URL:

https://spotmate.online/

Full analysis: https://app.any.run/tasks/91cc6627-0527-423c-9435-88ee97a64ac3
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: January 08, 2025, 12:55:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-scr
adware
adaware
arch-exec
stealer
maladvertising
Indicators:
MD5:

D1AEBEFCB69D9E58F30A7E2A3022DF40

SHA1:

BC3911FFBDF1D14A9446D8CE4B7F276C5AE137CE

SHA256:

B8305184AC1B7B9A028457C703B4851D09CB48EFD461987669E15429647F8B47

SSDEEP:

3:N8YhLKEAK:2YhVv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)

    • Steals credentials from Web Browsers

      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)

    • Changes the autorun value in the registry

      • WebCompanion.exe (PID: 5212)

    • ADAWARE has been detected (SURICATA)

      • WebCompanion.exe (PID: 5212)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • chrome.exe (PID: 6464)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2672)
      • WebCompanion-Installer.exe (PID: 4708)
      • Setup (1).exe (PID: 1684)
      • WebCompanion-Installer.exe (PID: 4804)
      • sidify-music-converter.exe (PID: 3076)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3920)
      • sidify-all-in-one.exe (PID: 4864)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7064)

    • Drops 7-zip archiver for unpacking

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)

    • Process drops legitimate windows executable

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)
      • sidify-music-converter.exe (PID: 3076)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3920)
      • MicrosoftEdgeUpdate.exe (PID: 5780)
      • sidify-all-in-one.exe (PID: 4864)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7064)
      • MicrosoftEdgeUpdate.exe (PID: 7060)

    • The process drops C-runtime libraries

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)

    • Reads security settings of Internet Explorer

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)
      • MicrosoftEdgeUpdate.exe (PID: 5780)

    • The process creates files with name similar to system file names

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)
      • sidify-music-converter.exe (PID: 3076)
      • sidify-all-in-one.exe (PID: 4864)

    • Starts CMD.EXE for commands execution

      • WebCompanion-Installer.exe (PID: 4708)

    • Creates a software uninstall entry

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)

    • Searches for installed software

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 3140)

    • Checks Windows Trust Settings

      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion.exe (PID: 5388)

    • The process checks if it is being run in the virtual environment

      • WebCompanion.exe (PID: 968)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 3568)

    • Access to an unwanted program domain was detected

      • WebCompanion.exe (PID: 5212)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • sidify-music-converter.exe (PID: 3076)
      • sidify-all-in-one.exe (PID: 4864)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 3920)
      • MicrosoftEdgeUpdate.exe (PID: 5780)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7064)
      • MicrosoftEdgeUpdate.exe (PID: 7060)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 2672)
      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 968)
      • Setup (1).exe (PID: 1684)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)
      • sidify-music-converter.exe (PID: 3076)
      • MicrosoftEdgeUpdate.exe (PID: 5780)
      • sidify-all-in-one.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7060)

    • Creates files or folders in the user directory

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)
      • wermgr.exe (PID: 4864)

    • Reads the computer name

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion.exe (PID: 5388)

    • The process uses the downloaded file

      • chrome.exe (PID: 2356)
      • chrome.exe (PID: 6464)
      • chrome.exe (PID: 4308)
      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • chrome.exe (PID: 4052)

    • Sends debugging messages

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)

    • Disables trace logs

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 968)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)

    • Checks proxy server information

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 968)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 5388)
      • MicrosoftEdgeUpdate.exe (PID: 5780)
      • wermgr.exe (PID: 4864)
      • MicrosoftEdgeUpdate.exe (PID: 7060)

    • Reads the machine GUID from the registry

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion-Installer.exe (PID: 4804)
      • WebCompanion.exe (PID: 5388)
      • WebCompanion.exe (PID: 4056)

    • Reads the software policy settings

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion.exe (PID: 5212)
      • WebCompanion.exe (PID: 968)
      • WebCompanion.exe (PID: 5388)
      • wermgr.exe (PID: 768)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6464)
      • chrome.exe (PID: 7008)

    • The sample compiled with english language support

      • chrome.exe (PID: 6464)
      • WebCompanion-Installer.exe (PID: 4708)
      • chrome.exe (PID: 7008)
      • WebCompanion-Installer.exe (PID: 4804)
      • sidify-music-converter.exe (PID: 3076)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3920)
      • MicrosoftEdgeUpdate.exe (PID: 5780)
      • sidify-all-in-one.exe (PID: 4864)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7064)
      • MicrosoftEdgeUpdate.exe (PID: 7060)

    • Create files in a temporary directory

      • Setup.exe (PID: 2672)
      • WebCompanion-Installer.exe (PID: 4708)
      • Setup (1).exe (PID: 1684)
      • WebCompanion-Installer.exe (PID: 4804)
      • sidify-music-converter.exe (PID: 3076)
      • sidify-all-in-one.exe (PID: 4864)

    • Application launched itself

      • chrome.exe (PID: 6464)
      • chrome.exe (PID: 4144)

    • SQLite executable

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)

    • Process checks computer location settings

      • WebCompanion-Installer.exe (PID: 4708)
      • WebCompanion-Installer.exe (PID: 4804)
      • MicrosoftEdgeUpdate.exe (PID: 7060)

    • Manual execution by a user

      • Setup (1).exe (PID: 1684)
      • sidify-music-converter.exe (PID: 1864)
      • sidify-music-converter.exe (PID: 3076)
      • sidify-all-in-one.exe (PID: 6720)
      • sidify-all-in-one.exe (PID: 4864)

    • Reads CPU info

      • WebCompanion.exe (PID: 4056)

    • Reads the time zone

      • WebCompanion.exe (PID: 4056)

    • Creates files in the program directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 3920)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
72
Malicious processes
14
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs setup.exe webcompanion-installer.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs #ADAWARE webcompanion.exe rundll32.exe no specs webcompanion.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs setup (1).exe webcompanion-installer.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs webcompanion.exe webcompanion.exe wmiapsrv.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sidify-music-converter.exe no specs sidify-music-converter.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs sidify-all-in-one.exe no specs sidify-all-in-one.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "7060" "2144" "944" "2156" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
904"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=8112 --field-trial-handle=1880,i,2590862588428729119,14537920499719854368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
968netsh http add urlacl url=http://+:9007/ user=EveryoneC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
968"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
WebCompanion-Installer.exe
User:
admin
Company:
Lavasoft
Integrity Level:
MEDIUM
Description:
Web Companion
Exit code:
4294967295
Version:
13.900.0.1080
Modules
Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1224"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7648 --field-trial-handle=1880,i,2590862588428729119,14537920499719854368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1400C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7704 --field-trial-handle=1880,i,2590862588428729119,14537920499719854368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1684"C:\Users\admin\Downloads\Setup (1).exe" C:\Users\admin\Downloads\Setup (1).exe
explorer.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion Installer
Exit code:
0
Version:
13.900.0.1080
Modules
Images
c:\users\admin\downloads\setup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1864"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=1880,i,2590862588428729119,14537920499719854368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
61 128
Read events
60 920
Write events
178
Delete events
30

Modification events

(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6464) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en-US
Value:
(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en
Value:
(PID) Process:(6464) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:_Global_
Value:
(PID) Process:(2356) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000009591CCA6CC61DB01
(PID) Process:(4708) WebCompanion-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
487
Suspicious files
390
Text files
140
Unknown types
0

Dropped files

PID
Process
Filename
Type
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF135e21.TMP —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF135e30.TMP —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF135e30.TMP —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF135e30.TMP —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF135e30.TMP —
MD5:—
SHA256:—
6464chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
260
DNS requests
261
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
96.6.17.223:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.103.72.96:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3208
SIHClient.exe
GET
200
96.6.17.223:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3208
SIHClient.exe
GET
200
96.6.17.223:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6696
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4708
WebCompanion-Installer.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
—
—
whitelisted
2012
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
4708
WebCompanion-Installer.exe
GET
200
104.16.148.130:80
http://geo.lavasoft.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6060
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.103.72.96:80
crl.microsoft.com
Akamai International B.V.
AT
whitelisted
5064
SearchApp.exe
95.101.23.74:443
www.bing.com
Akamai International B.V.
AT
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
96.6.17.223:80
www.microsoft.com
AKAMAI-AS
NO
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6872
chrome.exe
188.114.97.3:443
spotmate.online
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 104.103.72.96
  • 2.23.154.57
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 95.101.23.74
  • 95.101.23.80
  • 95.101.23.72
  • 95.101.23.66
  • 95.101.23.65
  • 95.101.23.81
  • 95.101.23.64
  • 95.101.23.67
  • 95.101.23.73
  • 95.101.23.90
  • 95.101.23.82
  • 95.101.23.83
  • 95.101.23.89
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 96.6.17.223
whitelisted
spotmate.online
  • 188.114.97.3
  • 188.114.96.3
unknown
accounts.google.com
  • 173.194.69.84
whitelisted
go.microsoft.com
  • 96.6.17.155
whitelisted
cdn.jsdelivr.net
  • 151.101.1.229
  • 151.101.193.229
  • 151.101.65.229
  • 151.101.129.229
whitelisted

Threats

PID
Process
Class
Message
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
Process
Message
WebCompanion-Installer.exe
Failed to OpenWcfHost: System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL http://+:9008/webcompanion/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details). ---> System.Net.HttpListenerException: Access is denied at System.Net.HttpListener.AddAllPrefixes() at System.Net.HttpListener.Start() at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() --- End of inner exception stack trace --- at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener) at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback) at System.ServiceModel.Channels.TransportChannelListener.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.HttpChannelListener`1.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at WebCompanionInstaller.App.OpenInstallerWcfHost()
WebCompanion-Installer.exe
Detecting windows culture
WebCompanion-Installer.exe
Preparing request for featureflag: {"Geo":"DE","Partner":"IN240402","Campaign":"20541619131","InstallDate":"20250108","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
WebCompanion-Installer.exe
Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe
1/8/2025 12:56:02 PM :-> Start
WebCompanion-Installer.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe
1/8/2025 12:56:03 PM :-> Starting installer 13.900.0.1080 with: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080, Run as admin: False
WebCompanion-Installer.exe
SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe
Preparing for installing Web Companion
WebCompanion-Installer.exe
1/8/2025 12:56:05 PM :-> Generating Machine and Install Id ...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://spotmate.online/