Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:Setup.exe
Analysis ID:1525401
MD5:28df21fcfe39aec7356a1e1cbadae3fb
SHA1:153d609589146237c947320298ecd58aac2fe568
SHA256:8446241c27c74561d32298e69489fb8f4be07cc00d84994786606d01b64957f9
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64_ra
  • Setup.exe (PID: 6208 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 28DF21FCFE39AEC7356A1E1CBADAE3FB)
    • WebCompanion-Installer.exe (PID: 6280 cmdline: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=18282981021 --version=13.900.0.1080 MD5: A27F9713DB1688D03D2082BFA1827803)
  • cleanup
SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
    C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
      C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
        No Sigma rule has matched
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-10-04T07:14:09.095696+020028033053Unknown Traffic192.168.2.1649701104.16.149.13080TCP
        2024-10-04T07:14:09.095696+020028033053Unknown Traffic192.168.2.1649701104.16.149.13080TCP
        2024-10-04T07:14:09.095696+020028033053Unknown Traffic192.168.2.1649701104.16.149.13080TCP
        2024-10-04T07:14:09.095696+020028033053Unknown Traffic192.168.2.1649701104.16.149.13080TCP
        2024-10-04T07:14:09.095696+020028033053Unknown Traffic192.168.2.1649701104.16.149.13080TCP
        2024-10-04T07:14:09.095696+020028033053Unknown Traffic192.168.2.1649701104.16.149.13080TCP

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeReversingLabs: Detection: 20%
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeVirustotal: Detection: 16%Perma Link
        Source: Setup.exeReversingLabs: Detection: 33%
        Source: Setup.exeVirustotal: Detection: 35%Perma Link
        Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeFile created: C:\Users\user\AppData\Local\Temp\WcInstaller.log
        Source: Setup.exeStatic PE information: certificate valid
        Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.16:49702 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.16:49703 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.16:49733 version: TLS 1.2

        Networking

        barindex
        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe, type: DROPPED
        Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com
        Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49701 -> 104.16.149.130:80
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com
        Source: global trafficDNS traffic detected: DNS query: geo.lavasoft.com
        Source: global trafficDNS traffic detected: DNS query: featureflags.lavasoft.com
        Source: global trafficDNS traffic detected: DNS query: flwadw.com
        Source: global trafficDNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com
        Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
        Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
        Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
        Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
        Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
        Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
        Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
        Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.16:49702 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.16:49703 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.16:49733 version: TLS 1.2
        Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: classification engineClassification label: mal60.troj.winEXE@3/17@4/36
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeFile created: C:\Users\user\AppData\Roaming\Lavasoft
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeMutant created: NULL
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A
        Source: Setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
        Source: Setup.exeReversingLabs: Detection: 33%
        Source: Setup.exeVirustotal: Detection: 35%
        Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\user\Desktop\Setup.exe
        Source: unknownProcess created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
        Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=18282981021 --version=13.900.0.1080
        Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=18282981021 --version=13.900.0.1080
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: apphelp.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: acgenral.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: uxtheme.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmm.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: samcli.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: msacm32.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: version.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: userenv.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: dwmapi.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: urlmon.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: mpr.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: sspicli.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: iertutil.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: srvcli.dll
        Source: C:\Users\user\Desktop\Setup.exeSection loaded: netutils.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: mscoree.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: kernel.appcore.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: version.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: uxtheme.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: cryptsp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: rsaenh.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: cryptbase.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dwrite.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: msvcp140_clr0400.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: windows.storage.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: wldp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: profapi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: httpapi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: mswsock.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dnsapi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: iphlpapi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: rasadhlp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: fwpuclnt.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: ntmarta.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: rasapi32.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: rasman.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: rtutils.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: winhttp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dhcpcsvc6.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dhcpcsvc.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: winnsi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: secur32.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: sspicli.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: schannel.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: mskeyprotect.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: ntasn1.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: ncrypt.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: ncryptsslp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: msasn1.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: gpapi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: wbemcomn.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: amsi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: userenv.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dwmapi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: d3d9.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: d3d10warp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: wtsapi32.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: winsta.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: powrprof.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: umpdc.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: textshaping.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dataexchange.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: d3d11.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dcomp.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dxgi.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: urlmon.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: iertutil.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: srvcli.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: netutils.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: windowscodecs.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: resourcepolicyclient.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: dxcore.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: textinputframework.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: coreuicomponents.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: coremessaging.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: wintypes.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: wintypes.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: wintypes.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: msctfui.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: uiautomationcore.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: propsys.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeSection loaded: d3dcompiler_47.dll
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
        Source: Setup.exeStatic PE information: certificate valid
        Source: Setup.exeStatic PE information: real checksum: 0x8ffaf should be: 0x88f0f
        Source: Setup.exeStatic PE information: section name: .sxdata
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\es-ES\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\Newtonsoft.Json.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\fr-CA\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\tr-TR\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\ICSharpCode.SharpZipLib.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\it-IT\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\pt-BR\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\zh-CHS\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\en-US\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\de-DE\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\ja-JP\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\7zS0483833A\ru-RU\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeFile created: C:\Users\user\AppData\Local\Temp\WcInstaller.log
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeMemory allocated: 10E0000 memory reserve | memory write watch
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeMemory allocated: 2B10000 memory reserve | memory write watch
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeMemory allocated: 2920000 memory reserve | memory write watch
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 600000
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599889
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599778
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599666
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599554
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599442
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599314
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599187
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599076
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598964
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598853
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598741
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598629
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598501
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598389
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598277
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598165
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598053
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597925
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597797
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597686
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597574
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597462
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597350
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597238
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597110
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596998
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596886
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596774
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596662
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596534
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596406
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596294
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596182
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596072
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595960
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595848
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595720
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595609
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595497
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595385
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595274
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595162
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595035
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594907
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594795
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594683
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594571
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594460
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\es-ES\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\Newtonsoft.Json.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\fr-CA\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\tr-TR\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\ICSharpCode.SharpZipLib.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\it-IT\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\pt-BR\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\en-US\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\zh-CHS\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\de-DE\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\ru-RU\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS0483833A\ja-JP\WebCompanion-Installer.resources.dllJump to dropped file
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 7012Thread sleep count: 199 > 30
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -2767011611056431s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -600000s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 7012Thread sleep count: 41 > 30
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599889s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599778s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599666s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599554s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599442s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599314s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599187s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -599076s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598964s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598853s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598741s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598629s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598501s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598389s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598277s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598165s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -598053s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597925s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597797s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597686s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597574s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597462s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597350s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597238s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -597110s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596998s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596886s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596774s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596662s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596534s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596406s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596294s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596182s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -596072s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595960s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595848s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595720s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595609s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595497s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595385s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595274s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595162s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -595035s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -594907s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -594795s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -594683s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -594571s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe TID: 6656Thread sleep time: -594460s >= -30000s
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 600000
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599889
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599778
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599666
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599554
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599442
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599314
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599187
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 599076
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598964
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598853
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598741
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598629
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598501
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598389
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598277
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598165
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 598053
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597925
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597797
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597686
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597574
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597462
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597350
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597238
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 597110
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596998
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596886
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596774
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596662
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596534
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596406
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596294
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596182
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 596072
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595960
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595848
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595720
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595609
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595497
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595385
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595274
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595162
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 595035
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594907
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594795
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594683
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594571
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeThread delayed: delay time: 594460
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess information queried: ProcessInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeProcess token adjusted: Debug
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeMemory allocated: page read and write | page guard
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS0483833A\Newtonsoft.Json.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS0483833A\en-US\WebCompanion-Installer.resources.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXmlLinq.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\7zS0483833A\ICSharpCode.SharpZipLib.dll VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
        Windows Management Instrumentation
        1
        DLL Side-Loading
        1
        Process Injection
        1
        Masquerading
        OS Credential Dumping12
        Security Software Discovery
        Remote ServicesData from Local System2
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
        DLL Side-Loading
        1
        Disable or Modify Tools
        LSASS Memory1
        Process Discovery
        Remote Desktop ProtocolData from Removable Media1
        Ingress Tool Transfer
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)41
        Virtualization/Sandbox Evasion
        Security Account Manager41
        Virtualization/Sandbox Evasion
        SMB/Windows Admin SharesData from Network Shared Drive2
        Non-Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
        Process Injection
        NTDS22
        System Information Discovery
        Distributed Component Object ModelInput Capture3
        Application Layer Protocol
        Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        DLL Side-Loading
        LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        Setup.exe33%ReversingLabsWin32.Trojan.Generic
        Setup.exe36%VirustotalBrowse
        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Local\Temp\7zS0483833A\ICSharpCode.SharpZipLib.dll4%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\ICSharpCode.SharpZipLib.dll1%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\Newtonsoft.Json.dll3%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\Newtonsoft.Json.dll1%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe21%ReversingLabsWin32.PUA.Generic
        C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe17%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\de-DE\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\de-DE\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\en-US\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\en-US\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\es-ES\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\es-ES\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\fr-CA\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\fr-CA\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\it-IT\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\it-IT\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\ja-JP\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\ja-JP\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\pt-BR\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\pt-BR\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\ru-RU\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\ru-RU\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\tr-TR\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\tr-TR\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        C:\Users\user\AppData\Local\Temp\7zS0483833A\zh-CHS\WebCompanion-Installer.resources.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\7zS0483833A\zh-CHS\WebCompanion-Installer.resources.dll0%VirustotalBrowse
        No Antivirus matches
        SourceDetectionScannerLabelLink
        geo.lavasoft.com0%VirustotalBrowse
        featureflags.lavasoft.com0%VirustotalBrowse
        flwadw.com0%VirustotalBrowse
        wcdownloadercdn.lavasoft.com1%VirustotalBrowse
        SourceDetectionScannerLabelLink
        http://geo.lavasoft.com/0%VirustotalBrowse
        NameIPActiveMaliciousAntivirus DetectionReputation
        geo.lavasoft.com
        104.16.149.130
        truefalseunknown
        wcdownloadercdn.lavasoft.com
        104.16.148.130
        truefalseunknown
        featureflags.lavasoft.com
        104.16.148.130
        truefalseunknown
        flwadw.com
        104.18.27.149
        truefalseunknown
        NameMaliciousAntivirus DetectionReputation
        http://geo.lavasoft.com/falseunknown
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        104.18.27.149
        flwadw.comUnited States
        13335CLOUDFLARENETUSfalse
        104.16.149.130
        geo.lavasoft.comUnited States
        13335CLOUDFLARENETUSfalse
        104.16.148.130
        wcdownloadercdn.lavasoft.comUnited States
        13335CLOUDFLARENETUSfalse
        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1525401
        Start date and time:2024-10-04 07:13:24 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowsinteractivecookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:12
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        Analysis Mode:stream
        Analysis stop reason:Timeout
        Sample name:Setup.exe
        Detection:MAL
        Classification:mal60.troj.winEXE@3/17@4/36
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
        • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, ocsp.entrust.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtProtectVirtualMemory calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        • Report size getting too big, too many NtReadVirtualMemory calls found.
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):213656
        Entropy (8bit):5.7590593524797615
        Encrypted:false
        SSDEEP:
        MD5:0CFE19791546A96C6699657A94604596
        SHA1:5D1A1B74CCA9F74FFFEBCB583661C02E4CA626DD
        SHA-256:56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
        SHA-512:586CC695A2C3C03008D0A1032C221CD3384B5F4363E83C9D903753FB1DAD65B340BC8CD0659F7F891A641F8BD7535C9B889219842045854AA98CD380F0FE4AA3
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 4%
        • Antivirus: Virustotal, Detection: 1%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......sC....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):438424
        Entropy (8bit):6.09887709092106
        Encrypted:false
        SSDEEP:
        MD5:461C476F474A5F13D2EA9344AE6F70F6
        SHA1:8F74702B99F08277D4514C63956E2E69E8090073
        SHA-256:4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
        SHA-512:E69080C205CD82EA2C056FA1328BBEC4C03CA3FDC3EE381C4FB44CB356247BE5FE4B8ADD53036DCB19CAC2C6D59B8E02F81932320EA534B5BA50DB80A0647017
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 3%
        • Antivirus: Virustotal, Detection: 1%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ..............................%.....@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{....*"..}....*V.(x.....(......}....*2.{....oy...*2.{....oz...*B..(....&..(....*...0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o|.....{.....o....oo...o}.....o....o....t.....o....o..
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):438936
        Entropy (8bit):6.4311342686757245
        Encrypted:false
        SSDEEP:
        MD5:A27F9713DB1688D03D2082BFA1827803
        SHA1:B8DF4649659003609419D052757166499D2322E8
        SHA-256:2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
        SHA-512:F952C6792F10CB60CA3ECC00B317C33AADB65C8471D106171660EC0FCB0603C8D18B8AD2A90AACDA6581D342647290099AF0ED0FDD897EDB390D5BF9209EA905
        Malicious:true
        Yara Hits:
        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe, Author: Joe Security
        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe, Author: Joe Security
        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe, Author: Joe Security
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 21%
        • Antivirus: Virustotal, Detection: 17%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.....................t.......(... ...@....@.. ....................................@..................................(..K....@...q...............2..........X'............................................... ............... ..H............text........ ...................... ..`.rsrc....q...@...r..................@..@.reloc...............~..............@..B.................(......H..................{....i...9............................................~....}.....(......su...}......(....}....*.r...p*z.(....r'..p.{....(......(....*....0..j..........{....r...pov...,.(.....+.(......r...p(......(......r...p.{....o....o.......(........sG........o......z*..........UU......N.(....r...p..(....*.r...p.....*..{....*"..}....*.rA..p*.rS..p*.(....oV...*f.~....}.....(......(....*.ro..p*N.(....r...p..(....*.0..i.......~......(....(!...,.r...p.+..(.......(j.....(...+
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
        Category:dropped
        Size (bytes):2273
        Entropy (8bit):5.064418012146103
        Encrypted:false
        SSDEEP:
        MD5:E3D3AA100B93504676414B9268DFBAD4
        SHA1:A7D1E59C9D8C48DFE259D2973C13B0E2965E67AA
        SHA-256:EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
        SHA-512:9470E0B4784CE3AA94248DDBD9C17BCA988B6A680754511CBE1F1C368270F6D18C75AD1EA0F3A438CA5BB1A12E55E8745F68F2EBC9F78C68B373A6541AC9EFBE
        Malicious:true
        Reputation:unknown
        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip"/>.. <add key="WebInstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe"/>.. <add key="WebProtectionZip" va
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):6656
        Entropy (8bit):4.423116664692943
        Encrypted:false
        SSDEEP:
        MD5:A564D6AE745D289B599A010E570E609E
        SHA1:7A698D14CDAB971982B02AF5A9C49D8AEDA56A19
        SHA-256:E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
        SHA-512:2894F6832F6D20E97E18FF09780D34E7CC25074F0382742838C9A060AF7ADE3FFD3DA9F844E0475697E3854A97379F0961A7F65A1EB5F2ACBA2AF17E49D75B39
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................1... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......h-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.|.-..X:..o.....V..................v...1.D|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):6144
        Entropy (8bit):4.337584317889265
        Encrypted:false
        SSDEEP:
        MD5:88498F281D2BC857F09C3A0EFFE97A35
        SHA1:5560555DED4D2336EBAAC6AECBD80C2FC6F0AAE7
        SHA-256:2FBD9C10CEC246D5E6EE2F41635F283C3064773724253BAE598BFAEA735B702D
        SHA-512:2550C9C2E42E77A44520EC53418636721C3A56BE7B647C839B7A3063A9BDE4FFD304A6812F51A95DF19B1F04E05285FA9C23AF946472F07DE10F514DDB0DF9C0
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................N/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0/......H........+..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet.... .......PADPADP......n.....V ...].......}.E(/....xv.|.-..X:..o.....V..............v.D|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq........\.......i.......t...............z...O...L...<...5...*.......................E...........L...
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):6656
        Entropy (8bit):4.320496600456879
        Encrypted:false
        SSDEEP:
        MD5:A22C9231A5562DCA9F0BC186BDA3348D
        SHA1:D4D281A596E272A482C6917DC3CA67C150E72FCB
        SHA-256:AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
        SHA-512:C140934BF63AADB01F7C0A1A4A7E89FB7CC6DEAA5219BBCB64EB6FB9D29F8139DC4A17C990373BB008A891436BD60E8B21CF748DAB0FA263853663AD17BA9FB4
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@.................................<0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p0......H........,..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.|.-..X:..o.....V..................v...1.D|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):6656
        Entropy (8bit):4.4162624308031155
        Encrypted:false
        SSDEEP:
        MD5:07759138B75C31E8E62E2DCB9E5B4121
        SHA1:C78CAC2D69DD3770256EA1D22FE62F8991AE1735
        SHA-256:460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
        SHA-512:7089069EFBE9109ED034C9538B16F482573757A6DAED2D870CF1711F15B1F39FFFC6E5F9FF5E3380514EAFCEE49797F63DD0C9E472D37647EE3FCF34E086B189
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......8-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.|.-..X:..o.....V..................v...1.D|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):5632
        Entropy (8bit):4.05939038461759
        Encrypted:false
        SSDEEP:
        MD5:320A49D5E8C225BF7D8C8FC8F0FBA1FE
        SHA1:6986D89BABDB474B16E3074865EEDFFCCECC9337
        SHA-256:53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
        SHA-512:6EC2883F6542F8EA3966F367E11359B3702B8E8E01FAFA3D3828E16D216CC77CC71B92BB1BFBC0C7F146C79FB4DBEE5FAD84288DFE1C5979F0C59841B92F03D6
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n,... ...@....... ....................................@..................................,..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P,......H........(..d...........P ..`...........................................\..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.|.-..X:.....V..................v...1.D|-...."..&#Uv=.9.W.F.^:1;j........a.......J...'...........(...............p.......E...........{...........b.......B...O............B.T.N._.C.L.O.S.E......
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):5632
        Entropy (8bit):4.697358912630535
        Encrypted:false
        SSDEEP:
        MD5:442654050F5E5EBFB286C75A6AD10485
        SHA1:7F9AB13C925DDDE3ADE1EBA334DD17F6BF341F7A
        SHA-256:B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
        SHA-512:E7F9F728603091728451127C02B1F8412C741C57C5ADFED91FECA37989C07570886ACA262ECBDB17A968474E05936C3485602115CBC26EDCEE65DD7764B76795
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................-... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H....... *..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.|.-..X:.....V..................v...1.D|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):6656
        Entropy (8bit):4.272201212454418
        Encrypted:false
        SSDEEP:
        MD5:01CCD85F0676258B5E4A223832E3258C
        SHA1:630CD9F369A81A7823905FD842FDDEEFAF23D3A1
        SHA-256:C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
        SHA-512:1BB2DB0ABF3E0BCA3B131D2DF5329006A56E3FAA4E540621E54AA98DBB0BF4E27093314B477AA66E4F10FE0AF5DF1887FF23CAD938C5B0F98E455433E14FAD01
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......|,..d...........P ..,...........................................(..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.|.-..X:..o.....V..................v...1.D|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):7680
        Entropy (8bit):4.608207837862824
        Encrypted:false
        SSDEEP:
        MD5:F2876EC061D1CC88E44104ED97FC36F8
        SHA1:68BFE2A32CA14B0C379EF725E426AB2FED09E075
        SHA-256:6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04
        SHA-512:E3DD2BAAB3C5AFB124DC9CC0BB2D9318D33707732B4F23C211C2E3BC5A8A8889FAF42003857DA98D43DD7F7368CAFB3A02591BE04DCA4E1343A00283CA071DB6
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................3... ...@....... ....................................@..................................3..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......L0..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.|.-..X:..o.....V..................v...1.D|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):5632
        Entropy (8bit):4.204809000235561
        Encrypted:false
        SSDEEP:
        MD5:D0009577C38F3338B2A3DCCEE9DF5169
        SHA1:D567D95A61B57885B55D7D70B93BC839EF162436
        SHA-256:598BAD964E2BED4A4EDAFAC5E8838C7B922C6EBBFBA70EDA0D400E543B91E54B
        SHA-512:95F766F541CA5EFC74C3DCC9D5C299798B581F1B302A4EFFDCA9B7ED4177DAF4E8547B7729DB724EB0A8A28C9770FC470BF9BDF2C616F70782DC96056CF8410E
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................,... ...@....... ....................................@.................................<,..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p,......H........(..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.|.-..X:.....V..................v...1.D|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.
        Process:C:\Users\user\Desktop\Setup.exe
        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
        Category:dropped
        Size (bytes):5120
        Entropy (8bit):4.582926268925439
        Encrypted:false
        SSDEEP:
        MD5:322549094C487E49ACEB9899419D8EC6
        SHA1:DD0E5FF6BC3E4590203829DA1BB8BD7B00CBD07E
        SHA-256:7824381C18E86E72C0D4A8BB0ED377DFDB6E3B5374984ED67AF119B14268E70D
        SHA-512:80747F72196406993110D0DB5B736BCA21975C26615D34F771042E69CA0D519ED80C0E9267A90517A5B9862AB44CF9F9D96C354E952CB9CB0C32EB4887F80A1C
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 0%
        • Antivirus: Virustotal, Detection: 0%, Browse
        Reputation:unknown
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................+... ...@....... ....................................@.................................t+..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........(..h...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.|.-..X:.....V..................v...1.D|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.
        Process:C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe
        File Type:ASCII text, with very long lines (912), with CRLF line terminators
        Category:modified
        Size (bytes):3301
        Entropy (8bit):5.308092675933736
        Encrypted:false
        SSDEEP:
        MD5:46D99296707070441E4014A4E244B45F
        SHA1:EDE8B92CD5180C617B0DE7789725FE31FAE8D645
        SHA-256:3825C6CA801567C0D85DF0324C919B51E03686C515BAE33E3D6BF85397CA8A5B
        SHA-512:0805B58EAE14C6C3E315B39B1A34A25D4F12D223463E8EC6CEE8F136452BB28A2D0E98ACF8D65AD41735448776F6D7BF2AC7300FCF7122B8809824E68C1674EE
        Malicious:false
        Reputation:unknown
        Preview:Detecting windows culture..Preparing request for featureflag: {"Geo":"GB","Partner":"IN240402","Campaign":"18282981021","InstallDate":"20241004","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}..Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklis
        Process:C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe
        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
        Category:modified
        Size (bytes):10494317
        Entropy (8bit):7.994463819622281
        Encrypted:true
        SSDEEP:
        MD5:C0A2AAF917E6BC1D951EC481213D4138
        SHA1:56308BC1CF014F507E161B518736CD3D3666387D
        SHA-256:2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
        SHA-512:43EF07470F33BA0FF6A18E343C55ADAF0CDB2B88C3B37FA53F32608F1F78B6266BFACD2BB3BD92BF56EB0E28C4C20278212E06C1873DEA9098ECE5CDB117B9BC
        Malicious:false
        Reputation:unknown
        Preview:PK.........%.X....FF...$......Application/7za.exe.yxTE.8|{I.YH'@CX.V[..%CP.4h_.MnCG@DQ..h..... .`'..\[...u..yg....QGY\........{..d.....S.......~.}y...N.:u..S.NU...`......*.k....~.......e..o.`.......[`._..]U..g.s...?..~..J..:.~.s.t.}..q.>}2l.....u.....#.Y..Mt}.......6z......{.:.:.y^KW.]....ys."..Nu.........C.EB..$..P.k......s.(..zN..K.........iH..Z.....[..x.P.7.iB.6..Ta.,..I...#....g.r...<.wg.....zb......QUw..M.:...L...nHN..r...]#..TA.r...vO..5.'.:B]..p}<.lxU... ...6...........?i...o...g..7H...%E_..B...d.... .f.].&I..Q..G.S..x.o.K......../.~...g.Q_..^(..h^...Dq.J\Y2.....&...........Fo`...........}....98E'..Kne+c........._./..o.o.+g.z..M.6.....D.D.^I9..!..0HJ..?h.7..2"U.;...RY..=b..k.^y....0.l...m*...h..9.........f....J-N..KU....HH."......Y...I)8..=s>.)MPH!.L....e...J..`bc(.:.-M=}...v...=..9.:..u.7.X.O...T..%e.)V...rS..s....o...[1.C... ...x7g)P..:............8. .u...lv-a..MB.TyW..D..p$..0.x>..'..K..l./g..U......b{.!_...,....<.....$#zh.e....+.
        Process:C:\Users\user\AppData\Local\Temp\7zS0483833A\WebCompanion-Installer.exe
        File Type:JSON data
        Category:dropped
        Size (bytes):56
        Entropy (8bit):4.4834448240680045
        Encrypted:false
        SSDEEP:
        MD5:8E1931157CEA768012397AD30D9BF945
        SHA1:F319B9576D7874FDD5245865156961A095A53CC6
        SHA-256:75DE2DAE215C7347F480F21E0302AD9B02CD6B61C8D7DC8381626D0862E32934
        SHA-512:FCED4F994273C2B1412CF8677E20C88108E970EF5F31E29CF32E9B103A629D6F5087DD0F6C1D4B875F0DBD02F548F0E9ABA1757B9FF3639F4CB4627C65ED930E
        Malicious:false
        Reputation:unknown
        Preview:{ "install_id" : "04c54e01-18f3-4071-89b0-994bf853747b"}
        File type:PE32 executable (GUI) Intel 80386, for MS Windows
        Entropy (8bit):7.653639216512008
        TrID:
        • Win32 Executable (generic) a (10002005/4) 99.40%
        • InstallShield setup (43055/19) 0.43%
        • Windows Screen Saver (13104/52) 0.13%
        • Generic Win/DOS Executable (2004/3) 0.02%
        • DOS Executable Generic (2002/1) 0.02%
        File name:Setup.exe
        File size:545'352 bytes
        MD5:28df21fcfe39aec7356a1e1cbadae3fb
        SHA1:153d609589146237c947320298ecd58aac2fe568
        SHA256:8446241c27c74561d32298e69489fb8f4be07cc00d84994786606d01b64957f9
        SHA512:46ebfbe59dde93ef45bfb37ba4d64367984d730cefa4713f1f920d5452896d1489e5d7b1196e27be118593a371662ddaab93cc01b0aee3769c4835b32083b6e0
        SSDEEP:12288:WG5knZfFKeTVOydwORmV42Y5RBHtf8WS8sejGxUeRx7/ta:WG50ZfFKMVRCa0gDS8geeBa
        TLSH:59C4F1127DE089B6D5810431CC745FA6A2B6FE560A20887773997E3E7F7F642C232A1D
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...
        Icon Hash:8011090b07071616
        Entrypoint:0x4148d4
        Entrypoint Section:.text
        Digitally signed:true
        Imagebase:0x400000
        Subsystem:windows gui
        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        DLL Characteristics:
        Time Stamp:0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:4
        OS Version Minor:0
        File Version Major:4
        File Version Minor:0
        Subsystem Version Major:4
        Subsystem Version Minor:0
        Import Hash:e00de6e48b9b06aceb12a81e7bf494c9
        Signature Valid:true
        Signature Issuer:CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
        Signature Validation Error:The operation completed successfully
        Error Number:0
        Not Before, Not After
        • 01/05/2024 16:39:26 01/05/2025 16:39:25
        Subject Chain
        • CN=7270356 Canada Inc., SERIALNUMBER=1417258-2, OID.2.5.4.15=Private Organization, O=7270356 Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
        Version:3
        Thumbprint MD5:0E3940FCE9D8B244F0D82DDEEBE28F5E
        Thumbprint SHA-1:EA06433E6F12D2AADA040F4A6EF7C927404A4CBA
        Thumbprint SHA-256:EB0A666D9DFD790059DF788FBA544ABC93E1690F1425147BA0A6E784AFC6F5B5
        Serial:25D0CB9D7B0D6C700CDAE43D243AB1C6
        Instruction
        push ebp
        mov ebp, esp
        push FFFFFFFFh
        push 0041B9E8h
        push 004147FCh
        mov eax, dword ptr fs:[00000000h]
        push eax
        mov dword ptr fs:[00000000h], esp
        sub esp, 58h
        push ebx
        push esi
        push edi
        mov dword ptr [ebp-18h], esp
        call dword ptr [0041B078h]
        xor edx, edx
        mov dl, ah
        mov dword ptr [004233F0h], edx
        mov ecx, eax
        and ecx, 000000FFh
        mov dword ptr [004233ECh], ecx
        shl ecx, 08h
        add ecx, edx
        mov dword ptr [004233E8h], ecx
        shr eax, 10h
        mov dword ptr [004233E4h], eax
        push 00000001h
        call 00007F3A807BB80Bh
        pop ecx
        test eax, eax
        jne 00007F3A807BA97Ah
        push 0000001Ch
        call 00007F3A807BAA38h
        pop ecx
        call 00007F3A807BB2BDh
        test eax, eax
        jne 00007F3A807BA97Ah
        push 00000010h
        call 00007F3A807BAA27h
        pop ecx
        xor esi, esi
        mov dword ptr [ebp-04h], esi
        call 00007F3A807BD42Ch
        call dword ptr [0041B07Ch]
        mov dword ptr [00425A5Ch], eax
        call 00007F3A807BD2EAh
        mov dword ptr [00423360h], eax
        call 00007F3A807BD093h
        call 00007F3A807BCFD5h
        call 00007F3A807BCA30h
        mov dword ptr [ebp-30h], esi
        lea eax, dword ptr [ebp-5Ch]
        push eax
        call dword ptr [0041B080h]
        call 00007F3A807BCF66h
        mov dword ptr [ebp-64h], eax
        test byte ptr [ebp-30h], 00000001h
        je 00007F3A807BA978h
        movzx eax, word ptr [ebp+00h]
        Programming Language:
        • [ C ] VS98 (6.0) SP6 build 8804
        • [C++] VS98 (6.0) SP6 build 8804
        • [ C ] VS2010 build 30319
        • [ASM] VS2010 build 30319
        • [EXP] VC++ 6.0 SP5 build 8804
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x1e9ac0x64.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x270000x71d4.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x81fb00x3298
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x1b0000x200.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x197c00x19800206b62d600beb166f8bf863ad5301f8cFalse0.5831609987745098DOS executable (COM)6.60822715389085IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0x1b0000x44900x4600b0314f39355cab7d4674a0928d3b15f2False0.312109375data4.383775518811042IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x200000x5a680x32008d44c03d32e0c923339cda9fae15827aFalse0.123828125data1.3793356235333818IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .sxdata0x260000x40x20035925cfdc1176bd9ffc634a58b40ec17False0.02734375data0.020393135236084953IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rsrc0x270000x71d40x7200cd606fe2fe8a9aaa6244d6a44a46010aFalse0.3919613486842105data4.655199945289653IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        NameRVASizeTypeLanguageCountryZLIB Complexity
        RT_ICON0x273540x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.37231182795698925
        RT_ICON0x2763c0x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishUnited States0.5472972972972973
        RT_ICON0x277640x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m0.3200354609929078
        RT_ICON0x27bcc0x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m0.23688524590163934
        RT_ICON0x285540x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m0.1721388367729831
        RT_ICON0x295fc0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m0.1241701244813278
        RT_ICON0x2bba40x1a7bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9648915769287506
        RT_DIALOG0x2d6200xb8dataEnglishUnited States0.6684782608695652
        RT_STRING0x2d6d80x94dataEnglishUnited States0.668918918918919
        RT_STRING0x2d76c0x34dataEnglishUnited States0.6538461538461539
        RT_GROUP_ICON0x2d7a00x4cdata0.8289473684210527
        RT_GROUP_ICON0x2d7ec0x22dataEnglishUnited States1.0
        RT_VERSION0x2d8100x344dataEnglishUnited States0.4318181818181818
        RT_MANIFEST0x2db540x67fexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3692122669873722
        DLLImport
        OLEAUT32.dllVariantClear, SysAllocString
        USER32.dllSendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
        SHELL32.dllShellExecuteExA
        KERNEL32.dllGetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread
        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States