File name:

MDE_File_Sample_9e937e97ea0bb0acfe4114a1eccac519c0caaa75 (1).zip

Full analysis: https://app.any.run/tasks/ea8367bd-3925-4f87-9e67-7083792b530d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: February 12, 2025, 20:34:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
stealer
adware
adaware
arch-scr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

FA1EC7FDB0758B46F30218625DFB966A

SHA1:

7B1E9CB29B86535E4D605E6D9954F885F9E568C3

SHA256:

135BDE0832271341D6544975DFDD60BEC9B59B9CD76747C8D6CE6557AA87B726

SSDEEP:

24576:e7vHRrnk9xPenx4QnR16Ps2ceNCF+jxOa5DkKM:eDHRrnk9xPWyQnR16Ps2ceMF+jxOa5Du

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • ADAWARE has been detected (SURICATA)

      • WebCompanion.exe (PID: 5628)
    • Changes the autorun value in the registry

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Actions looks like stealing of personal data

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
      • WebCompanion-Installer.exe (PID: 5244)
    • Searches for installed software

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Process drops legitimate windows executable

      • WebCompanion-Installer.exe (PID: 5244)
    • The process drops C-runtime libraries

      • WebCompanion-Installer.exe (PID: 5244)
    • Starts CMD.EXE for commands execution

      • WebCompanion-Installer.exe (PID: 5244)
    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 6472)
    • Reads security settings of Internet Explorer

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Drops 7-zip archiver for unpacking

      • WebCompanion-Installer.exe (PID: 5244)
    • The process creates files with name similar to system file names

      • WebCompanion-Installer.exe (PID: 5244)
    • Creates a software uninstall entry

      • WebCompanion-Installer.exe (PID: 5244)
    • Checks Windows Trust Settings

      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Adds/modifies Windows certificates

      • WebCompanion.exe (PID: 5628)
    • Access to an unwanted program domain was detected

      • WebCompanion.exe (PID: 5628)
    • Executes as Windows Service

      • WmiApSrv.exe (PID: 6680)
    • The process checks if it is being run in the virtual environment

      • WebCompanion.exe (PID: 2972)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6240)
      • chrome.exe (PID: 536)
    • Checks supported languages

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 2972)
      • WebCompanion.exe (PID: 5628)
    • The sample compiled with english language support

      • WinRAR.exe (PID: 6240)
      • WebCompanion-Installer.exe (PID: 5244)
      • chrome.exe (PID: 536)
    • Reads the machine GUID from the registry

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Create files in a temporary directory

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
      • WebCompanion-Installer.exe (PID: 5244)
    • Manual execution by a user

      • 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe (PID: 4764)
    • Disables trace logs

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • SQLite executable

      • WebCompanion-Installer.exe (PID: 5244)
    • Process checks computer location settings

      • WebCompanion-Installer.exe (PID: 5244)
    • Reads the computer name

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 2972)
      • WebCompanion.exe (PID: 5628)
    • Checks proxy server information

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Creates files or folders in the user directory

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Reads the software policy settings

      • WebCompanion-Installer.exe (PID: 5244)
      • WebCompanion.exe (PID: 5628)
      • WebCompanion.exe (PID: 2972)
    • Creates files in the program directory

      • WebCompanion.exe (PID: 5628)
    • Application launched itself

      • chrome.exe (PID: 3140)
    • Reads CPU info

      • WebCompanion.exe (PID: 2972)
    • Reads the time zone

      • WebCompanion.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:02:12 19:58:12
ZipCRC: 0x20dcf0d8
ZipCompressedSize: 456165
ZipUncompressedSize: 545064
ZipFileName: 9e937e97ea0bb0acfe4114a1eccac519c0caaa75
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
186
Monitored processes
41
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 9e937e97ea0bb0acfe4114a1eccac519c0caaa75.exe webcompanion-installer.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs #ADAWARE webcompanion.exe webcompanion.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmiapsrv.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5108 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1512"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6088 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5904 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2972"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
WebCompanion-Installer.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Version:
12.901.4.1003
Modules
Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3140"C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN230901&campaign=20731534003&C:\Program Files\Google\Chrome\Application\chrome.exe
WebCompanion-Installer.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3364"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5224 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4564 --field-trial-handle=1960,i,1835585331314613284,9484472680356263500,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
36 826
Read events
36 687
Write events
115
Delete events
24

Modification events

(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_9e937e97ea0bb0acfe4114a1eccac519c0caaa75 (1).zip
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6240) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
91
Suspicious files
323
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\WebCompanion-Installer.exe.configxml
MD5:BE34B448B611DC35DD383ED545E8FA96
SHA256:DEEBA89FAB938088E2E65942E93210E6E368EEF6BC1CA8E8724ED43154701851
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\es-ES\WebCompanion-Installer.resources.dllexecutable
MD5:49097A52EE5BB99275F10224FBDF8DEF
SHA256:8922F2BE98BDEF22CA58CB24AD75CAC9CC9A6EEEB5E61C359CC9D639B0CA72B9
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\ja-JP\WebCompanion-Installer.resources.dllexecutable
MD5:6D043830CBA47195B2DD06DAFC9216BA
SHA256:DCD3BD4FBF91BF5348F071AD284866725DFF07907641C9F52F9EE99C26EC3EB5
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\en-US\WebCompanion-Installer.resources.dllexecutable
MD5:E4266F63970E9BB702FDED23ABB07AD7
SHA256:83CF07757CA5E7C3DD2A8CABC44BA246B6B6F24C3D7042CEB3FC91DDFA8C4160
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\zh-CHS\WebCompanion-Installer.resources.dllexecutable
MD5:E3614E59F9F8C062A9B7B2A2E3D65C79
SHA256:2FFD832564129E2E3EDBD0E505C222EE64D13B78641F83B284052BB32C808B1B
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\it-IT\WebCompanion-Installer.resources.dllexecutable
MD5:B1E13550602007500AB49888607320E7
SHA256:5126C176226EF22564CED739E43F65A50EE96034F4D709AB184A3E1C07D53797
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\fr-CA\WebCompanion-Installer.resources.dllexecutable
MD5:E3F8A037101B250E7D355AEBBE6DF9ED
SHA256:C9E73B71A6F04A113E2765E7FFAA6051E09E5F3E86CE2F67D264B3DB05F9E19A
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\pt-BR\WebCompanion-Installer.resources.dllexecutable
MD5:917BC855C6178351A99AE65DC3C45129
SHA256:2960AE10EBE3BCE868C0D7FF416FFB462F2B6E3032A5D576C7154FF451ACC713
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\de-DE\WebCompanion-Installer.resources.dllexecutable
MD5:882D661D8E16DBBB09AC9B31454130F2
SHA256:91B10F5BB33CE0A3C1D10BA53AC71DBD95A5702CB7B183A65210C54FFB9CD585
47649e937e97ea0bb0acfe4114a1eccac519c0caaa75.exeC:\Users\admin\AppData\Local\Temp\7zSC927F674\Newtonsoft.Json.dllexecutable
MD5:746C1F0EA5A5C0A67FE96DBA4E32AC76
SHA256:9EE20B0B7E54E633EFF1A25B6E379201D499552689AD29EEBD5AD90F221B1386
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
113
DNS requests
118
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2336
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
2336
RUXIMICS.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
3820
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
3820
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6840
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
5244
WebCompanion-Installer.exe
GET
200
104.16.149.130:80
http://geo.lavasoft.com/
unknown
whitelisted
5628
WebCompanion.exe
GET
200
2.23.198.32:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
whitelisted
5628
WebCompanion.exe
GET
200
2.23.198.32:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCEHTvSjTpoGUpJ37OBzkq8uU%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4308
svchost.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
2336
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2336
RUXIMICS.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2336
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4308
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
184.86.251.21:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
www.bing.com
  • 184.86.251.21
  • 184.86.251.20
  • 184.86.251.27
  • 184.86.251.4
  • 184.86.251.30
  • 184.86.251.23
  • 184.86.251.22
  • 184.86.251.24
  • 184.86.251.19
  • 92.123.104.38
  • 92.123.104.28
  • 92.123.104.32
  • 92.123.104.29
  • 92.123.104.44
  • 92.123.104.31
  • 92.123.104.46
  • 92.123.104.52
  • 92.123.104.30
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.65
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.68
  • 20.190.160.3
  • 20.190.160.131
  • 20.190.160.2
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1792
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5628
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
Process
Message
WebCompanion-Installer.exe
Detecting windows culture
WebCompanion-Installer.exe
Preparing request for featureflag: {"Geo":"NL","Partner":"IN230901","Campaign":"20731534003","InstallDate":"20250212","TriggerType":"install","TriggerEvent":"installer","Version":"12.901.4.1003","featurewp":true,"featureal":true}
WebCompanion-Installer.exe
Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe
2/12/2025 8:35:43 PM :-> Start
WebCompanion-Installer.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe
2/12/2025 8:35:43 PM :-> Starting installer 12.901.4.1003 with: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN230901 --nonadmin --direct --tych --campaign=20731534003 --version=12.901.4.1003, Run as admin: True
WebCompanion-Installer.exe
SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe
Preparing for installing Web Companion
WebCompanion-Installer.exe
2/12/2025 8:35:45 PM :-> Machine Id and Install Id has been generated
WebCompanion-Installer.exe
2/12/2025 8:35:45 PM :-> Generating Machine and Install Id ...