URL:

http://wcdownloadercdn.lavasoft.com/8.9.0.992/WcInstaller.exe

Full analysis: https://app.any.run/tasks/a1e2a410-1fc0-4928-9cf8-90d552ade76d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: January 31, 2024, 20:08:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
adaware
Indicators:
MD5:

856358547E774A4F1C80F9ACA540F61F

SHA1:

7BE44B71B22F16E70A854D7D88E10DF960425430

SHA256:

919C1483DFE8E93BF1026AD3F77AF6B252325D6E0595D66BE7BCEAC56D6C811E

SSDEEP:

3:N1KJGDodXGpJEraRdWhccXpbJOXLNn:CIAQmccXptOXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WcInstaller.exe (PID: 3420)
      • WcInstaller.exe (PID: 4040)
      • WebCompanionInstaller.exe (PID: 3624)

    • ADAWARE has been detected (SURICATA)

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)

  • SUSPICIOUS

    • Searches for installed software

      • WebCompanionInstaller.exe (PID: 3624)

    • Executable content was dropped or overwritten

      • WcInstaller.exe (PID: 3420)
      • WcInstaller.exe (PID: 4040)
      • WebCompanionInstaller.exe (PID: 3624)

    • Checks Windows Trust Settings

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)

    • Reads security settings of Internet Explorer

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)

    • Reads settings of System Certificates

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)

    • Adds/modifies Windows certificates

      • WebCompanionInstaller.exe (PID: 3624)

    • Reads the Internet Settings

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)

    • Executes as Windows Service

      • PresentationFontCache.exe (PID: 2812)

    • Reads Microsoft Outlook installation path

      • WebCompanionInstaller.exe (PID: 2540)

    • Process requests binary or script from the Internet

      • WebCompanionInstaller.exe (PID: 2540)
      • WebCompanionInstaller.exe (PID: 3624)

    • Reads Internet Explorer settings

      • WebCompanionInstaller.exe (PID: 2540)

  • INFO

    • The process uses the downloaded file

      • iexplore.exe (PID: 1392)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2416)
      • iexplore.exe (PID: 1392)

    • Application launched itself

      • iexplore.exe (PID: 1392)

    • Create files in a temporary directory

      • WebCompanionInstaller.exe (PID: 3624)
      • WcInstaller.exe (PID: 3420)
      • WcInstaller.exe (PID: 4040)

    • Reads the computer name

      • WebCompanionInstaller.exe (PID: 3624)
      • PresentationFontCache.exe (PID: 2812)
      • WebCompanionInstaller.exe (PID: 2540)

    • Checks supported languages

      • WcInstaller.exe (PID: 3420)
      • WebCompanionInstaller.exe (PID: 3624)
      • WcInstaller.exe (PID: 4040)
      • WebCompanionInstaller.exe (PID: 2540)
      • PresentationFontCache.exe (PID: 2812)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 1392)
      • iexplore.exe (PID: 2416)

    • Reads the machine GUID from the registry

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)
      • PresentationFontCache.exe (PID: 2812)

    • Reads Environment values

      • WebCompanionInstaller.exe (PID: 3624)
      • WebCompanionInstaller.exe (PID: 2540)

    • Creates files in the program directory

      • WebCompanionInstaller.exe (PID: 3624)

    • Checks proxy server information

      • WebCompanionInstaller.exe (PID: 2540)

    • Creates files or folders in the user directory

      • WebCompanionInstaller.exe (PID: 2540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
8
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wcinstaller.exe no specs wcinstaller.exe #ADAWARE webcompanioninstaller.exe wcinstaller.exe #ADAWARE webcompanioninstaller.exe presentationfontcache.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1392"C:\Program Files\Internet Explorer\iexplore.exe" "http://wcdownloadercdn.lavasoft.com/8.9.0.992/WcInstaller.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2416"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1392 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2540.\WebCompanionInstaller.exe --prod --nanouniqueid=1706731783401 --prodC:\Users\admin\AppData\Local\Temp\7zS8CF42907\WebCompanionInstaller.exe
WcInstaller.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Exit code:
0
Version:
7.0.2417.4248
Modules
Images
c:\users\admin\appdata\local\temp\7zs8cf42907\webcompanioninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2812C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
PresentationFontCache.exe
Exit code:
0
Version:
3.0.6920.4902 built by: NetFXw7
Modules
Images
c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3380"C:\Users\admin\Downloads\WcInstaller.exe" C:\Users\admin\Downloads\WcInstaller.exe—iexplore.exe
User:
admin
Company:
Lavasoft
Integrity Level:
MEDIUM
Description:
Web Companion Installer
Exit code:
3221226540
Version:
8.9.0.992
Modules
Images
c:\users\admin\downloads\wcinstaller.exe
c:\windows\system32\ntdll.dll
3420"C:\Users\admin\Downloads\WcInstaller.exe" C:\Users\admin\Downloads\WcInstaller.exe
iexplore.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion Installer
Exit code:
0
Version:
8.9.0.992
Modules
Images
c:\users\admin\downloads\wcinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3624.\WebCompanionInstaller.exe --prodC:\Users\admin\AppData\Local\Temp\7zSC5D10437\WebCompanionInstaller.exe
WcInstaller.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Exit code:
0
Version:
8.9.0.992
Modules
Images
c:\users\admin\appdata\local\temp\7zsc5d10437\webcompanioninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4040"C:\Users\admin\AppData\Local\Temp\wctmp_1689517070\WcInstaller.exe" --nanouniqueid=1706731783401 --prodC:\Users\admin\AppData\Local\Temp\wctmp_1689517070\WcInstaller.exe
WebCompanionInstaller.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion Installer
Exit code:
0
Version:
7.0.2417.4248
Modules
Images
c:\users\admin\appdata\local\temp\wctmp_1689517070\wcinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
20 051
Read events
19 880
Write events
166
Delete events
5

Modification events

(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1392) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
30
Suspicious files
18
Text files
19
Unknown types
1

Dropped files

PID
Process
Filename
Type
1392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:BCACE81D477F3C718F9B8CAA06BBBDCC
SHA256:536E164C1BCBBE417F805D4D9722D6E8D934EE957FB54BB0A1FAEB65336F6294
1392iexplore.exeC:\Users\admin\Downloads\WcInstaller.exeexecutable
MD5:1A3CB08017131C33F53243B332BFA095
SHA256:F40791D06715813FFF67D7F8D2BA1AFF2294896CE57A5505A67F0A8FF08D7097
1392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{8A198375-C074-11EE-AE0A-12A9866C77DE}.datbinary
MD5:433F45C6BC050F75209A6D345573D5D5
SHA256:EB6F7EA8A6114AFC8FB903EDA3976E608C5785079FB44B9AD79DEA46DDF68A1C
2416iexplore.exeC:\Users\admin\Downloads\WcInstaller.exe.t2vq8gz.partialexecutable
MD5:1A3CB08017131C33F53243B332BFA095
SHA256:F40791D06715813FFF67D7F8D2BA1AFF2294896CE57A5505A67F0A8FF08D7097
3420WcInstaller.exeC:\Users\admin\AppData\Local\Temp\7zSC5D10437\fr-CA\WebCompanionInstaller.resources.dllexecutable
MD5:B61FCD433F37FCF2B5B2ABCF775888E1
SHA256:25B308729B23565F4B4A6A21931CBA07A6910F645DBCF90D04927C47A759A482
1392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
1392iexplore.exeC:\Users\admin\Downloads\WcInstaller.exe.t2vq8gz.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
1392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:2A29C8C2ED08C9CB1C313CA9FD0E3B0E
SHA256:BEF6E89E52145657756F8396BF64785A39A5B28806DF3A7BA767504B261D686B
1392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
1392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verAC52.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
28
DNS requests
16
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2416
iexplore.exe
GET
200
104.17.8.52:80
http://wcdownloadercdn.lavasoft.com/8.9.0.992/WcInstaller.exe
unknown
executable
552 Kb
unknown
—
—
GET
304
2.16.100.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1ae98d7f76faa131
unknown
—
—
unknown
—
—
GET
304
2.16.100.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c7ba49abb4fd7e2c
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3624
WebCompanionInstaller.exe
POST
200
104.17.8.52:80
http://flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
unknown
binary
29 b
unknown
1392
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
2.16.100.155:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0754c686571bd23f
unknown
compressed
65.2 Kb
unknown
3624
WebCompanionInstaller.exe
GET
200
104.17.8.52:80
http://wcdownloadercdn.lavasoft.com/7.0.2417.4248/WcInstaller.exe
unknown
executable
494 Kb
unknown
2540
WebCompanionInstaller.exe
POST
200
104.17.8.52:80
http://flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
unknown
binary
29 b
unknown
1392
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2416
iexplore.exe
104.17.8.52:80
wcdownloadercdn.lavasoft.com
CLOUDFLARENET
—
shared
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1392
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
1392
iexplore.exe
2.16.100.178:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
1392
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3624
WebCompanionInstaller.exe
104.17.8.52:80
wcdownloadercdn.lavasoft.com
CLOUDFLARENET
—
shared
3624
WebCompanionInstaller.exe
64.18.87.82:80
wc-update-service.lavasoft.com
MTO
CA
malicious
1080
svchost.exe
2.16.100.155:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
wcdownloadercdn.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 2.16.100.178
  • 88.221.110.80
  • 88.221.110.59
  • 88.221.110.67
  • 2.16.100.155
  • 2.16.100.152
  • 2.16.100.163
  • 88.221.110.83
  • 2.16.100.177
  • 2.16.100.161
  • 88.221.110.65
  • 88.221.110.66
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
flow.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
whitelisted
wc-update-service.lavasoft.com
  • 64.18.87.82
  • 64.18.87.81
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 2.19.86.20
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted

Threats

PID
Process
Class
Message
2416
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3624
WebCompanionInstaller.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
3624
WebCompanionInstaller.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
3624
WebCompanionInstaller.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3624
WebCompanionInstaller.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2540
WebCompanionInstaller.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
Process
Message
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
1/31/2024 8:09:43 PM :-> Starting installer 8.9.0.992 with: .\WebCompanionInstaller.exe --prod, Run as admin: True
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
1/31/2024 8:09:51 PM :-> Starting installer 7.0.2417.4248 with: .\WebCompanionInstaller.exe --prod --nanouniqueid=1706731783401 --prod, Run as admin: True
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://wcdownloadercdn.lavasoft.com/8.9.0.992/WcInstaller.exe