File name:

MDE_File_Sample_9e937e97ea0bb0acfe4114a1eccac519c0caaa75 (1).zip

Full analysis: https://app.any.run/tasks/ea8367bd-3925-4f87-9e67-7083792b530d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: February 12, 2025, 20:34:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
stealer
adware
adaware
arch-scr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

FA1EC7FDB0758B46F30218625DFB966A

SHA1:

7B1E9CB29B86535E4D605E6D9954F885F9E568C3

SHA256:

135BDE0832271341D6544975DFDD60BEC9B59B9CD76747C8D6CE6557AA87B726

SSDEEP:

24576:e7vHRrnk9xPenx4QnR16Ps2ceNCF+jxOa5DkKM:eDHRrnk9xPWyQnR16Ps2ceMF+jxOa5Du

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ADAWARE has been detected (SURICATA)

      • WebCompanion.exe (PID: 5628)
    • Actions looks like stealing of personal data

      • WebCompanion.exe (PID: 2972)
      • WebCompanion.exe (PID: 5628)
    • Steals credentials from Web Browsers

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Changes the autorun value in the registry

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
  • SUSPICIOUS

    • Searches for installed software

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Executable content was dropped or overwritten

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
      • WebCompanion-Installer.exe (PID: 5244)
    • Reads security settings of Internet Explorer

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Process drops legitimate windows executable

      • WebCompanion-Installer.exe (PID: 5244)
    • The process drops C-runtime libraries

      • WebCompanion-Installer.exe (PID: 5244)
    • Creates a software uninstall entry

      • WebCompanion-Installer.exe (PID: 5244)
    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 6472)
    • Starts CMD.EXE for commands execution

      • WebCompanion-Installer.exe (PID: 5244)
    • Drops 7-zip archiver for unpacking

      • WebCompanion-Installer.exe (PID: 5244)
    • The process creates files with name similar to system file names

      • WebCompanion-Installer.exe (PID: 5244)
    • Access to an unwanted program domain was detected

      • WebCompanion.exe (PID: 5628)
    • Checks Windows Trust Settings

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Adds/modifies Windows certificates

      • WebCompanion.exe (PID: 5628)
    • Executes as Windows Service

      • WmiApSrv.exe (PID: 6680)
    • The process checks if it is being run in the virtual environment

      • WebCompanion.exe (PID: 2972)
  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6240)
      • WebCompanion-Installer.exe (PID: 5244)
      • chrome.exe (PID: 536)
    • Checks supported languages

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6240)
      • chrome.exe (PID: 536)
    • Create files in a temporary directory

      • WebCompanion-Installer.exe (PID: 5244)
      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
    • Manual execution by a user

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
    • Disables trace logs

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Reads the machine GUID from the registry

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Reads the computer name

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Checks proxy server information

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Creates files or folders in the user directory

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Process checks computer location settings

      • WebCompanion-Installer.exe (PID: 5244)
    • Reads the software policy settings

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • SQLite executable

      • WebCompanion-Installer.exe (PID: 5244)
    • Creates files in the program directory

      • WebCompanion.exe (PID: 5628)
    • Reads CPU info

      • WebCompanion.exe (PID: 2972)
    • Reads the time zone

      • WebCompanion.exe (PID: 2972)
    • Application launched itself

      • chrome.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:02:12 19:58:12
ZipCRC: 0x20dcf0d8
ZipCompressedSize: 456165
ZipUncompressedSize: 545064
ZipFileName: 9e937e97ea0bb0acfe4114a1eccac519c0caaa75
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
186
Monitored processes
41
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe webcompanion-installer.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs #ADAWARE webcompanion.exe webcompanion.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmiapsrv.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5108 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1512"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6088 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5904 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2972"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
WebCompanion-Installer.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Version:
12.901.4.1003
Modules
Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3140"C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN230901&campaign=20731534003&C:\Program Files\Google\Chrome\Application\chrome.exe
WebCompanion-Installer.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3364"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5224 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4564 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
36 826
Read events
36 687
Write events
115
Delete events
24

Modification events

(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_9e937e97ea0bb0acfe4114a1eccac519c0caaa75 (1).zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
91
Suspicious files
323
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244WebCompanion-Installer.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dllexecutable
MD5:1D9954E5D7F2D70099670C1CD25E491B
SHA256:9BA1EA7828F227ED28FD3F7B60AF3D891E7BD155AD3F33909A5B1ADAC9E38CCC
5244WebCompanion-Installer.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exeexecutable
MD5:E983C907A0C8AA4EA37CA2A7B3FB2AE5
SHA256:7E58A8A27177D6043ACE14A124EF352119958188B60B952DC86C443F3B95967C
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\WebCompanion-Installer.exeexecutable
MD5:F6271B5D4729C2FD7DD9950F41D57C8B
SHA256:04E8C3DE51503351B4D52FA9B010AEBB41D3CCA46387046E8E689FBAA7063C16
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\ICSharpCode.SharpZipLib.dllexecutable
MD5:B0040D764201ABD71C26560E798BFA7F
SHA256:13C3E0FEC7FF29EB8AB28B321102C2D27AFCBB410884CD693CFD3D211BBEF1D5
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\WebCompanion-Installer.exe.configxml
MD5:BE34B448B611DC35DD383ED545E8FA96
SHA256:DEEBA89FAB938088E2E65942E93210E6E368EEF6BC1CA8E8724ED43154701851
6240WinRAR.exeC:\Users\admin\Desktop\9e937e97ea0bb0acfe4114a1eccac519c0caaa75executable
MD5:15670358FDFC55FB34E0D108C3A4475A
SHA256:50F13606550D1A5D9388711007CCFBCE88D8B900DC712367B66064D0D4B3FD8B
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\es-ES\WebCompanion-Installer.resources.dllexecutable
MD5:49097A52EE5BB99275F10224FBDF8DEF
SHA256:8922F2BE98BDEF22CA58CB24AD75CAC9CC9A6EEEB5E61C359CC9D639B0CA72B9
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\Newtonsoft.Json.dllexecutable
MD5:746C1F0EA5A5C0A67FE96DBA4E32AC76
SHA256:9EE20B0B7E54E633EFF1A25B6E379201D499552689AD29EEBD5AD90F221B1386
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\de-DE\WebCompanion-Installer.resources.dllexecutable
MD5:882D661D8E16DBBB09AC9B31454130F2
SHA256:91B10F5BB33CE0A3C1D10BA53AC71DBD95A5702CB7B183A65210C54FFB9CD585
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\en-US\WebCompanion-Installer.resources.dllexecutable
MD5:E4266F63970E9BB702FDED23ABB07AD7
SHA256:83CF07757CA5E7C3DD2A8CABC44BA246B6B6F24C3D7042CEB3FC91DDFA8C4160
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
113
DNS requests
118
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2336
RUXIMICS.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2336
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
3820
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6840
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
5244
WebCompanion-Installer.exe
GET
200
104.16.149.130:80
http://geo.lavasoft.com/
unknown
whitelisted
3820
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
5244
WebCompanion-Installer.exe
GET
200
104.16.149.130:80
http://geo.lavasoft.com/
unknown
whitelisted
5628
WebCompanion.exe
GET
200
2.23.198.32:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4308
svchost.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
2336
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2336
RUXIMICS.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2336
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4308
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
184.86.251.21:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
www.bing.com
  • 184.86.251.21
  • 184.86.251.20
  • 184.86.251.27
  • 184.86.251.4
  • 184.86.251.30
  • 184.86.251.23
  • 184.86.251.22
  • 184.86.251.24
  • 184.86.251.19
  • 92.123.104.38
  • 92.123.104.28
  • 92.123.104.32
  • 92.123.104.29
  • 92.123.104.44
  • 92.123.104.31
  • 92.123.104.46
  • 92.123.104.52
  • 92.123.104.30
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.65
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.68
  • 20.190.160.3
  • 20.190.160.131
  • 20.190.160.2
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
Process
Message
WebCompanion-Installer.exe
Detecting windows culture
WebCompanion-Installer.exe
Preparing request for featureflag: {"Geo":"NL","Partner":"IN230901","Campaign":"20731534003","InstallDate":"20250212","TriggerType":"install","TriggerEvent":"installer","Version":"12.901.4.1003","featurewp":true,"featureal":true}
WebCompanion-Installer.exe
Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe
2/12/2025 8:35:43 PM :-> Start
WebCompanion-Installer.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe
2/12/2025 8:35:43 PM :-> Starting installer 12.901.4.1003 with: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN230901 --nonadmin --direct --tych --campaign=20731534003 --version=12.901.4.1003, Run as admin: True
WebCompanion-Installer.exe
SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe
Preparing for installing Web Companion
WebCompanion-Installer.exe
2/12/2025 8:35:45 PM :-> Machine Id and Install Id has been generated
WebCompanion-Installer.exe
2/12/2025 8:35:45 PM :-> Generating Machine and Install Id ...