PUA.Win32.WebCompanion.AW

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• .\installer.exe
• "%User Temp%\7zS8FB90A0A\GenericSetup.exe" %User Temp%\7zS8FB90A0A\GenericSetup.exe
• %User Temp%\7zS8FB90A0A\GenericSetup.exe %User Temp%\7zS8FB90A0A\GenericSetup.exe
• "%System%\cmd.exe" /C ""%User Temp%\4nhzcjme.et5.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCLOSEAPPLICATIONS /TID=lavasoft /PROFILE=lavasoft /CHANNEL=lavasoft /SID=UT"
• "%System%\cmd.exe" /C ""%User Temp%\icw20one.g4h.exe" --silent --homepage=1 --search=1 --partner=BT170602"
• "%User Temp%\4nhzcjme.et5.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCLOSEAPPLICATIONS /TID=lavasoft /PROFILE=lavasoft /CHANNEL=lavasoft /SID=UT
• "%User Temp%\is-BO6CR.tmp\4nhzcjme.et5.tmp" /SL5="$102B0,48494708,225280,%User Temp%\4nhzcjme.et5.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCLOSEAPPLICATIONS /TID=lavasoft /PROFILE=lavasoft /CHANNEL=lavasoft /SID=UT
• "schtasks" /delete /tn "WebDiscover Browser Launch Task" /f
• "schtasks" /delete /tn "WebDiscover Browser Update Task" /f
• "schtasks" /delete /tn "WebDiscover Launch Task" /f
• "schtasks" /delete /tn "WebDiscover Update Task" /f
• "sc" delete wdsvc
• "schtasks" /create /ru SYSTEM /tn "WebDiscover Browser Launch Task" /tr "\"%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe\" --launch --docked" /sc onlogon /f
• "schtasks" /create /ru SYSTEM /tn "WebDiscover Browser Update Task" /tr "\"%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe\" --update" /sc daily /ri 120 /du 24:00 /f
• "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe" --update
• "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe" --docked
• "%User Temp%\icw20one.g4h.exe" --silent --homepage=1 --search=1 --partner=BT170602
• .\WebCompanionInstaller.exe --partner=BT170602 --version=4.9.2159.4024 --prod --silent --homepage=1 --search=1 --partner=BT170602
• dw20.exe -x -s 1296
• "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe" --type=crashpad-handler "--user-data-dir=%AppDataLocal%\WebDiscoverBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=%AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad" "--metrics-dir=%AppDataLocal%\WebDiscoverBrowser\User Data" --annotation=plat=Win32 --annotation=prod=WebDiscover --annotation=ver=63.0.3239.132-devel --initial-client-data=0xe4,0xf4,0xf8,0xe8,0xfc,0x734b9950,0x734b9928,0x734b9938
• "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe" --type=crashpad-handler "--user-data-dir=%AppDataLocal%\WebDiscoverBrowser\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=%AppDataLocal%\WebDiscoverBrowser\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=%AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad" "--metrics-dir=%AppDataLocal%\WebDiscoverBrowser\User Data" --annotation=plat=Win32 --annotation=prod=WebDiscover --annotation=ver=63.0.3239.132-devel --initial-client-data=0xe8,0xe4,0xf4,0xf0,0xf8,0x734b9950,0x734b9928,0x734b9938
• "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe" --type=crashpad-handler "--user-data-dir=%AppDataLocal%\WebDiscoverBrowser\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=%AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=WebDiscover --annotation=ver=63.0.3239.132-devel --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x6f0cd0,0x6f0ca8,0x6f0cb8

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Temp%\7zS8FB90A0A
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB
• %All Users Profile%\Lavasoft\Web Companion\Options
• %All Users Profile%\Lavasoft\Web Companion
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\swiftshader
• %Application Data%\Microsoft\CLR Security Config
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\Files
• %System Root%\Users
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB
• %User Profile%\AppData
• %AppDataLocal%\WebDiscoverBrowser\User Data
• %AppDataLocal%\WebDiscoverBrowser\User Data\BrowserMetrics
• %AppDataLocal%\WebDiscoverBrowser
• %User Temp%\7zS8FB90A0A\fr
• %User Temp%\7zS8FB90A0A\it
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default
• %User Temp%\7zS8FB90A0A\de
• %Application Data%\Microsoft\CLR Security Config\v2.0.50727.312
• %AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb
• %User Temp%\7zS8FB90A0A\es
• %User Temp%\7zS8FB90A0A\en
• %User Temp%\is-CN70L.tmp\_isetup
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2
• %System Root%\Program Files\WebDiscoverBrowser
• %AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad\reports
• %All Users Profile%\Lavasoft
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales
• %User Temp%\7zS8FB90A0A\pt
• %AppDataLocal%\WebDiscoverBrowser\User Data\Safe Browsing
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data
• %User Temp%\7zS8FB90A0A\ru

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Potentially Unwanted Application adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WebDiscoverBrowser = "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe --docked"

Other System Modifications

This Potentially Unwanted Application modifies the following file(s):

• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\debug.log
• %AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad\settings.dat

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It deletes the following files:

• %System Root%\Program Files\WebDiscoverBrowser\WebDiscover Browser.pif
• %User Temp%\7zS8FB90A0A
• %System Root%\Program Files\WebDiscoverBrowser\WebDiscover Browser.url
• %AppDataLocal%\WebDiscoverBrowser\User Data\CrashpadMetrics-spare.pma

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\{{GUID}}
1570359510 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
version = "4.28.2"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
wd_path = "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
tracking_id = "lavasoft"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
sub_id = "UT"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
channel = "lavasoft"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
profile = "lavasoft"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
install_time = "1570359510"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
default_browser = ""

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
split = "a"

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
pixel_url = ""

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
cd = ""

HKEY_LOCAL_MACHINE\SOFTWARE\WebDiscoverBrowser
cr = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: Setup Version = "5.5.9 (u)"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: App Path = "%System Root%\Program Files\WebDiscoverBrowser"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
InstallLocation = "%System Root%\Program Files\WebDiscoverBrowser"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: Icon Group = "WebDiscover Browser"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: User = "{username}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: Language = "en"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
DisplayName = "WebDiscover Browser 4.28.2"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
DisplayIcon = "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
UninstallString = "%System Root%\Program Files\WebDiscoverBrowser\unins000.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
QuietUninstallString = "%System Root%\Program Files\WebDiscoverBrowser\unins000.exe /SILENT"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
DisplayVersion = "4.28.2"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Publisher = "WebDiscover Media"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
URLInfoAbout = "http://{BLOCKED}discover.com"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
NoModify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
NoRepair = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
InstallDate = "20191006"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
MajorVersion = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
MinorVersion = "28"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
VersionMajor = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
VersionMinor = "28"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
EstimatedSize = "155782"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: Setup Version = "5.5.9 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: App Path = "%System Root%\Program Files\WebDiscoverBrowser"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
InstallLocation = "%System Root%\Program Files\WebDiscoverBrowser"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: Icon Group = "WebDiscover Browser"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
DisplayName = "WebDiscover Browser 4.28.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
DisplayIcon = "%System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
UninstallString = "%System Root%\Program Files\WebDiscoverBrowser\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
QuietUninstallString = "%System Root%\Program Files\WebDiscoverBrowser\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
DisplayVersion = "4.28.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
Publisher = "WebDiscover Media"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
URLInfoAbout = "http://{BLOCKED}discover.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
InstallDate = "20191006"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
MajorVersion = "4"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
MinorVersion = "28"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
VersionMajor = "4"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
VersionMinor = "28"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{{GUID}}_is1
EstimatedSize = "155782"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Lavasoft\Web Companion
MachineId = ""

HKEY_CURRENT_USER\Software\WebDiscoverBrowser
UsageStatsInSample = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
WebDiscoverBrowser
usagestats = "0"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser
metricsid = ""

HKEY_CURRENT_USER\Software\WebDiscoverBrowser
metricsid_installdate = "0"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser
metricsid_enableddate = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
WebDiscoverBrowser\FirstNotDefault
S-1-5-21-2407829820-1079796033-203259571-500 = "\x19\xfb\xb3z\xd2\xf2.\x00"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
search_provider_overrides = "F7DD132D0A09C20B304762B3855451CE83581D2E745784077A5217DCB548B0B1"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
default_search_provider_data.template_url_data = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
browser.show_home_button = "198C46820A0C2A02F142D5D03F3EC61C556FDB45B89FE6B26D422548D4868886"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
media.storage_id_salt = "BC8C09EDD7B6822356F4736DA9CD7E5FD1989FC249A236F232D21D14CB3C8C44"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
homepage = "DAB161EFDDC141318D319B0C6B19DACAE8E538A14571A0D9401CE8452DA9917E"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
homepage_is_newtabpage = "092516C1C09CCE35F21BDF0C2030F98EF169572EE67598E5BC965BE267344DE3"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
google.services.account_id = "227CF9B4CBCF5A30F214874136362C104493B79E0F9D6F76725D91150D06BE18"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
google.services.last_username = "3B755230DCC0D5C155A2496F5643816738663624FEEDA6E0DB6E9BB4B52ADD75"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
session.startup_urls = "85B460B76B12C5C1E893F0E0D3F7FAA74B8295583E8A66CF606E973DA19A8877"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
session.restore_on_startup = "1F0789230764D1AB251A5BEC58E32C6D64DEB0E38A1ADAF4E46D51E111170241"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
pinned_tabs = "BD6DABF8B43E14477540E620885461A2F392FA6E6045BA7A513B5E847079C8E7"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
prefs.preference_reset_time = "E7D02842BD45C08FE759AAADE5BF61F9DC0F6DAEFBFC744903F7FFA873BA2BC5"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
safebrowsing.incidents_sent = "A0C61791A10914120B9303E8736997E8102935691EF57E9CEB3C1C19F700F1B0"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
software_reporter.prompt_version = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
google.services.username = "AE844FC1C70FB075A1D2711762556EFBEC9E7DF3413436C10A97C7FF4E4FF23E"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
software_reporter.prompt_seed = "F2C39D4BD46860173CB66F26572523453D71AE5CAF2BDE708BA387E2056E22BF"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
google.services.last_account_id = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
settings_reset_prompt.prompt_wave = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default\extensions.settings
bepbmhgboaologfdajaanbcjmnhjmhfn = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default\extensions.settings
mfehgcgbbipciphmccgaenjidiccnmng = "{random characters}"

HKEY_CURRENT_USER\Software\WebDiscoverBrowser\
PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai = "{random characters}"

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run\
WebDiscover Browser

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run\
WebDiscoverBrowser

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run\
WebDiscover

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\
WebDiscover Browser

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\
WebDiscoverBrowser

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\
WebDiscover

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-33OMS.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-QO76V.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\it.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB\CURRENT
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-H603M.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-CRUVT.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\et.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB\LOG
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-FOLQE.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\am.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Preferences~RF21251b4.TMP
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-06PR1.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\swiftshader\is-4D0S5.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-8BG42.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Web Data
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB\LOG
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\pt-PT.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-KKRLU.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\chrome_200_percent.pak
• %User Temp%\7zS8FB90A0A\pt\DevLib.resources.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\swiftshader\libGLESv2.dll
• %AppDataLocal%\WebDiscoverBrowser\User Data\Local State
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-EG483.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-1AAJP.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-K5339.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\previews_opt_out.db-journal
• %AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad\reports\{GUID}.dmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-GAN85.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ko.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-TRGST.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-2KL1A.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-KJM1T.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\kn.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-S1GGA.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\{GUID}.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\resources.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Top Sites-journal
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\nacl64.exe
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB\000003.log
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB\CURRENT
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\{GUID}.tmp
• %User Temp%\7zS8FB90A0A\GenericSetup.exe.config
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-2B3R2.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-0MMVS.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\th.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\vi.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-49QE9.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ru.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-50D8B.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-LI70S.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Safe Browsing Cookies
• %User Temp%\7zS8FB90A0A\GenericSetup.exe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\id.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB\000003.log
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\CURRENT
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-P9AVJ.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-5V5HM.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-VB0G8.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ro.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\snapshot_blob.bin
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\icudtl.dat
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\chrome_child.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-0Q2D7.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\pt-BR.pak
• %User Temp%\7zS8FB90A0A\installer.exe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-K2V7T.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-KDN92.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\nacl_irt_x86_32.nexe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\fi.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\pl.pak
• %User Temp%\7zS8FB90A0A\en\DevLib.resources.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ta.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\v8_context_snapshot.bin
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-OMNO1.tmp
• %User Temp%\4nhzcjme.et5.exe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\lv.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ml.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-2PP8C.tmp
• %User Temp%\7zS8FB90A0A\en
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\libGLESv2.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-LBJA7.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-KVSGF.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Favicons
• %User Temp%\7zS8FB90A0A\pt
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB\MANIFEST-000001
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\debug.log
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\hi.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-GSPES.tmp
• %User Temp%\7zS8FB90A0A\2019.10.06_10.57.54.148009_installer_pid=376.txt
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\sw.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Google Profile.ico
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\chrome_100_percent.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Secure Preferences
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-GALSG.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\000003.log
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\sk.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\cs.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB\000001.dbtmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-2MOJO.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\master_preferences
• %System Root%\Program Files\WebDiscoverBrowser\is-0NFN1.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-GCG1M.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\lockfile
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Login Data-journal
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-JMMF9.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-BCQPI.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Web Data-journal
• %AppDataLocal%\GDIPFONTCACHEV1.DAT
• %AppDataLocal%\WebDiscoverBrowser\User Data\CrashpadMetrics-active.pma
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\en-US.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails\CURRENT
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ar.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails\LOG
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-E81KT.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\libEGL.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\en-GB.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-65LA1.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-GAF4S.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-8IRUP.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-F7H00.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\zh-CN.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-MULD6.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB\LOCK
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\zh-TW.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-6MULH.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\d3dcompiler_47.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-036G4.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Download Service\EntryDB\LOCK
• %AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad\metadata
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-7V6FM.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-BO087.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Preferences~RF201fd78.TMP
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\de.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-84HLT.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Visited Links
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\bg.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\BrowserMetrics-active.pma
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails\MANIFEST-000001
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-UC7KP.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\nacl_irt_x86_64.nexe
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails\LOCK
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\hr.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\BrowserMetrics-spare.pma
• %User Temp%\xc2\xb5torrentWeb.log
• %User Temp%\icw20one.g4h.exe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\mr.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-Q8E0N.tmp
• %User Temp%\7zS8FB90A0A\Carrier.exe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\chrome_elf.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-8D3KL.tmp
• %User Temp%\7zS8FB90A0A\it\DevLib.resources.dll
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Secure Preferences~RF2111914.TMP
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\swiftshader\libEGL.dll
• %All Users Profile%\Lavasoft\Web Companion\Options\Statistics.txt
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\browser.exe
• %User Temp%\7zS8FB90A0A\es\DevLib.resources.dll
• %User Temp%\WcInstaller.log
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\te.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-CEJV8.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\swiftshader\is-0POOB.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\he.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-V0FQO.tmp
• %User Temp%\7zS8FB90A0A\fr\DevLib.resources.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-6I9U2.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\BrowserMetrics\BrowserMetrics-5D99C8F8.pma
• %AppDataLocal%\WebDiscoverBrowser\User Data\First Run
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\bn.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-6LNPD.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-9DP1C.tmp
• %System Root%\Program Files\WebDiscoverBrowser\unins000.exe
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-8RKA2.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-34GBO.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-240LT.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\da.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\gu.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Local State~RF201fd2a.TMP
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-HN1GR.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-OUP2Q.tmp
• %User Temp%\7zS8FB90A0A\ru\DevLib.resources.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-8DR7E.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF211dc64.TMP
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-PTN96.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails\000003.log
• %User Temp%\7zS8FB90A0A\fr
• %System Root%\Program Files\WebDiscoverBrowser\unins000.dat
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ja.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\History
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-609EI.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\LOCK
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\uk.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\el.pak
• %User Temp%\7zS8FB90A0A\Microsoft.Win32.TaskScheduler.dll
• %System Root%\Program Files\WebDiscoverBrowser\WebDiscover Browser.lnk
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-C2VI0.tmp
• %User Temp%\7zS8FB90A0A\es
• %User Temp%\7zS8FB90A0A\WizardPages.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-2QHSU.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\es-419.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\sv.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\previews_opt_out.db
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Thumbnails\000001.dbtmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Preferences
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\nl.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-LCFCO.tmp
• %User Temp%\7zS8FB90A0A\ru
• %User Temp%\7zS8FB90A0A\DevLib.dll
• %AppDataLocal%\WebDiscoverBrowser\User Data\BrowserMetrics-spare.pma.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\es.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Crashpad\settings.dat
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\sl.pak
• %User Temp%\7zS8FB90A0A\BundleConfig.xml
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\tr.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\chrome.dll
• %AppDataLocal%\WebDiscoverBrowser\User Data\CrashpadMetrics.pma
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\natives_blob.bin
• %AppDataLocal%\WebDiscoverBrowser\User Data\Safe Browsing Cookies-journal
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\History-journal
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\chrome_watcher.dll
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\lt.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-3Q620.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-D8TE6.tmp
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Login Data
• %User Temp%\7zS8FB90A0A\it
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Top Sites
• %User Temp%\7zS8FB90A0A\de
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Sync Data\LevelDB\000001.dbtmp
• %User Temp%\7zS8FB90A0A\de\DevLib.resources.dll
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\data_reduction_proxy_leveldb\LOG
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\63.0.3239.132.manifest
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\fr.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\fil.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-RBMMU.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\nb.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ms.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-O4VMO.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\ca.pak
• %AppDataLocal%\WebDiscoverBrowser\User Data\Default\Favicons-journal
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\sr.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\hu.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\fa.pak
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\is-JAPI3.tmp
• %System Root%\Program Files\WebDiscoverBrowser\4.28.2\Locales\is-M7LR4.tmp

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://sos.{BLOCKED}e.com/v1/offer/campaignFilter/?{random characters}
• http://flow.{BLOCKED}ft.com/v1/event-stat?ProductID=IS&Type=StubStart
• http://flow.{BLOCKED}ft.com/v1/event-stat?{random characters}
• http://{BLOCKED}panion.com/nano_download.php?partner=BT170602
• http://sdl.{BLOCKED}e.com
• http://update.{BLOCKED}coverbrowser.com
• http://api.{BLOCKED}n.io
• http://www.{BLOCKED}c.com
• http://ssl.{BLOCKED}c.com
• http://{BLOCKED}discover.com
• http://{BLOCKED}-safely.com
• http://report-uri.{BLOCKED}lare.com
• http://translate.{BLOCKED}apis.com

This report is generated via an automated analysis system.