URL:

http://files3.codecguide.com/K-Lite_Codec_Pack_1465_Full.exe

Full analysis: https://app.any.run/tasks/2da81d23-fdb2-4621-8ebd-4a2843fb50ec
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 29, 2019, 13:15:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
Indicators:
MD5:

13D6B78A4A57D4691E40D3C5456A5A6D

SHA1:

1468B38BF525CE4EAA19ED4012B7C9A2518EA587

SHA256:

908B05A03A85891522EC440C1C10A9F203B922BFAD3CDABF95CC4B46D67398C0

SSDEEP:

3:N1KYvLdDLKKcBivOiIc6C:CYTZLTWi+C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 2988)
      • regsvr32.exe (PID: 2736)
      • WebCompanionInstaller.exe (PID: 3120)
      • WebCompanion.exe (PID: 2528)
      • Lavasoft.WCAssistant.WinService.exe (PID: 3808)
      • WebCompanion.exe (PID: 2740)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3156)
      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Uses Task Scheduler to run other applications

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2696)

    • Application was dropped or rewritten from another process

      • CodecTweakTool.exe (PID: 3592)
      • WcInstaller.exe (PID: 3496)
      • WebCompanionInstaller.exe (PID: 3120)
      • Lavasoft.WCAssistant.WinService.exe (PID: 3808)
      • WebCompanion.exe (PID: 2528)
      • WebCompanion.exe (PID: 2740)
      • Ad-Aware Web Companion.exe (PID: 1856)

    • Changes internet zones settings

      • WebCompanionInstaller.exe (PID: 3120)

    • Changes the autorun value in the registry

      • WebCompanion.exe (PID: 2528)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • K-Lite_Codec_Pack_1465_Full[1].exe (PID: 2868)
      • K-Lite_Codec_Pack_1465_Full[1].exe (PID: 3748)
      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)
      • WcInstaller.exe (PID: 3496)
      • WebCompanionInstaller.exe (PID: 3120)
      • csc.exe (PID: 960)

    • Reads Windows owner or organization settings

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)
      • CodecTweakTool.exe (PID: 3592)

    • Searches for installed software

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Checks supported languages

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Creates files in the user directory

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)
      • WebCompanionInstaller.exe (PID: 3120)
      • WebCompanion.exe (PID: 2528)

    • Reads the Windows organization settings

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)
      • CodecTweakTool.exe (PID: 3592)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2988)
      • regsvr32.exe (PID: 2736)

    • Checks for external IP

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Modifies the open verb of a shell class

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Creates files in the program directory

      • regsvr32.exe (PID: 2736)
      • WebCompanionInstaller.exe (PID: 3120)
      • WebCompanion.exe (PID: 2528)
      • Lavasoft.WCAssistant.WinService.exe (PID: 3808)
      • WebCompanion.exe (PID: 2740)
      • iexplore.exe (PID: 4004)

    • Starts SC.EXE for service management

      • WebCompanionInstaller.exe (PID: 3120)

    • Creates a software uninstall entry

      • WebCompanionInstaller.exe (PID: 3120)

    • Starts CMD.EXE for commands execution

      • WebCompanionInstaller.exe (PID: 3120)
      • Lavasoft.WCAssistant.WinService.exe (PID: 3808)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2564)
      • cmd.exe (PID: 3660)

    • Creates files in the Windows directory

      • Lavasoft.WCAssistant.WinService.exe (PID: 3808)
      • WebCompanion.exe (PID: 2528)
      • WebCompanionInstaller.exe (PID: 3120)

    • Removes files from Windows directory

      • Lavasoft.WCAssistant.WinService.exe (PID: 3808)
      • WebCompanionInstaller.exe (PID: 3120)

    • Changes the started page of IE

      • WebCompanion.exe (PID: 2528)

    • Starts Internet Explorer

      • CodecTweakTool.exe (PID: 3592)

    • Reads Internet Cache Settings

      • CodecTweakTool.exe (PID: 3592)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3156)
      • iexplore.exe (PID: 2980)
      • iexplore.exe (PID: 4004)
      • iexplore.exe (PID: 4048)

    • Changes internet zones settings

      • iexplore.exe (PID: 2980)
      • iexplore.exe (PID: 4048)

    • Application was dropped or rewritten from another process

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2232)
      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Loads dropped or rewritten executable

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Creates a software uninstall entry

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Creates files in the program directory

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)

    • Dropped object may contain Bitcoin addresses

      • K-Lite_Codec_Pack_1465_Full[1].tmp (PID: 2440)
      • WebCompanionInstaller.exe (PID: 3120)
      • WebCompanion.exe (PID: 2528)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4004)

    • Creates files in the user directory

      • iexplore.exe (PID: 4004)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4004)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
29
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe k-lite_codec_pack_1465_full[1].exe k-lite_codec_pack_1465_full[1].tmp no specs k-lite_codec_pack_1465_full[1].exe k-lite_codec_pack_1465_full[1].tmp regsvr32.exe no specs regsvr32.exe no specs schtasks.exe no specs codectweaktool.exe wcinstaller.exe webcompanioninstaller.exe sc.exe no specs sc.exe no specs sc.exe no specs regedit.exe no specs cmd.exe no specs netsh.exe no specs webcompanion.exe lavasoft.wcassistant.winservice.exe cmd.exe no specs netsh.exe no specs csc.exe cvtres.exe no specs ad-aware web companion.exe no specs webcompanion.exe presentationfontcache.exe no specs iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\gg4zssqd.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
WebCompanion.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1856"C:\Program Files\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe" {0633EE93-D776-472f-A0FF-E1416B8B2E3A}C:\Program Files\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe—WebCompanion.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Ad-Aware Web Companion.exe
Exit code:
0
Version:
4.5.1957.3838
Modules
Images
c:\program files\lavasoft\web companion\application\ad-aware web companion.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2232"C:\Users\admin\AppData\Local\Temp\is-28GHC.tmp\K-Lite_Codec_Pack_1465_Full[1].tmp" /SL5="$501A4,45567768,259072,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\K-Lite_Codec_Pack_1465_Full[1].exe" C:\Users\admin\AppData\Local\Temp\is-28GHC.tmp\K-Lite_Codec_Pack_1465_Full[1].tmp—K-Lite_Codec_Pack_1465_Full[1].exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-28ghc.tmp\k-lite_codec_pack_1465_full[1].tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2280netsh http add urlacl url=http://+:9007/ user=EveryoneC:\Windows\system32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2440"C:\Users\admin\AppData\Local\Temp\is-790QL.tmp\K-Lite_Codec_Pack_1465_Full[1].tmp" /SL5="$50130,45567768,259072,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\K-Lite_Codec_Pack_1465_Full[1].exe" /SPAWNWND=$4015A /NOTIFYWND=$501A4 C:\Users\admin\AppData\Local\Temp\is-790QL.tmp\K-Lite_Codec_Pack_1465_Full[1].tmp
K-Lite_Codec_Pack_1465_Full[1].exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-790ql.tmp\k-lite_codec_pack_1465_full[1].tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2528"C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe
WebCompanionInstaller.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Exit code:
0
Version:
4.5.1957.3838
Modules
Images
c:\program files\lavasoft\web companion\application\webcompanion.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2560"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"C:\Windows\system32\sc.exe—WebCompanionInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
2564"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=EveryoneC:\Windows\System32\cmd.exe—WebCompanionInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2696"C:\Windows\system32\schtasks.exe" /Create /TN "klcp_update" /XML "C:\Users\admin\AppData\Local\Temp\is-B0VQM.tmp\klcp_update_task.xml" /FC:\Windows\system32\schtasks.exe—K-Lite_Codec_Pack_1465_Full[1].tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2736"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\K-Lite Codec Pack\Icaros\32-bit\IcarosPropertyHandler.dll"C:\Windows\system32\regsvr32.exe—K-Lite_Codec_Pack_1465_Full[1].tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 938
Read events
3 633
Write events
2 274
Delete events
31

Modification events

(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{F539F5D5-23C7-11E9-91D7-5254004A04AF}
Value:
0
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2980) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307010002001D000D000F002200B902
Executable files
153
Suspicious files
22
Text files
333
Unknown types
20

Dropped files

PID
Process
Filename
Type
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE1651DC4D1D96302.TMP —
MD5:—
SHA256:—
3156iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\K-Lite_Codec_Pack_1465_Full[1].exe —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\K-Lite_Codec_Pack_1465_Full[1].exe —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB13CC8F9DC2C97DA.TMP —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F539F5D5-23C7-11E9-91D7-5254004A04AF}.dat —
MD5:—
SHA256:—
2440K-Lite_Codec_Pack_1465_Full[1].tmpC:\Program Files\K-Lite Codec Pack\is-96BGI.tmp —
MD5:—
SHA256:—
2440K-Lite_Codec_Pack_1465_Full[1].tmpC:\Program Files\K-Lite Codec Pack\Info\is-KQ3J8.tmp —
MD5:—
SHA256:—
2440K-Lite_Codec_Pack_1465_Full[1].tmpC:\Program Files\K-Lite Codec Pack\Tools\is-TMOAU.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
40
DNS requests
27
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
GET
200
216.239.32.21:80
http://ipinfo.io/json
US
text
172 b
shared
3156
iexplore.exe
GET
200
51.15.9.231:80
http://files3.codecguide.com/K-Lite_Codec_Pack_1465_Full.exe
NL
executable
44.0 Mb
suspicious
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
GET
200
104.24.119.99:80
http://data.codecguide.com/config/offer_wc.ini
US
text
370 b
malicious
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
GET
200
104.17.114.51:80
http://webcompanion.com/nano_download.php?partner=KL150601
US
executable
347 Kb
malicious
3120
WebCompanionInstaller.exe
GET
200
104.17.60.19:80
http://wcdownloadercdn.lavasoft.com/4.5.1957.3838/WebCompanion-4.5.1957.3838-prod.zip
US
compressed
8.99 Mb
whitelisted
3120
WebCompanionInstaller.exe
POST
200
72.55.154.81:80
http://wc-update-service.lavasoft.com/update.asmx
CA
xml
1.43 Kb
whitelisted
3120
WebCompanionInstaller.exe
POST
200
72.55.154.82:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
3120
WebCompanionInstaller.exe
POST
200
72.55.154.82:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
POST
200
172.217.23.142:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
3120
WebCompanionInstaller.exe
POST
200
72.55.154.82:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2980
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3156
iexplore.exe
51.15.9.231:80
files3.codecguide.com
Online S.a.s.
NL
suspicious
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
216.239.32.21:80
ipinfo.io
Google Inc.
US
whitelisted
3120
WebCompanionInstaller.exe
72.55.154.82:80
wc-tracking.lavasoft.com
iWeb Technologies Inc.
CA
unknown
3120
WebCompanionInstaller.exe
72.55.154.81:80
wc-tracking.lavasoft.com
iWeb Technologies Inc.
CA
unknown
2528
WebCompanion.exe
104.17.114.51:80
webcompanion.com
Cloudflare Inc
US
shared
3120
WebCompanionInstaller.exe
104.17.60.19:80
wcdownloadercdn.lavasoft.com
Cloudflare Inc
US
shared
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
104.24.119.99:80
data.codecguide.com
Cloudflare Inc
US
shared
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
172.217.23.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
104.17.114.51:80
webcompanion.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
files3.codecguide.com
  • 51.15.9.231
suspicious
ipinfo.io
  • 216.239.32.21
  • 216.239.38.21
  • 216.239.36.21
  • 216.239.34.21
shared
data.codecguide.com
  • 104.24.119.99
  • 104.24.118.99
malicious
www.google-analytics.com
  • 172.217.23.142
whitelisted
webcompanion.com
  • 104.17.114.51
  • 104.17.115.51
  • 104.17.116.51
  • 104.17.113.51
  • 104.17.112.51
malicious
wc-tracking.lavasoft.com
  • 72.55.154.82
  • 72.55.154.81
whitelisted
wc-update-service.lavasoft.com
  • 72.55.154.81
  • 72.55.154.82
whitelisted
wcdownloadercdn.lavasoft.com
  • 104.17.60.19
  • 104.17.61.19
whitelisted
rt.webcompanion.com
  • 104.17.113.51
  • 104.17.115.51
  • 104.17.114.51
  • 104.17.116.51
  • 104.17.112.51
malicious

Threats

PID
Process
Class
Message
3156
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup ipinfo.io
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2440
K-Lite_Codec_Pack_1465_Full[1].tmp
Misc activity
ET INFO EXE - Served Attached HTTP
Process
Message
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
1/29/2019 1:17:19 PM :-> Starting installer 4.5.1957.3838 with: .\WebCompanionInstaller.exe --partner=KL150601 --version=4.5.1957.3838 --prod --silent --partner=KL150601 --homepage=1 --search=1, Run as admin: True
WebCompanionInstaller.exe
Preparing for installing Web Companion
WebCompanionInstaller.exe
1/29/2019 1:17:20 PM :-> Generating Machine and Install Id ...
WebCompanionInstaller.exe
1/29/2019 1:17:20 PM :-> Machine Id and Install Id has been generated
WebCompanionInstaller.exe
1/29/2019 1:17:20 PM :-> Checking prerequisites ...
WebCompanionInstaller.exe
1/29/2019 1:17:20 PM :-> Antivirus not detected
WebCompanionInstaller.exe
1/29/2019 1:17:20 PM :-> vm_check False
WebCompanionInstaller.exe
1/29/2019 1:17:21 PM :-> reg_check :False
WebCompanionInstaller.exe
1/29/2019 1:17:21 PM :-> Installed .Net framework is V40
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://files3.codecguide.com/K-Lite_Codec_Pack_1465_Full.exe