URL:

https://featureflags.lavasoft.com/api/feature/WC

Full analysis: https://app.any.run/tasks/0834078f-7a85-4066-8f38-200c952f6bd6
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 19, 2025, 13:42:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
adaware
webcompanion
tool
arch-scr
arch-exec
stealer
Indicators:
MD5:

97A1EE7229E8031BC30C6C6308C73B39

SHA1:

E2A559C8A1D11B7A7C4CFCAE117B4E277F091479

SHA256:

29902C4833387CC4FA5E4D2B3534C6100611E8BB91496802EA7AD9789CC73F7C

SSDEEP:

3:N8BQXADJECW9OaRIbQXAKymn:2mWKV9OQFt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADAWARE has been detected (SURICATA)

      • WebCompanion.exe (PID: 4644)

    • Changes the autorun value in the registry

      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)

    • Actions looks like stealing of personal data

      • WebCompanion.exe (PID: 7704)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup_WebCompanion.exe (PID: 8052)
      • WebCompanion-Installer.exe (PID: 420)
      • Setup_WebCompanion.exe (PID: 7744)
      • WebCompanion-Installer.exe (PID: 2668)

    • Searches for installed software

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 4120)
      • WebCompanion.exe (PID: 1232)

    • The process drops C-runtime libraries

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • The process creates files with name similar to system file names

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • Reads security settings of Internet Explorer

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • WebCompanion.exe (PID: 1232)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 4120)

    • Starts CMD.EXE for commands execution

      • WebCompanion-Installer.exe (PID: 420)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 4664)

    • Drops 7-zip archiver for unpacking

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • Creates a software uninstall entry

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • Access to an unwanted program domain was detected

      • WebCompanion.exe (PID: 4644)

    • Process drops legitimate windows executable

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • The process checks if it is being run in the virtual environment

      • WebCompanion.exe (PID: 7704)
      • WebCompanion.exe (PID: 4120)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 7488)
      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 7704)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)

    • Application launched itself

      • msedge.exe (PID: 6892)
      • firefox.exe (PID: 6016)
      • firefox.exe (PID: 6140)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6892)
      • msedge.exe (PID: 3720)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 6892)

    • Create files in a temporary directory

      • Setup_WebCompanion.exe (PID: 8052)
      • WebCompanion-Installer.exe (PID: 420)
      • Setup_WebCompanion.exe (PID: 7744)
      • WebCompanion-Installer.exe (PID: 2668)

    • The sample compiled with english language support

      • msedge.exe (PID: 6892)
      • msedge.exe (PID: 3720)
      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • Reads Environment values

      • identity_helper.exe (PID: 7488)

    • Disables trace logs

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)
      • WebCompanion.exe (PID: 4120)

    • Reads the machine GUID from the registry

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)
      • WebCompanion.exe (PID: 4120)

    • Checks supported languages

      • Setup_WebCompanion.exe (PID: 8052)
      • WebCompanion-Installer.exe (PID: 420)
      • identity_helper.exe (PID: 7488)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • Setup_WebCompanion.exe (PID: 7744)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)
      • WebCompanion.exe (PID: 4120)

    • Reads the software policy settings

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • slui.exe (PID: 5644)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)
      • WebCompanion.exe (PID: 4120)

    • Creates files or folders in the user directory

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)
      • WebCompanion.exe (PID: 4120)

    • Creates files in the program directory

      • WebCompanion.exe (PID: 4644)

    • SQLite executable

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • Checks proxy server information

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)
      • slui.exe (PID: 5644)
      • WebCompanion-Installer.exe (PID: 2668)
      • WebCompanion.exe (PID: 1232)

    • Launching a file from a Registry key

      • WebCompanion.exe (PID: 4644)
      • WebCompanion.exe (PID: 7704)

    • Process checks computer location settings

      • WebCompanion-Installer.exe (PID: 420)
      • WebCompanion-Installer.exe (PID: 2668)

    • ADAWAREWEBCOMPANION mutex has been found

      • WebCompanion.exe (PID: 7704)
      • WebCompanion.exe (PID: 4120)

    • Manual execution by a user

      • firefox.exe (PID: 6016)
      • Setup_WebCompanion.exe (PID: 7744)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 6140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
215
Monitored processes
70
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup_webcompanion.exe webcompanion-installer.exe slui.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs #ADAWARE webcompanion.exe msedge.exe no specs msedge.exe no specs webcompanion.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs msedge.exe no specs setup_webcompanion.exe webcompanion-installer.exe webcompanion.exe webcompanion.exe msedge.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420.\WebCompanion-Installer.exe --partner=IN220102 --savename=Setup_WebCompanion.exe --nonadmin --direct --tyed --campaign --version=12.901.4.1003C:\Users\admin\AppData\Local\Temp\7zS47F93868\WebCompanion-Installer.exe
Setup_WebCompanion.exe
User:
admin
Company:
Lavasoft
Integrity Level:
MEDIUM
Description:
Web Companion
Exit code:
0
Version:
12.901.4.1003
Modules
Images
c:\users\admin\appdata\local\temp\7zs47f93868\webcompanion-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
472"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 0 -prefsHandle 4796 -prefsLen 44910 -prefMapHandle 4812 -prefMapSize 273389 -ipcHandle 4656 -initialChannelId {e056a75a-7e32-4446-906e-b37c873b9122} -parentPid 6140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
1028"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=1452,i,12502656733070531172,18301266836001416671,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1212"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4084 -prefsLen 44882 -prefMapHandle 4088 -prefMapSize 273389 -jsInitHandle 4092 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4052 -initialChannelId {b0108ae6-3d1b-482c-932e-9af61c84f7d9} -parentPid 6140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
1232"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --update C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
WebCompanion-Installer.exe
User:
admin
Company:
Lavasoft
Integrity Level:
MEDIUM
Description:
Web Companion
Exit code:
0
Version:
12.901.4.1003
Modules
Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1964\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2028"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4156,i,12502656733070531172,18301266836001416671,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=4980,i,12502656733070531172,18301266836001416671,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5892,i,12502656733070531172,18301266836001416671,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2212C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
56 624
Read events
56 523
Write events
100
Delete events
1

Modification events

(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\787138
Operation:writeName:WindowTabManagerFileMappingId
Value:
{633CCE5C-6807-4796-8A2F-69C6D4E5B519}
(PID) Process:(6892) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
0C0E253583962F00
(PID) Process:(6892) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\787138
Operation:writeName:WindowTabManagerFileMappingId
Value:
{E6DD3FD2-28B3-4477-8113-4BFB7D7A75B4}
(PID) Process:(6892) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
20094E3583962F00
Executable files
155
Suspicious files
349
Text files
184
Unknown types
169

Dropped files

PID
Process
Filename
Type
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF176a62.TMP —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF176a62.TMP —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF176a52.TMP —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF176a72.TMP —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF176a81.TMP —
MD5:—
SHA256:—
6892msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
207
DNS requests
261
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7076
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3720
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:ycjW93AVcVxV05fn-QgdC7H8ukTluwJRb97gJAeVQLw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
6892
msedge.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
—
—
whitelisted
6892
msedge.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCECXQy517DWxwDNrkPSQ6scY%3D
unknown
—
—
whitelisted
420
WebCompanion-Installer.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4644
WebCompanion.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
—
—
whitelisted
7076
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4644
WebCompanion.exe
GET
200
64.18.87.82:80
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220102
unknown
—
—
whitelisted
4644
WebCompanion.exe
GET
200
64.18.87.82:80
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220102_ab
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1816
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3720
msedge.exe
104.16.148.130:443
featureflags.lavasoft.com
CLOUDFLARENET
—
whitelisted
3720
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3720
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3720
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3720
msedge.exe
92.123.104.45:443
copilot.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
  • 172.217.16.206
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
featureflags.lavasoft.com
  • 104.16.148.130
  • 104.16.149.130
whitelisted
copilot.microsoft.com
  • 92.123.104.45
  • 92.123.104.53
whitelisted
update.googleapis.com
  • 216.58.206.35
whitelisted
www.bing.com
  • 92.123.104.7
  • 92.123.104.35
  • 92.123.104.22
  • 92.123.104.17
  • 92.123.104.5
  • 92.123.104.12
  • 92.123.104.14
  • 92.123.104.37
  • 92.123.104.36
  • 92.123.104.50
  • 92.123.104.58
  • 92.123.104.61
  • 92.123.104.67
  • 92.123.104.43
  • 104.126.37.170
  • 104.126.37.155
  • 104.126.37.123
  • 104.126.37.179
  • 104.126.37.137
  • 104.126.37.177
  • 104.126.37.154
  • 104.126.37.128
  • 104.126.37.153
whitelisted
edgeassetservice.azureedge.net
  • 13.107.253.45
whitelisted
login.live.com
  • 40.126.31.128
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.71
  • 40.126.31.3
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted

Threats

PID
Process
Class
Message
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
3720
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
Process
Message
WebCompanion-Installer.exe
Failed to OpenWcfHost: System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL http://+:9008/webcompanion/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details). ---> System.Net.HttpListenerException: Access is denied at System.Net.HttpListener.AddAllPrefixes() at System.Net.HttpListener.Start() at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() --- End of inner exception stack trace --- at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener) at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback) at System.ServiceModel.Channels.TransportChannelListener.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.HttpChannelListener`1.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at WebCompanionInstaller.App.OpenInstallerWcfHost()
WebCompanion-Installer.exe
Detecting windows culture
WebCompanion-Installer.exe
Preparing request for featureflag: {"Geo":"US","Partner":"IN220102","Campaign":"NA","InstallDate":"20250619","TriggerType":"install","TriggerEvent":"installer","Version":"12.901.4.1003","featurewp":true,"featureal":true}
WebCompanion-Installer.exe
Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"color\": \"25FFFF\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"darkmode\": false, \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe
6/19/2025 1:43:47 PM :-> Start
WebCompanion-Installer.exe
6/19/2025 1:43:48 PM :-> Starting installer 12.901.4.1003 with: .\WebCompanion-Installer.exe --partner=IN220102 --savename=Setup_WebCompanion.exe --nonadmin --direct --tyed --campaign --version=12.901.4.1003, Run as admin: False
WebCompanion-Installer.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe
SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe
Preparing for installing Web Companion
WebCompanion-Installer.exe
6/19/2025 1:43:49 PM :-> Generating Machine and Install Id ...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://featureflags.lavasoft.com/api/feature/WC