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......sC....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7447
Entropy (8bit):	4.148360771828323
Encrypted:	false
SSDEEP:	96:juE/fX1KUsQxPfh9CupcMqBQx5cqztTDJttN3eW5FSWHKGdT:1KLUcupjQwNt5Fuu6q
MD5:	91300AB51E6F2F17C38E72A89924BCA3
SHA1:	E1B6C8DDFD90BC183ACE243FD20AFFFD340F685E
SHA-256:	437B93F1AD3593129617EB324AEC5C8C557473F21B4CF3F6F56C5AE6880B2CC7
SHA-512:	A9917B05E9D452674621C1A2AA8B319C0E2FB3F249E783E0DD71BC957581FD099521DCE95808EF5D9A412B17EEDB6137018398C85B9E36404F8DB1B21DE4DC42
Malicious:	false
URL:	https://webcompanion.com/images/adaware-web-companion.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="221.113" height="38.721" viewBox="0 0 221.113 38.721"><defs><style>.a{fill:#ff7e00;}.b{fill:#333;}.c{fill:#f90;}.d{fill:#fc0;opacity:0.56;}.e{fill:#f30;opacity:0.4;}</style></defs><path class="a" d="M.244-13.984H2.783L6.3-3.916,9.424-13.984h2.119L14.658-3.916l3.525-10.068h2.539L15.84,0H13.5L10.557-9.58H10.4L7.461,0H5.117ZM22.967-1.328a5.263,5.263,0,0,1-1.572-4A5.167,5.167,0,0,1,23-9.321a5.374,5.374,0,0,1,3.77-1.479,5.473,5.473,0,0,1,3.691,1.309A4.511,4.511,0,0,1,31.98-5.879v1.543h-8.34a2.414,2.414,0,0,0,1.06,1.87,3.734,3.734,0,0,0,2.241.708,3.7,3.7,0,0,0,3.037-1.26l1.279,1.4A5.955,5.955,0,0,1,26.775.156,5.346,5.346,0,0,1,22.967-1.328ZM23.641-6.1h6.094a2.556,2.556,0,0,0-.84-2.056,3.076,3.076,0,0,0-2.07-.718,3.539,3.539,0,0,0-2.207.747A2.416,2.416,0,0,0,23.641-6.1ZM33.932,0V-14.844h2.236v6.064A3.983,3.983,0,0,1,39.63-10.8a5.058,5.058,0,0,1,3.662,1.479,5.25,5.25,0,0,1,1.519,3.94,5.467,5.467,0,0,1-1.509,4A4.781,4.781,0,0,1,39.781.156,4.8,4.8,0

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.653640389792838
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Setup.exe
File size:	545'352 bytes
MD5:	a081cff1d93f1bcc478835dcb98e7c47
SHA1:	00e6cb7c41860aeb346958192c68eb86b4015fb2
SHA256:	c0db81c7d38819926df96d6fb3adda34fb8783acede83d5f9bc0b681f2287845
SHA512:	c95a0db92a5a40189a515aa109e3af25570156f1b25845f21ced7f855de21dfd7e212453b075ceb54f78916573a0194a25a85a4f7282c7293b49a8743895c5ea
SSDEEP:	12288:PG5knZfFKeT4OydwORmV42Y5RBHtf8WS8sejGxUeRx7/1F:PG50ZfFKM4RCa0gDS8geepF
TLSH:	82C4F1127DE089B5D5820431CC745FA6A2B6FE560A21887773987E3E7F7F642C232A1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...

Entrypoint:	0x4148d4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e00de6e48b9b06aceb12a81e7bf494c9

Signature Valid:	true
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	5/1/2024 10:39:26 AM 5/1/2025 10:39:25 AM
Subject Chain	CN=7270356 Canada Inc., SERIALNUMBER=1417258-2, OID.2.5.4.15=Private Organization, O=7270356 Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
Version:	3
Thumbprint MD5:	0E3940FCE9D8B244F0D82DDEEBE28F5E
Thumbprint SHA-1:	EA06433E6F12D2AADA040F4A6EF7C927404A4CBA
Thumbprint SHA-256:	EB0A666D9DFD790059DF788FBA544ABC93E1690F1425147BA0A6E784AFC6F5B5
Serial:	25D0CB9D7B0D6C700CDAE43D243AB1C6

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9ac	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x71d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x81fb0	0x3298
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x197c0	0x19800	206b62d600beb166f8bf863ad5301f8c	False	0.5831609987745098	DOS executable (COM)	6.60822715389085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4490	0x4600	b0314f39355cab7d4674a0928d3b15f2	False	0.312109375	data	4.383775518811042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a68	0x3200	8d44c03d32e0c923339cda9fae15827a	False	0.123828125	data	1.3793356235333818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	35925cfdc1176bd9ffc634a58b40ec17	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x71d4	0x7200	cd606fe2fe8a9aaa6244d6a44a46010a	False	0.3919613486842105	data	4.655199945289653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27354	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.37231182795698925
RT_ICON	0x2763c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x27764	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m			0.3200354609929078
RT_ICON	0x27bcc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m			0.23688524590163934
RT_ICON	0x28554	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m			0.1721388367729831
RT_ICON	0x295fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m			0.1241701244813278
RT_ICON	0x2bba4	0x1a7b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9648915769287506
RT_DIALOG	0x2d620	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2d6d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2d76c	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2d7a0	0x4c	data			0.8289473684210527
RT_GROUP_ICON	0x2d7ec	0x22	data	English	United States	1.0
RT_VERSION	0x2d810	0x344	data	English	United States	0.4318181818181818
RT_MANIFEST	0x2db54	0x67f	exported SGML document, ASCII text, with CRLF line terminators	English	United States	0.3692122669873722

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\0dc2mvk1.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\0lb5auzx.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\1gli4ckq.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\1mtdcfx0.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\1opwugx1.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\2olgaqth.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\2ql3fjdc.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\3yzmga3h.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\4abba1f5.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\4gzjcgmi.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\4sstk4qw.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\5nn5ls4h.newcfg

Windows Analysis Report
Setup.exe

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:02:21.312272072 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:02:21.827608109 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:02:21 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69709dae719ae-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Jul 1, 2024 15:02:22.038235903 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:02:21 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69709dae719ae-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:02:36.378293991 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:02:36.886476994 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:02:36 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69767feb40f37-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Jul 1, 2024 15:02:37.102349043 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:02:36 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69767feb40f37-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:03:14.434118986 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:03:14.924943924 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:03:14 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69855cf031829-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Jul 1, 2024 15:03:15.134262085 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:03:14 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69855cf031829-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:03:17.375996113 CEST	117	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402 HTTP/1.1 Host: wc-partners.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:03:17.869205952 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:03:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 195 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 33 35 33 35 38 22 2c 22 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 30 33 3a 31 37 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 31 36 30 42 31 36 46 30 38 33 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 32 34 39 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3335358","Default":false,"InstallDateUtc":"7\/1\/2024 1:03:17 PM","PTAG":"A160B16F083","PURL":"default","WCYID":"WCYID10249"}}
Jul 1, 2024 15:03:17.879431963 CEST	96	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402_wb HTTP/1.1 Host: wc-partners.lavasoft.com
Jul 1, 2024 15:03:17.993823051 CEST	389	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:03:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 203 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 30 33 3a 31 37 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/1\/2024 1:03:17 PM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}
Jul 1, 2024 15:03:17.994925976 CEST	96	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402_ab HTTP/1.1 Host: wc-partners.lavasoft.com
Jul 1, 2024 15:03:18.114409924 CEST	389	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:03:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 203 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 30 33 3a 31 38 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/1\/2024 1:03:18 PM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}
Jul 1, 2024 15:03:18.115398884 CEST	96	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402_ac HTTP/1.1 Host: wc-partners.lavasoft.com
Jul 1, 2024 15:03:18.231442928 CEST	389	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:03:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 203 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 30 33 3a 31 38 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/1\/2024 1:03:18 PM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:03:21.988594055 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:03:22.486388922 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:03:22 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c698850c6cc47a-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:03:22.595174074 CEST	110	OUT	GET /version_logs?json=true&version=13.900.0.1080 HTTP/1.1 Host: webcompanion.com Connection: Keep-Alive
Jul 1, 2024 15:03:23.090677977 CEST	624	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.2.34 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69888cdab424d-EWR Data Raw: 31 35 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 31 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 38 3c 2f 62 3e [TRUNCATED] Data Ascii: 158<br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>91</b><br /><br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>98</b><br />null
Jul 1, 2024 15:03:23.549449921 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 1, 2024 15:03:23.550012112 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 1, 2024 15:03:23.552458048 CEST	629	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.2.34 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69888cdab424d-EWR Data Raw: 31 35 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 31 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 38 3c 2f 62 3e [TRUNCATED] Data Ascii: 158<br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>91</b><br /><br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>98</b><br />null0

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:02:22 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194 Connection: Keep-Alive
2024-07-01 13:02:22 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 30 37 30 31 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"20240701","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-07-01 13:02:23 UTC	472	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:02:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 846 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69711aade7289-EWR
2024-07-01 13:02:23 UTC	846	IN	Data Raw: 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 70 70 4e 61 6d 65 5c 22 3a 20 5c 22 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 22 2c 20 5c 22 53 65 74 74 69 6e 67 73 5c 22 3a 20 5b 5c 22 57 43 41 75 74 6f 55 70 64 61 74 65 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 47 72 61 6e 75 6c 61 72 69 74 79 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 56 32 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 54 69 6d 65 72 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 54 65 Data Ascii: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:02:23 UTC	166	OUT	POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 470 Connection: Keep-Alive
2024-07-01 13:02:23 UTC	470	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 32 30 30 63 62 31 33 65 2d 33 65 38 35 2d 34 33 63 32 2d 38 30 30 64 2d 65 34 66 30 37 65 36 35 39 32 36 65 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 54 72 69 67 67 65 72 22 3a 20 22 69 6e 73 74 61 6c 6c 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "200cb13e-3e85-43c2-800d-e4f07e65926e", "Version": "13.900.0.1080", "Trigger": "install", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit
2024-07-01 13:02:23 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:02:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c69716dacb5e76-EWR
2024-07-01 13:02:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:02:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:02:24 UTC	145	OUT	POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 421
2024-07-01 13:02:24 UTC	421	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 63 62 31 33 65 2d 33 65 38 35 2d 34 33 63 32 2d 38 30 30 64 2d 65 34 66 30 37 65 36 35 39 32 36 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 54 72 69 67 67 65 72 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"200cb13e-3e85-43c2-800d-e4f07e65926e","Version":"13.900.0.1080","Trigger":"install","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402"
2024-07-01 13:02:24 UTC	235	IN	HTTP/1.1 400 Bad Request Date: Mon, 01 Jul 2024 13:02:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6971bac8378e2-EWR
2024-07-01 13:02:24 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 66 6f 72 6d 61 74 2f 64 61 74 61 22 7d 0d 0a Data Ascii: 21{"message":"Invalid format/data"}
2024-07-01 13:02:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0