PUP.MSIL.Bundler.CBA
The detection of PUP.MSIL.Bundler.CBA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.
Table of Contents
What Is PUP.MSIL.Bundler.CBA?
PUP.MSIL.Bundler.CBA is a type of potentially unwanted program that is designed to bundle additional software with legitimate programs or install unwanted applications on a user's system. This type of malware can be installed intentionally or unintentionally, often through deceptive download links, fake updates, or infected software packages. The "PUP" designation indicates that while the program may not be malicious in the classical sense, it can still cause problems and compromise the security of the affected system.
How PUP.MSIL.Bundler.CBA Operates
Once installed, PUP.MSIL.Bundler.CBA can operate in various ways, including modifying system settings, installing additional software, and displaying unwanted advertisements. It may also collect user data, such as browsing habits and search history, which can be used for targeted advertising or other malicious purposes. In some cases, PUPs like PUP.MSIL.Bundler.CBA can also install other types of malware, including Trojans, spyware, or adware, which can further compromise the security of the affected system.
Symptoms of Infection
Systems infected with PUP.MSIL.Bundler.CBA may exhibit a range of symptoms, including slow system performance, unwanted pop-ups and advertisements, and unexpected changes to system settings. Users may also notice that their browser homepage or search engine has been changed, or that new toolbars or extensions have been installed without their consent. In some cases, the presence of PUP.MSIL.Bundler.CBA may not be immediately apparent, and users may only discover the infection after noticing unusual system behavior or receiving warnings from their security software.
How to Remove PUP.MSIL.Bundler.CBA
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.MSIL.Bundler.CBA.
- Uninstall any suspicious programs or applications that may be related to the infection, using the "Add/Remove Programs" or "Programs and Features" utility in the Control Panel.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions, toolbars, or homepage changes.
- Reboot your system and perform a follow-up scan to ensure that all instances of PUP.MSIL.Bundler.CBA have been removed.
Conclusion
Removing PUP.MSIL.Bundler.CBA from your system requires a combination of technical knowledge and caution. By following the steps outlined above and using reputable security software, you can help to ensure the complete removal of this potentially unwanted program and prevent future infections. It is also essential to practice safe computing habits, including avoiding suspicious downloads, using strong passwords, and keeping your operating system and security software up to date, to minimize the risk of infection and protect your system from other types of malware.
Analysis Report
General information
| Family Name: | PUP.MSIL.Bundler.CBA |
|---|---|
| Signature status: | Root Not Trusted |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
364afe047e04534fe9df5b79b4566b5e
SHA1:
6fc4a1bf6771b5a7ae99688bf2eb51e2dd61d499
File Size:
566.58 KB, 566584 bytes
|
|
MD5:
3445ae37d046a8c8ef183cde09090992
SHA1:
78bac0e73c2efcfec20245dfe8843d819cfee064
File Size:
315.39 KB, 315392 bytes
|
|
MD5:
5cde401b097421ec60096af9c346abe5
SHA1:
523bf5b606baf01b06ad3766a316d932c443b730
File Size:
578.46 KB, 578464 bytes
|
|
MD5:
eb833b0be2609870f23f5200740e1c8b
SHA1:
8fbb6076a6a8b85374016dbdb8998b5acc61e51e
SHA256:
578A17CBA784B32BC970FAF0E584DBC56739E9E138637EE105270C253FD56596
File Size:
438.49 KB, 438488 bytes
|
|
MD5:
9ea224387bfdb5d55fb7ae9eae7e18f9
SHA1:
2bac49991e08bbf9d1e210bc4794dc8da3ed5d08
SHA256:
C40B0802F3B90591F63DECD843ABF657E68986250D93405A72FB42D586BC3AF5
File Size:
566.58 KB, 566584 bytes
|
Show More
|
MD5:
3c168355c5548d970524fbffc988a1a0
SHA1:
369fcb0010c67a9db812c927eb7b77745d58b6d8
SHA256:
9E731CC0DFC93A64F5CFF655B34D7D207FB4AB2F50D5E592A80B2A54BAEF70FB
File Size:
683.50 KB, 683501 bytes
|
|
MD5:
f4c85ad28636969799158cc8a48817f5
SHA1:
dd70f6d655f8401e97519bbba4b7765a2c86acef
SHA256:
7AC2DFC2B25D2F840045FA4B32D02130AAF6AD816154CF53C4F346E1602D48B0
File Size:
492.75 KB, 492752 bytes
|
|
MD5:
05eabd05a36ffef555880bce30d166c8
SHA1:
b2293cb1fc3c457fd1bb65d2105e950f32f1112a
SHA256:
89935812340926F0D36E22A2DE96BF7B97155851997B09C6764DB4FE8743020D
File Size:
566.60 KB, 566600 bytes
|
|
MD5:
763a6380fc14d6bc97aae07938715a6e
SHA1:
36cb7968d9d9f61c3e090fc93007183bd93a063f
SHA256:
C72DDDFED17D47AFC0B67DF0727F04D525687471C721CC03547131B05BADB05B
File Size:
554.16 KB, 554160 bytes
|
|
MD5:
a65df2557fd255566d495afcc5217ce1
SHA1:
eeedf4477f1fcbbf618ffa6668e81ebb62024730
SHA256:
066C9B8D9DA0D28E0F3DF787442EF241EAD1A414E3A7B530F2EDD6255B7649C4
File Size:
545.06 KB, 545064 bytes
|
|
MD5:
3fe0ed02aa1b6d1f233316d097868903
SHA1:
a8a788e02ddc2a702ba588d973330dff2e5949ff
SHA256:
32D810459EDF5532172B8643EB6D97CB4F7FA6402DEFE862A86AD3FD4D97C616
File Size:
566.58 KB, 566584 bytes
|
|
MD5:
1e2940776bdfd5b11aad3234244f91f5
SHA1:
d2ac867b433a83759955b4a6ac5f07d246c84f4b
SHA256:
DD533A6FE3AFB2F76B8B77B04BD5321ABE687291A432F5571BABEB815C8F415B
File Size:
576.74 KB, 576744 bytes
|
|
MD5:
57bc2dd19baee207df442c0005c64e51
SHA1:
ee3c200e01af58b09aa7bed6ac8f920bce7a292c
SHA256:
3A5FBCEC9B2E550A9EC3A33B5BB71BE236F7B790AB1EE759247BDCD678FA017D
File Size:
311.81 KB, 311808 bytes
|
|
MD5:
eb730afad07fe2781b631cef31dc0bb5
SHA1:
3369b4c2ec5caa4b2c80bacc2e620fd18ca90c19
SHA256:
1C09D9EE991BE23C38CDAF0443447F305746FF0085E7A1E6F1271EBDAD81E086
File Size:
815.94 KB, 815936 bytes
|
|
MD5:
1ff90076d157eb300a1b199c03412fd3
SHA1:
fc5821854aaa3d6dd6a250ae3e46087c2ef2ab95
SHA256:
AAA43F5D37C47CC71FB0885416AF8F6C38B07759515A1F1608FA093716DCEA1A
File Size:
750.32 KB, 750320 bytes
|
|
MD5:
53c9e09e48d93a7aff596db4ec5813d4
SHA1:
e94e8facdd3706164e0337fe887101a31ee5d8f6
SHA256:
99BD722BFC9DB08963CC90F7869E6740C82FECD87E37D8DAFEF337328E382BFE
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
078ae99248383d836f51151edaa0a77d
SHA1:
0d05570b46c5a1a5cf7410f5acbb8aa53d70e04f
SHA256:
2283C27E01C7012568084B906125899FEFBCB6697108F7F2B907F0063FB200DA
File Size:
566.60 KB, 566600 bytes
|
|
MD5:
3370e65a6fa39aef962a757da38abed2
SHA1:
5dc7fe955bc4b0fce40211e96899073d32d0ff82
SHA256:
1A655AD30836FECF4EE800AF9310534B4DD40955FEE1338C558E09FB4342C79F
File Size:
755.50 KB, 755504 bytes
|
|
MD5:
df45e1f260c0ab3c6342a06925ff59d6
SHA1:
6a18de4b289fda2c8edb307b0f4a0f815ded898b
SHA256:
48FEF23B7504E752BF3FD48504C6E34B9B8EC1E3E200DC1EC5312A5C7459A021
File Size:
755.51 KB, 755512 bytes
|
|
MD5:
0c42f01ca32b453a50c2732ffd4c462c
SHA1:
505041e56498acac1903af2b5e2cd346f97037a1
SHA256:
925F27593EFFFD5204AE49255FB89B6FE6E8AD10DEC8EF596170DECC2959F3CC
File Size:
750.34 KB, 750336 bytes
|
|
MD5:
e500ac936d616bbb26fbc702545be88b
SHA1:
d6243d9c3db2f411cb6a05fe35deec8b3e56e644
SHA256:
AA46DE7212171978A35CF29F567EFFFB4A5473DA8FD976FBF4AE2CF0EBC10186
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
b6f0c1e9736ef72b490afe2f7bbe84ae
SHA1:
76cd3833ac6ba2881d55cfe2671d47e92609cd27
SHA256:
78AD9564C523FB31DD70EB521F3D772DDCC563CC9F5B1B3F9E32354E2DCF7BC5
File Size:
811.84 KB, 811840 bytes
|
|
MD5:
f8dd5245bdce1ea4386b3c48e420f1bf
SHA1:
5bf748339614f427b6f32cc3d7c1599f70595098
SHA256:
DF3728E2CA8BDF20BD96E2D5056A06B62D8401E1B5F11F77A07BC924E0A37554
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
1aaa1b71114fc56f557899fe9c288b6b
SHA1:
fa284917696e8d3a840e24876e1a692c4d779a1b
SHA256:
FAAB4300F6E1BF170ED95177F7B4EABB2FD5952A55C764DF0AFFD3AA8571C1B0
File Size:
755.51 KB, 755512 bytes
|
|
MD5:
1775f0a77318417b1e84f9a448085343
SHA1:
5903c4d1f8c0a26b09056923040a576d180a5c23
SHA256:
4488F848CFE4EB8A9FC3D27EC4808CF975E2954980DED46654FBF8DAD96CC5F7
File Size:
750.33 KB, 750328 bytes
|
|
MD5:
5f42237caee5d40b7a5f35846541dc8a
SHA1:
69528d143c61b25c833c1cb4f3bdd31a906e2308
SHA256:
0BFCF51F2AB8CF3B8B90F38EE9CDFCE05CAD5A146390CA1A9518C71796E6EAD9
File Size:
755.44 KB, 755440 bytes
|
|
MD5:
0a91a7ccd54756820a5ae4538ef61b58
SHA1:
1998332b435d596596c7e98101e37e815f36557e
SHA256:
9D5E0129E9EE6573E238EE2090F781139FEF11EBD553AF32987333139F4C9899
File Size:
811.84 KB, 811840 bytes
|
|
MD5:
eb84b62e09f747f9e1ef6ef1aba7a4d6
SHA1:
178514c9f737070d91eb34c03fe74babcf6bc734
SHA256:
BA27E48BF308C0B12B50449C82E8B877F1F5B3B1ABA75C0FC7890A813BB130FE
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
87ac0320b79bfa1e5a00a814a81d571c
SHA1:
cfac351b5b12a6503ebc23567c83754d7757942c
SHA256:
F7F9CD2D42D5AC73BE56D456001B5C778B2555D4629BFA623B4C2DA75AAF08AF
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
1e5da19f1c3084af7cf83034cec2542c
SHA1:
af8c85dfe2c806e540ae5fe8630091c4d3b1b30d
SHA256:
C643ADFC073CD66011AA63E56973152E8BEE653C3991D533A5210EE4FE2018B3
File Size:
811.84 KB, 811840 bytes
|
|
MD5:
f44005b4c70ad5c8e6ff81c879bb03ac
SHA1:
a30a92626bb729b81ee408bbf0f9c96d5494d163
SHA256:
FAECB71CC74D326450B9C19A2716D4F1ABC38D60689A7848D65A49641253F4CB
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
a385266a248aa9e842c62716a39a9e46
SHA1:
07724318ac3c893e4e5dcffd77f2c8231395de6e
SHA256:
E4806B2132F6DE835C4D21007196D619DA23FC975DC50858020BABDB87B75BB0
File Size:
811.84 KB, 811840 bytes
|
|
MD5:
8a19dbfc9cf462e8b53380fa509e38d5
SHA1:
a1887421fe11ed63c1b3bb3b05425ff2aa52d8e0
SHA256:
7E0E47B0F6C7533D98FC329F8672C822D317A0BFCBA0AEE884EDC8414F2E600E
File Size:
566.58 KB, 566584 bytes
|
|
MD5:
f674f65bd9a1d259c27b11c22779e0a2
SHA1:
15797f157283242ec16c293a37d8e714541438d3
SHA256:
13F13CCEA966F2D8D3BEF918E38EA7C27C6DE81434176AC65B34C0E40743C1C4
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
a02438a9e0f97fb6235ef0c0bc5f4efd
SHA1:
633fd90c276a5888b857090d7ef1425de9ded852
SHA256:
BBC07E9DFECF16E5803969ACCEEF8B54191C3B506E3CA9D687053143A001A1D0
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
c8da064fc7b9892041c889d972285f75
SHA1:
3fdbb3c99a189c2a047eb2429aeb54f941f7fbef
SHA256:
ABDDAA32AC2AEA0B21D180AA2E090DBADDFEF57AC7C45062C80D72BBFDADAFA1
File Size:
811.82 KB, 811824 bytes
|
|
MD5:
b3374dca77a19a1b89d3c21d16fcb80f
SHA1:
fae78932a512895e196212cf9c90c28791b2a080
SHA256:
889298961D98BA975DE8F4F36F7B06170F45006CFFEB22FF847F31B0BD3C0479
File Size:
555.03 KB, 555032 bytes
|
|
MD5:
aa9460da6cfd9506c589d8e0c627f9b6
SHA1:
61ae448092dec2e8e94906b703effe2f72dd61fe
SHA256:
43AD734776B43EAFF37AE9B7E2ED558FC5321CE194D4B2F01A10F4E73396FEA2
File Size:
576.76 KB, 576760 bytes
|
|
MD5:
07084ba49931074beae12d8737e4740b
SHA1:
bfadd713f12cabfe2abf441029e4ce7e55fe2bef
SHA256:
7CEB9F0D67EA0B840546D479ADDFCF0CEB63A2FFC018B2199BA4B6D42CFB2BCD
File Size:
815.94 KB, 815936 bytes
|
|
MD5:
d26b2a281cf64a0de4eedd00bf496daa
SHA1:
64d6adc6a31d1f0b92b0705e493d5c31907323f7
SHA256:
7FE15B8BC195FF4ABC8D2F5E5048722AF99A38FE9BBA47C7ECDB18045794592A
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
56c14fec068ef0c370fed508658d8091
SHA1:
5501332175f750d2a1e60b91c43d9342618b283c
SHA256:
539A732138D2B8C37AB40A1104E437F4D6BE1BB76FF59B3836F94DE1FDAB65C6
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
fc4409e5cf9dec15475ed00d28d452f3
SHA1:
c03c78f8f5125071dcf5ebd30ff207af6f9fb32c
SHA256:
40853BEF9C85D8A7F11BD824D02E46E23940244AC5CFB714860DC0BA0C153C2B
File Size:
755.53 KB, 755528 bytes
|
|
MD5:
445c79b58b51a9ec9bcb040d61a3a83e
SHA1:
11717f91debb858ad91af9a2c8de99fbf0574c8c
SHA256:
A534F24E2264B36121E6A8F40040A2DCAC3630DA92D5F7416E8D1D301DF1763A
File Size:
749.82 KB, 749824 bytes
|
|
MD5:
d918fab36804a2eb696dfd70623607ad
SHA1:
f9e9a4fde069597887cd13cd9cab4a873cf50060
SHA256:
16B20BEE711368C448F8E3C8176121E446AC9A450D132423EE2AE8E9BDB0226D
File Size:
791.87 KB, 791867 bytes
|
|
MD5:
e8c6aa1b3280c6ca2dcdab140fb2576a
SHA1:
ee901ff7da069a796c0008a71bd711651388359f
SHA256:
15D7AEFFD8DD54713EB04EF1C6F959702B6EBE2BB404A72F3675321EAD153A56
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
8976bbe44680a7e6742f20b6b49acd16
SHA1:
56ef80130c0a080325d4ad22c643efe200e010e5
SHA256:
62867F9852334DF3CD28FFB2129AB24CA2CBE5849D73A500E028A1C7A1CA7FEC
File Size:
755.53 KB, 755528 bytes
|
|
MD5:
fe3682f28de9395de75a954402d5bf0f
SHA1:
cbf5da788bfaeb76e35c3b4bfd04645be2daf365
SHA256:
818AC225822BC8407D3CBD3037EF45FD4E0C3EC2BA5632CF45D65009D2CDE445
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
648e6b3554bd3093130ba8d504febf16
SHA1:
2d3a392f4cb44173e0cc27c288c6252d7fa3a1be
SHA256:
79E901403A82C379364C8D421A69585A50A5ED42234F936867B929C9328A24E4
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
c6d8e8717003d77276203be457a34bfe
SHA1:
4a9766b52b30e15dcd1eb636216502e2fa5cee33
SHA256:
7F55434FD119F535DBCFB324C62F3A286D580761F6D668FC0F39E9261B861079
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
0b08d0d56dba61f740c5076b1a003d4a
SHA1:
5d71def60dce96f93b8f84d6845c6ee0f035ce19
SHA256:
A92398C6124B8B40A1281FF9B20F7814F0CC9050B6C7A5225E646653EBCB348A
File Size:
1.57 MB, 1573888 bytes
|
|
MD5:
bb8e9602148c265c5c5db2b39749540c
SHA1:
8949c4bd3826c9a67b712a8c15cda40fdd9bac96
SHA256:
9AC0B52EDCFDC8EA8A3BF79DD8740765D148480F2EFC3313CD8598C4831ACC95
File Size:
755.51 KB, 755512 bytes
|
|
MD5:
50949a49f8252161dc571190349bc54d
SHA1:
8e34d5b8877bff78cae93940e3e489b1bbb841c6
SHA256:
AC9A6CE632895374C781DBE248934928EB438FEBEB96CBD6824D62D6A4916E9A
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
180dc3562d68791c5407f078202431aa
SHA1:
af813aa970ca5193c55fd481429d1c64d913e02a
SHA256:
D4214E0CC27558D2D8707027DE934494CAE1C03F8A7F02F03A08679AB7C75D37
File Size:
750.34 KB, 750336 bytes
|
|
MD5:
4204d55eafd39a9af18bbb2fad2812e6
SHA1:
69d656c7c1ec2efceae2c3f3078cb778a691017d
SHA256:
9051B548A70710DD10EBAC527AFCA7683FE845B5D5C6422CF31255DFF032D3DE
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
eba76b13f40bfd2fae913a432cde9360
SHA1:
cbadcbb33628ad43eda4e595ad4eb1628a25506b
SHA256:
9987014A154AD9ED90D38E4A122544440CFEF8D4CDC88C73B91D78F8FF627060
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
e7550907d2bf16a11427cd8a5b8c162e
SHA1:
f5e211e52d1bbd5620307548a119c76f10eb2b44
SHA256:
8601A4E4FD21BD6E86D1A8C1F325F7548AF2DE1143710905A0B2BA1852A05592
File Size:
755.53 KB, 755528 bytes
|
|
MD5:
18b96dcfabce995e7b4a847923997587
SHA1:
e900ff6c50a8056ff50229a38db9b8d14dc30814
SHA256:
4533E6CEAFE6D09A1593484246648D2263ADFFCAB7D48EB87AB1941E594409C8
File Size:
454.14 KB, 454144 bytes
|
|
MD5:
fa023c42fd55d3ea2e929f9de0289d6d
SHA1:
1eca2410527042bcdac346352d7ddcf1e49d97b9
SHA256:
24577DB3DE006E1DC08996963216F4EC7914B23CADD29EBD39E3BE3776C9E3F4
File Size:
566.60 KB, 566600 bytes
|
|
MD5:
1d5a5ef29878b2bf28afe1cf02c180f8
SHA1:
7a9ad325c9589aec3afe8113f704a94f13559e44
SHA256:
E9D9191934316AD0CD9492BDC5A9A2D2D9154A53906D0E1A3657F8CB7DD808E0
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
8442caada1221448180a4c4c36ca6e02
SHA1:
9e484b8b505fcd8953d868888905ae80ace23af5
SHA256:
F8BF10E0DB0D81C3C10E80B10833ACB026F443D986500074647B4E7FDC28B559
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
79dadb91d4e1739bc343b1dfa3d23fb4
SHA1:
855add33954b0a100971c10984488b22a3c2cb99
SHA256:
A193221EA4DB31DA5A16150898DAAB09D0E11A3BE819EEC044EC35C63CE94C53
File Size:
1.31 MB, 1307136 bytes
|
|
MD5:
fa9188deeb1c79a274fa0cffb3672ca2
SHA1:
364633b00c4be021483595f9563a5c69a319bc0a
SHA256:
7CAD76CF8A1FB5B10CD7D2665D15CB8F762DF3819E885710B81992A9BB2C8972
File Size:
566.58 KB, 566576 bytes
|
|
MD5:
7d084b53f426e017c63ca873c4aea0d5
SHA1:
77c8466574d6d1c05bb51c9b2e653dc59732962d
SHA256:
4DEA4D99D201023C2C3A1F732CF6AC36BFBD14BEF7FB3CA86CA72FC1A78B9155
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
d5eda4d2339965f527a373a5c58ef0fe
SHA1:
7b136b27fe5d5a6aee6fe7ac378cab04f005fbcb
SHA256:
57E2D6C1B5A0E5AD0B019DFFCCAFA8532E0338E293E5061B98FB45548C428B13
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
f258c017c1ce8d79e158df499ff2da5b
SHA1:
6597f6a1d3e7c8283c74561adac51860378c6c36
SHA256:
282036DFD3D0A3F7678AD486212FFDDB6E7910373D65683614EE6F89FDD386FE
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
eb59afbb717eef09693a1095a8d409af
SHA1:
8d4798f1f0d6fffe0f185b57a9dea2d14526cfce
SHA256:
F2440139B80006D829851C850674DB6BDA6FE8402E23009557948FC0FB97F3F0
File Size:
755.50 KB, 755504 bytes
|
|
MD5:
9d13731c4e03f24c2b3b81c4da8300b3
SHA1:
b2b5253c1765df4e6d26cdfbe75e572b39845a6d
SHA256:
7C5EE97AE507EB20F70CDBA8584A85A697C29BF50DE57F8CEF0B1BF11CE56DDD
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
daeb01141642dfc950e37251626d7c74
SHA1:
5d16adfa67a00441880f149f4edf33d005f0f936
SHA256:
4EFDD949412FA43D1C2297756693B41664AAD6341B62613D7AB5B8DF65643E0F
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
8cb401000c7f00c6964fcf4695d234df
SHA1:
1c23565cd87a9f33d330fa143b220153c808bf49
SHA256:
A4BB90E9B6CE5CB15059852075D596852C26579F7D996DA6DEAD27524BF4C8F8
File Size:
811.83 KB, 811832 bytes
|
|
MD5:
c73e35c317e67cd7e77d15477bbd9b33
SHA1:
dfa5713920a9666b8a1bf922de72c117ad3b48c2
SHA256:
17A4E441236A3A8887A04801FE872637F7B3A29D324CE7BE425D34BDAD8ADD7B
File Size:
545.06 KB, 545056 bytes
|
|
MD5:
1c3db5f0244abaa599f2e771319c991e
SHA1:
aadc7188d1230136dda4df47cd477d383c0c068a
SHA256:
8DBC2F905AD5048171F25BFBFCD71622F3DF27CFDACC5AF82DF1B2A67B283C24
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
1d5fc610af00a96bc4f673ff11589fa4
SHA1:
c1ca00c5d21a7b19f558d55dc501195afe775271
SHA256:
3A4C3AE4708CD400A10EDFA06EBFEFFED6D76B8BD8B297A9ECBB110B4D17DCA1
File Size:
750.34 KB, 750336 bytes
|
|
MD5:
11d4f904d37a62a10ca6f894790834d0
SHA1:
ac31991a3834d01a438accd084fa521c64fb0ebe
SHA256:
6BCAD2D954460686FD219ACF947118D39DA9250504654FF77CF84D6302CF354F
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
2da353ed96742b2e35bb802119b341b0
SHA1:
240c5e53d6827c5e9dfc32f53c547d9def50b8b7
SHA256:
0CF18F8BD8D5414F63EF5E9B5D6E0CB56ADCA4D4FB1B451115A90FB1702F9E03
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
0fed3d2bc6c595f088a4b748dfc1264e
SHA1:
67b992e90c02e86510cfaa35cbeae04b633f50c3
SHA256:
3234BA277370235EE328E27E5624BC459654BB5A30442B52064580829839D333
File Size:
815.94 KB, 815936 bytes
|
|
MD5:
209f3fd1532cf7e4344cc02c5bb616c0
SHA1:
78ca0d0f2bf0170499753496892657abed6bdeb3
SHA256:
1AE09882C32D421D5738DF8F4A5F9DAA62830DE7303160B12D27961426C4A9BC
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
2cf3c6d199fc03359c23541ed3d6b38e
SHA1:
f030dc1bb6205ed59ab3ca3dd1a5d40a7fd4d5d0
SHA256:
95E11187B073564CDDE9199A3AA58EA35EB49ADB6E0532F49C0C0D8E1BB91165
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
f0973ccb5d7cdd063ec1cd5592e08adc
SHA1:
0d84e92c5339904cf858f9b44ba71c4a5a0cc6ec
SHA256:
006BA89D2625EB7B7CCB743E3686EC94D4E2B2EE5C680CF47E7426E3FF1CABD0
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
271af0a34a5fd001b25b396dbc1b86d6
SHA1:
44dd12fd111e3f4cff13ac44660c1f3da1a2bd20
SHA256:
2C00CB6A996D751485D0F4C53ED440911B952D2E857D992D753ADC1F38C86C0A
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
7442f3af60e4d5ddde875792632220a1
SHA1:
17cce6b09eca760633aaad8301ac160bc51f9159
SHA256:
DCDD713DB6085D107AE399BE5EA900FFFDA834859FB5E496E49EEC5D51A6491C
File Size:
755.53 KB, 755528 bytes
|
|
MD5:
9b31e54314046cbf055aa3c5fc077f3f
SHA1:
12d1b8c796ecb5a1dde2ca00bb63ce8be11dba6f
SHA256:
1F439B56A45D50289F71FB5C60A2A4B4788B4EAEEB24EDFA40E0781628D9D14D
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
24ac78d6ce5b01462106ae170e58355f
SHA1:
ebe07f6b4411edf204e66ed7bdcb52d2bfae4a22
SHA256:
D8FFB6DF6BA0248B7D424D45D21F327582F5A9189ECD4C4A6A3A6CF0E039327F
File Size:
1.57 MB, 1573888 bytes
|
|
MD5:
db500ab01515b317fd1eeb60dc1abc87
SHA1:
0982636e8270214cb1719716dc0c2257b7595da1
SHA256:
D489C808D3D5BF8067AFE340C5BABFA111F37FA0C60299120BCC21D1A2A44338
File Size:
815.94 KB, 815936 bytes
|
|
MD5:
e5809a4aef041694b280d7dd8319e027
SHA1:
30c3fd0a1e1235fcc86f0160ddf184025ff80662
SHA256:
ED901A8413DE7288F21A1472177C340D17F72DEF4669F1FB6CD5C14B5D1288AE
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
8588c1b1f246fdc1aaa7d0bf594e0c65
SHA1:
81cf6d4d5fb86d233629387c278c37c42bcb12ca
SHA256:
DBA949907352DD24B940421CBAE16AEC84DEA89AF48966F98B8C91751C5C64A6
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
7d092f2c3e122b3955e9c4bcbd3940ac
SHA1:
1e9ab5c4aa87d0b9874023ac951f8539df8491fa
SHA256:
20B4ECBD2652F5DB5876EA742AAF55E7D1920B388D233FA0A7B74EB4BC0E59E4
File Size:
578.46 KB, 578456 bytes
|
|
MD5:
ccbc380d1004ffa065856efc3937a250
SHA1:
090059c63caecb9c16acd5d772005a1dc0656c8e
SHA256:
FC318ADCB09826B21D033FE17A8AB2782B80CB219C06F54EA04B6BFB13A6A542
File Size:
755.53 KB, 755528 bytes
|
|
MD5:
8a72abe4e1f66d8b426e816ee3692753
SHA1:
fb6ed1f8a3327ffcc35000fd798db250354eb0d3
SHA256:
7EA8808505629BF9B3F56E4ED1251E63D8FE05257D9842F4F0785F0BFB51ECC0
File Size:
579.97 KB, 579968 bytes
|
|
MD5:
d25463710d835322ae8b92d951b9b6cc
SHA1:
23b273df363cf7826a8f02160a5e44911d71568c
SHA256:
672399FDEC29B64117FB48A75B2F7CEDAE1364690C8B5A0638B0EF999FD03982
File Size:
791.92 KB, 791922 bytes
|
|
MD5:
07ee73a5b3c78a62e7a6d80ac942c081
SHA1:
e882966b2c85706ab95dc1f5f22fc130f2912f6c
SHA256:
A006CE456CEC8E2F23590CDC3195654E28EEEE2024B923D0F485B390FBBFAED0
File Size:
1.52 MB, 1517568 bytes
|
|
MD5:
9aa9bdcf45aaad6173a09394a2a6903a
SHA1:
ac23357c759076e04907e952b65db36f2c194851
SHA256:
8983030E3DD3F0A669D2D958A09C1BBD130DE9CE0C7670395CAE98A8C7F86DE5
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
0dc1e6d2077c1b7a4ef16e1fd9b8bdb7
SHA1:
ebe84c33939f9234168980ddbe737231aea800ed
SHA256:
71508181AE642CC636B1078FB2869F8808DC6A5D4264A3EB0499BD5E1F8E315A
File Size:
750.34 KB, 750336 bytes
|
|
MD5:
4a7545d5a40d2052eda4d04bfccad0c8
SHA1:
bbd297df631a084875199d60b6d1ce23cd7b05a8
SHA256:
4FE12E9546D299DBF81120B34A9277A50E4A9B412F9D4E151FA96E8107FCCCBE
File Size:
791.98 KB, 791983 bytes
|
|
MD5:
d96e32ea6bbec6ec0468d703c76a4163
SHA1:
2886c1ffd1f2ccba95b25b1c6777a6ec15d99b08
SHA256:
F51140A7F3AB598F762698553FF18941AACDA7F75C8A608CB2D627A1C6B8E199
File Size:
576.71 KB, 576712 bytes
|
|
MD5:
463ada87a3fb5798a10b06dc928fa8b3
SHA1:
718efa9a9ae7ab4d6a881f9b9e0283adc4ea39da
SHA256:
03FF45741FB2B9E5229D170766F91B5A44A05086B0BB351AD1561FDBCC232872
File Size:
467.15 KB, 467152 bytes
|
|
MD5:
3d47c92c4d5a4d61f63cf79b89e7cbbe
SHA1:
c8a46a982140b7c72f42a1870141bf811a49db53
SHA256:
11875BEB4F44221701B2F1B84C6C942DD021A5804EA08329078247E4F98EF503
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
b213b81898d0f7c52d6c4f51c71a2a10
SHA1:
f00b2467ffb9376ace6dabeb450ed8367eda9633
SHA256:
18692E9A73D5A47DC211A6885345DBD993832B3C3621BB0C6885E4CCF7EA3FCC
File Size:
311.81 KB, 311808 bytes
|
|
MD5:
7d09087b7d52e54c28fadf510b09121e
SHA1:
a0f50c50f464caaf567ded38257fb9230a603424
SHA256:
229321EAAC7C416038FC3C699CD57CB54B60DF0640EC32ED1B1FD3D7D940252B
File Size:
1.02 MB, 1023855 bytes
|
|
MD5:
30ea82d8c140dba48c4398801a8fe9c0
SHA1:
23c254cb536a965c7719b72ad1421b4b66de22d2
SHA256:
9D1B24BA2EE7309D2776B530118119B95A86684DC8F4C43D81746FE5D5B00C33
File Size:
750.33 KB, 750328 bytes
|
|
MD5:
cfa3dff87d0bf1fd01c768d98b523be4
SHA1:
3f44a5243e7480f079ed4dcd96a8c68cb0362451
SHA256:
1994ECADDAD6F576692E47365A2F1B8B8A5DC7B3526B45E7AB3870902EE3504E
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
12c4d509bef9d8a9f9ddd05095a13b08
SHA1:
85f5182ba712f1448381b2fa8c40542f97599095
SHA256:
D21C2FB7010F94FC3C72FC458C445E3AF03CC73E020A55994020A7D050EBC5A0
File Size:
802.82 KB, 802816 bytes
|
|
MD5:
30f060e57aa0baf029858e76ef7e6d2c
SHA1:
6645c274be54f34e806267d245be345864ff8847
SHA256:
9E5B2D4FD8D0E674DAA14FF4DE5A5C188F841BBDF606A8CF297046AA36FBB3D3
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
d075cfbdcde0d3f25630893e93d6fc8e
SHA1:
cc1c71ab88b7a3e85fe22d610c495b2047e41c2a
SHA256:
5D9CD58DFAC4BF169DEFF6180CD4ACBBCC2095EE86ADD8BB67C3773A8D00823C
File Size:
578.32 KB, 578320 bytes
|
|
MD5:
41b3d7595d76d4fdc634418bfa599260
SHA1:
18829550f8ed53e46a1aa81bbb00b4ba217da4c8
SHA256:
24C254D6CB185BCECCEBEDABEF6D184AA1352A92A10C52112214C717D55A04C1
File Size:
1.31 MB, 1307136 bytes
|
|
MD5:
fe1e96b02b26d47964754e5abbffd197
SHA1:
c0e5c4961ece4b62f188abc32f917ef85b443be9
SHA256:
BBE3CAA383ED7610889594E52BFC0AE6D3A950FB6D332E63E555C3B3B7251A4A
File Size:
750.34 KB, 750336 bytes
|
|
MD5:
6ca03400b8f2f6db2d92a837bbde2d2b
SHA1:
275d8537130e7d4025071c71caa070fa20561c02
SHA256:
BA45B6D045FE9237171AE53D8362F2DD2E42A60C0CB86EC881C4B952A8DFD904
File Size:
755.52 KB, 755520 bytes
|
|
MD5:
5839fc980df5dd26efb360e6fcc05a90
SHA1:
e0fcd08393e4ae894e88664499ba0db4aa957b49
SHA256:
68D653442E0644AB407D924134EFBF74F41C7FF7627ACE67545A3B3BD6D3E33F
File Size:
656.58 KB, 656583 bytes
|
|
MD5:
dca7afe8f37f0722cb87bca0d7b4accf
SHA1:
21bfea996169289e86896cc4e91d0c0194f686bd
SHA256:
0CD59A2FF5D8F1A0F22EF6FFBED0BE9C263767DB6E9DBAED68D0A10319CCBD10
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
99bde1367068d7711cf77ec40904a590
SHA1:
5466259513794fd029d1e097beb86db4d15dad39
SHA256:
0589AA0222C7F57E1FE65FFB66230ABABFDD65E1F0ACBE342A6140974FB61C4D
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
5e3f051cd5a0505d9ccfc88addf154fa
SHA1:
99890058b119259fd8cca1ce6218e1e0f61e88d3
SHA256:
632125B3B9789768C5C7C91328C4CC8BBE9156D55C4520EC0CB863C4546C7F20
File Size:
755.53 KB, 755528 bytes
|
|
MD5:
bacc07cce5454f5a88915d927d10850a
SHA1:
1ce0ef5f0bc677de9f71196800ca999ef566ba56
SHA256:
F10F84A5EB8654C41FDA986DF9FC05A21057635682FDFCEF5F7BEC9A7C13543E
File Size:
755.51 KB, 755512 bytes
|
|
MD5:
edf6475fcd9f7c51194e8ea3c18462ff
SHA1:
47fe783292d9bef34bb620aa3374723693c9a7c9
SHA256:
341B35730041F20804C0D2A4A9B0ED3613694028FD71A0D80E2AE551B0873395
File Size:
967.45 KB, 967449 bytes
|
|
MD5:
a971c34ecbd3416440eae3953de9b37a
SHA1:
1aa930e3f2947ea260810aed1d00c97859927a6c
SHA256:
B56128EB97AD7FA0980182284D8CC162590DC2883DDF01381AD9EA84F5F8975D
File Size:
555.33 KB, 555328 bytes
|
|
MD5:
5be687ed18a956a418344cba2b4079f6
SHA1:
a92f3933188756fe0230da9b303a8d90ec79c076
SHA256:
3147F5B171FB452D2EFB51CA3B32DB7E1515CB68A25CD6FDFFE9180D8BC416E2
File Size:
755.46 KB, 755456 bytes
|
|
MD5:
4d9dbd06b74db20d632e69fb7dca74c9
SHA1:
6aa51910d86ecdd280f1abb034e714099a146bc7
SHA256:
288580C843269D6504EF68DE0C01E9F05F3FB2B04E2043ED5825B5EB0CCCE9A9
File Size:
755.45 KB, 755448 bytes
|
|
MD5:
5e4fc3cce7ed835ea1a3c41b7a4af771
SHA1:
651c791164aaabace82167b944013bcd391fc459
SHA256:
6C503168F1AB263A3125C0FC9C554F4693E4DFD289CE0E604FFC1FA7BEF083E7
File Size:
811.84 KB, 811840 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
Show More
|
| Comments | Web Companion protects you against malicious websites and dangerous links found online |
| Company Name |
|
| File Description |
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | (R) Lavasoft |
| Original Filename |
|
| Product Name |
|
| Product Version |
Show More
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Lavasoft Software Canada Inc. | Entrust Root Certification Authority - G2 | Root Not Trusted |
| Lavasoft Software Canada Inc. | Entrust Root Certification Authority - G2 | Hash Mismatch |
File Traits
- .NET
- dll
- HighEntropy
- msil.krypt
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 966 |
|---|---|
| Potentially Malicious Blocks: | 500 |
| Whitelisted Blocks: | 459 |
| Unknown Blocks: | 7 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
0
0
0
0
?
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
0
x
x
x
x
0
0
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
0
0
0
0
0
0
0
0
x
x
x
x
0
0
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
x
x
x
x
x
x
x
0
x
0
0
x
0
0
x
0
0
x
0
0
x
0
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
x
x
x
x
x
0
x
0
0
x
0
0
x
0
0
x
0
0
0
x
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
0
0
0
0
0
x
x
x
0
x
x
0
0
x
x
0
x
0
0
x
x
0
0
x
x
x
x
0
0
0
0
0
x
0
0
x
x
x
x
x
0
x
x
x
x
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
0
x
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
?
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
0
x
x
x
x
x
x
x
x
0
0
0
0
0
0
x
x
x
x
0
x
0
0
0
0
0
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
0
0
0
0
x
x
x
0
x
x
x
x
x
x
x
x
0
x
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Bundler.CBA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| c:\program files (x86)\microsoft\edgeupdate\install\{6a176c66-fcef-434d-b7e1-fb2480e2fa30}\microsoftedgeupdatesetup_x86_1.3.237.7.exe | Synchronize,Write Attributes |
| c:\program files (x86)\microsoft\edgeupdate\install\{6a176c66-fcef-434d-b7e1-fb2480e2fa30}\microsoftedgeupdatesetup_x86_1.3.237.7.exe | Synchronize,Write Data |
| c:\program files (x86)\microsoft\edgeupdate\install\{6a176c66-fcef-434d-b7e1-fb2480e2fa30}\microsoftedgeupdatesetup_x86_1.3.237.7.exe.dat | Synchronize,Write Data |
| c:\program files (x86)\microsoft\edgeupdate\install\{6a176c66-fcef-434d-b7e1-fb2480e2fa30}\microsoftedgeupdatesetup_x86_1.3.237.7.exe.tmp | Generic Write,Read Attributes |
| c:\program files\common files\system\symsrv.dll | Generic Write,Read Attributes |
| c:\program files\common files\system\symsrv.dll.000 | Generic Write,Read Attributes |
| c:\programdata\lavasoft\web companion\options\statistics.txt | Generic Write,Read Attributes |
| c:\programdata\synaptics | Synchronize,Write Attributes |
Show More
| c:\programdata\synaptics\rcxa21b.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics\rcxc410.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics\rcxf63c.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\synaptics\synaptics.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Attributes |
| c:\programdata\synaptics\synaptics.exe | Synchronize,Write Data |
| c:\users\user\appdata\local\temp\7fcactr.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\7zs00b27e69\de-de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\de-de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\de-de\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\de-de\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\en-us | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\en-us | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\en-us\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\en-us\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\es-es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\es-es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\es-es\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\es-es\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\fr-ca | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\fr-ca | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\fr-ca\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\fr-ca\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\icsharpcode.sharpziplib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\icsharpcode.sharpziplib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\it-it | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\it-it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\it-it\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\it-it\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ja-jp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ja-jp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ja-jp\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ja-jp\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\newtonsoft.json.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\newtonsoft.json.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\pt-br | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\pt-br | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\pt-br\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\pt-br\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ru-ru | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ru-ru | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ru-ru\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\ru-ru\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\tr-tr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\tr-tr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\tr-tr\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\tr-tr\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\webcompanioninstaller.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\webcompanioninstaller.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\webcompanioninstaller.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\webcompanioninstaller.exe.config | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\zh-chs | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\zh-chs | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\zh-chs\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs00b27e69\zh-chs\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\de-de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\de-de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\de-de\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\de-de\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\en-us | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\en-us | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\en-us\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\en-us\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\es-es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\es-es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\es-es\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\es-es\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\fr-ca | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\fr-ca | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\fr-ca\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\fr-ca\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\icsharpcode.sharpziplib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\icsharpcode.sharpziplib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\it-it | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\it-it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\it-it\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\it-it\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ja-jp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ja-jp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ja-jp\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ja-jp\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\newtonsoft.json.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\newtonsoft.json.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\pt-br | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\pt-br | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\pt-br\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\pt-br\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ru-ru | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ru-ru | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ru-ru\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\ru-ru\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\tr-tr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\tr-tr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\tr-tr\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\tr-tr\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\webcompanioninstaller.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\webcompanioninstaller.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\webcompanioninstaller.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\webcompanioninstaller.exe.config | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\zh-chs | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\zh-chs | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\zh-chs\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a78125\zh-chs\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\de-de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\de-de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\de-de\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\de-de\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\en-us | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\en-us | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\en-us\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\en-us\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\es-es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\es-es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\es-es\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\es-es\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\fr-ca | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\fr-ca | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\fr-ca\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\fr-ca\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\icsharpcode.sharpziplib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\icsharpcode.sharpziplib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\it-it | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\it-it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\it-it\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\it-it\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ja-jp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ja-jp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ja-jp\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ja-jp\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\newtonsoft.json.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\newtonsoft.json.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\pt-br | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\pt-br | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\pt-br\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\pt-br\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ru-ru | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ru-ru | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ru-ru\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\ru-ru\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\tr-tr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\tr-tr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\tr-tr\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\tr-tr\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\webcompanion-installer.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\webcompanion-installer.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\webcompanion-installer.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\webcompanion-installer.exe.config | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\zh-chs | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\zh-chs | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\zh-chs\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs066a9775\zh-chs\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\de-de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\de-de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\de-de\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\de-de\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\en-us | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\en-us | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\en-us\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\en-us\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\es-es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\es-es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\es-es\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\es-es\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\fr-ca | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\fr-ca | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\fr-ca\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\fr-ca\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\icsharpcode.sharpziplib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\icsharpcode.sharpziplib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\it-it | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\it-it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\it-it\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\it-it\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ja-jp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ja-jp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ja-jp\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ja-jp\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\newtonsoft.json.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\newtonsoft.json.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\pt-br | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\pt-br | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\pt-br\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\pt-br\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ru-ru | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ru-ru | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ru-ru\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\ru-ru\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\tr-tr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\tr-tr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0bc98dcb\tr-tr\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
850 additional files are not displayed above.
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\systemcertificates\authroot\certificates\ddfb16cd4931c973a2037d3fc83a4d7d775d05e4::blob | 0 N��K���j8�XCPx �c,j��C�7�Mf �6o�TTJ�h� �91�~�S @ 0>0 `�H��l00 +�7< �0g� 00 +�7< � 4 02+++++ 2 D i g i C e r t T r u s t e d R o o t | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43::blob | 캇笋สI壡魱꠷犓 쩭큛켍༜瀲퍙뉴ꚜ엣ꘊS @ 㸰ἰआ虠ňﶆɬ、〒ؐ⬊ĆĄ㞂ļ́ダ؛朅ಁ́ሰူਆثЁ舁㰷āȃ쀀 4 ㈰ࠆثԁ܅ȃࠆثԁ܅̃ࠆثԁ܅Ѓࠆثԁ܅ăࠆثԁ܅ࠃb 逾떙币䢏lᆝ﨡㖺襚槟Ṗ옽尲 | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43::blob | \ t�f�̕��A��r�� c�c b�Z�ȫ Kߵ���MC O_i09� {@��ʏ D i g i C e r t E뢯�˂1-Q���!��m�b >���^�Hl �� �!��5Z����iV =�2\ 4 02+++ | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\8cf427fd790c3ad166068de81e57efbb932272d4::blob | K�ɑ�e �Z��� �� ����� &�� d��h��U� υ���oR�h7�� T 0R++ +�7 +++++S A 0?0 `�H��l 00 +�7< �0g� 00 +�7< � 6 | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\8cf427fd790c3ad166068de81e57efbb932272d4::blob | \ �F�|��ϴ1 u1: � ��'�y :�f�� Wﻓ"r�~ b�� R_E��ܪば^7�-4 jr&z� �}�;iQ�l���f� E n t r u s t . n e t b C�Wt�>�_� �{��.kBs�Nm8A=:��9 6 04 + | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\ddfb16cd4931c973a2037d3fc83a4d7d775d05e4::blob | x�` /���7�S.uI 0 N��K���j8�XCPx �c,j��C�7�Mf �6o�TTJ�h� �91�~�S @ 0>0 `�H��l00 +�7< �0g� 00 +�7< � 4 02+++++ 2 D i g i C e r t | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\ddfb16cd4931c973a2037d3fc83a4d7d775d05e4::blob | \ �� y��,��Up��7� ��I1�s�}?�:M}w]� �mƢ3�3���AI'�Y ����q]dL�.g?纘� Ob U/{�l�rO��r@ǎv���� ș� 2 D i g i C e r t T r u s t e d R o o t G 4 4 02 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\lavasoft\web companion::machineid | 268ddfeb-393b-01ab-2937-4e66db5d0964 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 鍑ꘇ暖ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ᗭⰹ汻ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 쓭㌨渖ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䜄濶ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 鞣닿瀭ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ܗ䦝畯ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� �LG=�A��J� �C� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� � ��n��� � <��� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k ; 8�jg �v �� T��� ����Bx #��$kF&� (�(X�)�`*J-!R1�1HO @V� G�IH�pb"hc�zh�rj�bk`k�ql(�lR q�Xr�BtǤvy��P� �/�����b:��� �6�X���.�a ���j�� [�m� Ù� �]� �gi�=��$�a��8���V �Κ����j | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver | C:\ProgramData\Synaptics\Synaptics.exe | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k < 8�jg �v �� T��� ����Bx #��$kF&� (�(X�)�`*J-!R1�1HO @V� G�IH�pb"hc�zh�rj�bk`k�ql(�lR q�Xr�BtǤvy�w�n�P� �/�����b:��� �6�X���.�a ���j�� [�m� Ù� �]� �gi�=��$�a��8���V �Κ�� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k = 8�jg �v �� T��� ����Bx #��$kF&� (�(X�)�`*J-!R1�1HO @V� G�IH�pb"hc�zh�rj�bk`k�ql(�lR q�Xr�BtǤvy�w�n�P� �/�����b:��� �6�X���.� ��a ���j�� [�m� Ù� �]� �gi�=��$�a��8���V �Κ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 鲫 ȁ ਪˣ 鈯ˣ 遙̃ 豤̃ অˣ 炑̃ 龡^ 濖̃ 賬̃ 獖} 偫~ 엦1 ˣ 邯̃ 뫯ʃe ꙥ ¶i ꙥr ֢v ꙥ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k C 8�jg �v �� �� T��� ����Bx #��$kF&� (�(X�)�`*J-!R1�1HO @V� G�IH�pb"hc�zh�rj�bk`k�ql(�lR q�Xr�BtǤvy�w�n�P� �/������7� M�b:��� �6�X���.� ��a ���j�� [�m� Ù� �]� �IV �gi�=��$�a� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k D 8�jg �v �� �� T��� ����Bx #��$kF&� (�(X�)�`*J-!R1�1HO @V� G�IH�pb"hc�zh�rj�bk`k�ql(�lR q�Xr�7r�BtǤvy�w�n�P� �/������7� M�b:��� �6�X���.� ��a ���j�� [�m� Ù� �]� �IV �gi�=��$ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� ]T�� �B�����wȜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX � ��n��� � <�� ]T�� �B�����wȜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k � 8��81��B�8 �6 �v y� �Z xy �� �a ۀT��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� /�� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX � ��n��� � <�� N:��� 3B��SWsԄI� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | � xy * � /�� Y� d� kP~ � � �ރ �p ��^ �o � ee: Vs} kP~ ��1 3 �� 7 � �� ﺃ e e�� � ��1 �� f e�� g � | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀ�� T��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | k 8��81��B�8 �6 �v y� �Z xy �� �a ۀ�� T��� B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꌿ矍銫ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ﮹㾛늾ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | �bX��� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� � ��n��� � <��� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Ol % �v�� ����Bx (�1`1�1HO @V� A��H[uN$_�zk`k�q{b��P� ��!���� � ��3�� ��� ������m� Ù� �V ����$�8წ���V �l� �&M �~ �=�SB1_ T�Vw���%�������� �AE��D��&��$���L A *�" C �� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX N:��� 3B��SWsԄI� � ��n��� � <��� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Pl & �v�� ����Bx (�1`1�1HO @V� A��H[uN$_�zk`k�qw�n{b��P� ��!���� � ��3�� ��� ������m� Ù� �V ����$�8წ���V �l� �&M �~ �=�SB1_ T�Vw���%�������� �AE��D��&��$���L A *�" C | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Ql ' �v�� ����Bx (�1`1�1HO @V� A��H[uN$_�zk`k�qw�n{b��P� ��!���� � ��3�� ��� ������ ��m� Ù� �V ����$�8წ���V �l� �&M �~ �=�SB1_ T�Vw���%�������� �AE��D��&��$���L A *�" | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 陋 ȁ 獖} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Rl - �v�� �� ����Bx (�1`1�1HO @V� A��H[uN$_�zk`k�qw�n{b��P� ��!�����7� � ��3� M�� ��� ������ ��m� Ù� �IV �V ����$�8წ���V �l� �&M�(!��j �~ � �=�SB1_ T�Vw�`�V��%�������� �A | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Sl . �v�� �� ����Bx (�1`1�1HO @V� A��H[uN$_�zk`k�qr�7w�n{b��P� ��!�����7� � ��3� M�� ��� ������ ��m� Ù� �IV �V ����$�8წ���V �l� �&M�(!��j �~ � �=�SB1_ T�Vw�`�V��%������� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Tl . �v�� �� ����Bx (�1`1�1HO @V� A��H[uN$_�zk`k�qr�7w�n{b��P� ��!�����7� � ��3� M�� ��� ������ ��m� Ù� �IV �V ����$�8წ���V �l� �&M�(!��j �~ � �=�SB1_ T�Vw�`�V�R� ��%���� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | Ⲏᒛǝ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| Encryption Used |
|
| User Data Access |
|
| Anti Debug |
|
| Other Suspicious |
|
| Process Manipulation Evasion |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
| Syscall Use |
Show More
|
| Service Control |
|
| Network Wininet |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
.\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN231001 --nonadmin --direct --tych --campaign=19897137492 --version=10.901.2.519
|
C:\WINDOWS\system32\fondue.exe "C:\WINDOWS\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
|
.\WebCompanion-Installer.exe --savename=Setup_WebCompanion.exe --partner=IN230403 --nonadmin --direct --tych --campaign=19954005342 --version=11.907.0.802
|
.\WebCompanionInstaller.exe --savename=Setup_WebCompanion.exe --partner=IN230401 --nonadmin --direct --campaign=16075236377 --version=10.901.2.519
|
.\WebCompanionInstaller.exe --savename=Setup_WebCompanion.exe --partner=IN230401 --nonadmin --direct --tyff --campaign=20290905988 --version=10.901.2.519
|
Show More
.\WebCompanionInstaller.exe --prod
|
.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN231001 --nonadmin --direct --tyed --campaign=19904337827 --version=12.901.4.1003
|
.\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tyff --campaign=20286318653 --version=10.901.2.519
|
.\WebCompanionInstaller.exe --savename=WcInstaller.exe --partner=IN220101 --nonadmin --direct --tych --campaign=20307634210 --version=11.904.0.689
|
"C:\Users\Wvmfrpfm\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 8496" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "8496"
|
C:\WINDOWS\system32\timeout.exe timeout 5
|
WriteConsole:
Waiting for 5
|
WriteConsole: seconds, press
|
.\WebCompanionInstaller.exe --savename=Setup_WebCompanion.exe --partner=IN230402 --nonadmin --direct --tych --campaign=18022583703 --version=10.901.2.519
|
"C:\Users\Czlridxy\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 6136" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "6136"
|
"C:\Users\Emgcvmbk\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 9060" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "9060"
|
WriteConsole: 0834
|
WriteConsole: 0833
|
"C:\Users\Arkwqmke\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 3304" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "3304"
|
.\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN230901 --nonadmin --direct --tych --campaign=17923320442 --version=10.901.2.519
|
"C:\Users\Wdvcxcnw\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 4164" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "4164"
|
.\WebCompanionInstaller.exe --savename=Setup_WebCompanion.exe --partner=IN220101 --nonadmin --direct --tyed --campaign=19746138190 --version=11.904.0.689
|
"C:\Users\Koqusvug\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 4648" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "4648"
|
runas c:\users\user\downloads\._cache_5d71def60dce96f93b8f84d6845c6ee0f035ce19_0001573888
|
runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate
|
.\WebCompanionInstaller.exe --savename=Setup_WebCompanion.exe --partner=IN220101 --nonadmin --direct --tych --campaign=19733658126 --version=10.901.2.519
|
runas c:\users\user\downloads\._cache_855add33954b0a100971c10984488b22a3c2cb99_0001307136
|
.\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --campaign=19746138190 --version=10.901.2.519
|
"C:\Users\Zhuquxrq\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 5808" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "5808"
|
.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN230901 --nonadmin --direct --campaign=20541619131 --version=12.901.4.1003
|
"C:\Users\Hzxznevn\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 5820" /fo csv
|
.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN230403 --nonadmin --direct --tyff --campaign=20286318653 --version=11.907.0.802
|
.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tych --campaign=21007111631 --version=11.908.5.907
|
.\WebCompanionInstaller.exe --partner=IN220101 --nonadmin --direct --tych --campaign=20303113172 --version=11.904.0.689
|
"C:\Users\Yatvxbao\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 8640" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "8640"
|
.\WebCompanion-Installer.exe --savename=Setup_WebCompanion.exe --partner=IN220101 --nonadmin --direct --tych --campaign=20398356463 --version=11.907.0.807
|
runas c:\users\user\downloads\._cache_18829550f8ed53e46a1aa81bbb00b4ba217da4c8_0001307136
|
.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tych --campaign=20286318653 --version=11.907.0.807
|
.\WebCompanionInstaller.exe --partner=CH210702 --version=9.1.0.409
|
"C:\Users\Omrvqktc\AppData\Local\Temp\WC.bat"
|
C:\WINDOWS\system32\tasklist.exe tasklist /FI "PID eq 4152" /fo csv
|
C:\WINDOWS\system32\find.exe find /I "4152"
|
