File name:

Setup.exe

Full analysis: https://app.any.run/tasks/37158ab5-e7c3-470e-b062-6307ac404a0c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: May 18, 2025, 14:55:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
adaware
arch-exec
arch-scr
webcompanion
tool
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

92407C380F366ABB1050D944BEB7746A

SHA1:

942E6606F018028A50345163475BEFA0C3C2326F

SHA256:

9FFA11FB3D0FDBD4CA07C1454E3F2BC0C80658731CC8D3AD79B69DD8878DAE7F

SSDEEP:

24576:/SIe5VvZ0jvUTfPfkSqO6n7KnPC2hWbWaaQJza:/SIe5VvZ0jvUTfPfkSqO6n7KnPC2hWbr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ADAWARE has been detected (SURICATA)

      • WebCompanion.exe (PID: 5800)
    • Changes the autorun value in the registry

      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
    • Actions looks like stealing of personal data

      • WebCompanion.exe (PID: 7012)
  • SUSPICIOUS

    • The process drops C-runtime libraries

      • Setup.exe (PID: 2340)
    • Drops 7-zip archiver for unpacking

      • Setup.exe (PID: 2340)
    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2340)
    • The process creates files with name similar to system file names

      • Setup.exe (PID: 2340)
    • Process drops legitimate windows executable

      • Setup.exe (PID: 2340)
    • Creates a software uninstall entry

      • Setup.exe (PID: 2340)
    • Searches for installed software

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 4464)
    • Starts CMD.EXE for commands execution

      • Setup.exe (PID: 2340)
    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 7012)
      • WebCompanion.exe (PID: 5800)
    • Access to an unwanted program domain was detected

      • WebCompanion.exe (PID: 5800)
    • The process checks if it is being run in the virtual environment

      • WebCompanion.exe (PID: 7012)
  • INFO

    • Create files in a temporary directory

      • Setup.exe (PID: 2340)
    • Reads the computer name

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
    • Checks proxy server information

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 7012)
      • WebCompanion.exe (PID: 5800)
    • Checks supported languages

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
    • SQLite executable

      • Setup.exe (PID: 2340)
    • Reads the machine GUID from the registry

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
    • Creates files or folders in the user directory

      • Setup.exe (PID: 2340)
      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
    • The sample compiled with english language support

      • Setup.exe (PID: 2340)
    • Reads the software policy settings

      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
      • Setup.exe (PID: 2340)
    • Creates files in the program directory

      • WebCompanion.exe (PID: 5800)
    • Disables trace logs

      • WebCompanion.exe (PID: 5800)
      • WebCompanion.exe (PID: 7012)
      • Setup.exe (PID: 2340)
    • Process checks computer location settings

      • Setup.exe (PID: 2340)
    • Application launched itself

      • chrome.exe (PID: 2240)
    • ADAWAREWEBCOMPANION mutex has been found

      • WebCompanion.exe (PID: 7012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:14 08:46:30+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 702976
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0xad8d6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 13.900.0.1080
ProductVersionNumber: 13.900.0.1080
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 13.900.0.1080
ProductVersion: 13.900.0.1080
FileDescription: Web Companion
InternalName: WebCompanion.exe
LegalCopyright: c Lavasoft Limited. All Rights Reserved.
OriginalFileName: WebCompanion.exe
ProductName: Web Companion
AssemblyVersion: 13.900.0.1080
CompanyName: Lavasoft
LegalTrademarks: (R) Lavasoft
Comments: Web Companion protects you against malicious websites and dangerous links found online
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
32
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs #ADAWARE webcompanion.exe webcompanion.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1956,i,7565173750927898245,158349218828209789,262144 --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1956,i,7565173750927898245,158349218828209789,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6028 --field-trial-handle=1956,i,7565173750927898245,158349218828209789,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1324"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1956,i,7565173750927898245,158349218828209789,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1512"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3292 --field-trial-handle=1956,i,7565173750927898245,158349218828209789,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2240"C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN250102&campaign=22379554474&C:\Program Files\Google\Chrome\Application\chrome.exe
Setup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2340"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
explorer.exe
User:
admin
Company:
Lavasoft
Integrity Level:
MEDIUM
Description:
Web Companion
Exit code:
0
Version:
13.900.0.1080
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2800C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5892 --field-trial-handle=1956,i,7565173750927898245,158349218828209789,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4000\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
29 160
Read events
29 096
Write events
63
Delete events
1

Modification events

(PID) Process:(2340) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Lavasoft\Web Companion
Operation:writeName:MachineId
Value:
ad1f12af-3f36-3c28-b351-2ce4355f42c2
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2340) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
69
Suspicious files
145
Text files
81
Unknown types
0

Dropped files

PID
Process
Filename
Type
2340Setup.exeC:\Users\admin\AppData\Local\Temp\WebCompanion.zipcompressed
MD5:C0A2AAF917E6BC1D951EC481213D4138
SHA256:2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dllexecutable
MD5:79AAF194177DC418CFB4D94AF29CDD2A
SHA256:6327ED564E521BB91791EEE54D7C18699BE1DE77DB2B9D6DCDD6FB7077CACB39
2340Setup.exeC:\Users\admin\AppData\Local\Temp\App.configxml
MD5:9965A5BB6C522F5E1F52EBAB89A9EF69
SHA256:937962C98E0CDBF26416C0A4EA4F5F4F6C26FCD7ADA158883D51602CDF0462E1
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txtbinary
MD5:72347B4446EEAF9DA5D63849FEC5FA97
SHA256:439BA3036DED0408D6739FFB010F0050709C22E7C3F05E15213993299FAB2DE6
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dllexecutable
MD5:AFCCE3F23C9C31DE19A91FC7D436A516
SHA256:4055E2A085F44DBCD464983F9316E5A33B5056AF8ABED05FD4DFEBFDE162DD77
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dllexecutable
MD5:56732B85F3168BA6852CD1EAC84164B0
SHA256:AAAF2F91C0F5172AFBCF15D9F06A706BB23FBBEA40361F64E8552A7D7C96F62D
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe.configxml
MD5:64B56E0401F35D30E7E33D3FE11DB9EA
SHA256:77348A27DB6505DCC962A97A60C8AFC4F3BBAA4D1C485616407700F6BA901379
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dllexecutable
MD5:AAEBD8816C4A3FC26D5C4FA227EE565C
SHA256:10C6C4B9A94318C4244EC36A0F211D965B10661B0BC76339067AAFB866F115FD
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dllexecutable
MD5:EE8EE543588B987699DC972027F7C86C
SHA256:7443EC0A10F409C82FD578237E3D7588E9F9A66E8531A1A27822B7BDE5E8BEC8
2340Setup.exeC:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exeexecutable
MD5:70F3C5BB9046EDB9EE0BA0CDF63698DF
SHA256:8EB6D08CCDF88ACC4F7DE252779565A93BB57379591275EF3FA0C33303C60C0E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
83
DNS requests
98
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5800
WebCompanion.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2340
Setup.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
2340
Setup.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
whitelisted
2420
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
2420
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
5800
WebCompanion.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
whitelisted
5800
WebCompanion.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2340
Setup.exe
104.16.148.130:80
geo.lavasoft.com
CLOUDFLARENET
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.128
  • 20.190.159.2
  • 20.190.159.130
  • 40.126.31.129
  • 20.190.159.23
  • 40.126.31.131
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
geo.lavasoft.com
  • 104.16.148.130
  • 104.16.149.130
whitelisted
featureflags.lavasoft.com
  • 104.16.149.130
  • 104.16.148.130
whitelisted
flwadw.com
  • 104.18.26.149
  • 104.18.27.149
unknown

Threats

PID
Process
Class
Message
5800
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
5800
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
5800
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
644
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info