EchoTrail

Web Companion 14.5.31.49849

by Lavasoftinstaller signed by LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.)Valid

Sources: observed in the EchoTrail lab on Windows 11 on October 29, 2026.

The install

Installer
webcompanioninstaller.exe
Installed through
the screenshot-and-model clicker
Install directory
C:\Program Files (x86)\Lavasoft
Launched
WebCompanion.exe
Windows
Windows 11
Date
October 29, 2026
Executables dropped
187

installer sha256 6157bb210c92b7a55822162cbe09bd4c2eb05003cce9014797d62dc0911072fe

The lab used Web Companion for 2 minutes, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Web Companion's own windows.

Web Companion 14.5.31.49849: First window
First window. Web Companion dashboard is shown with a restart-required banner and a disabled web protection status.
Web Companion 14.5.31.49849: Main window
Main window. The About view of Adaware Web Companion shows version info, with a sidebar listing Dashboard, scanners, My Protection, Settings, Feedback.
Web Companion 14.5.31.49849: Settings
Settings. Settings view of Adaware Web Companion showing language and three toggles, all enabled.

What it dropped

Executables

  • cstsdk.dllsigned by CN=Bitdefender SRL, OU=DEVSUP LABS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\cstsdk.dll
    sha256 d6751b8f79197229df96bd3b26537149ddd800f5af4c939cb21b259ad4908d0e
  • cstsdk.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\cstsdk.dll
    sha256 397e60a1dd0f144c67819e94c754d40c4c07dd233be5c4fe99e24b606e0c7827
  • libguster.dllsigned by CN=Bitdefender SRL, OU=DEVSUP LABS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\libguster.dll
    sha256 d1a9a9dbdb36f4ca63bf1ef3e5a3d345b77829177199f3db6289e191fb07e5b7
  • libguster.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\libguster.dll
    sha256 ceca24fdb2149b0bdeb712baed05a29d9cc2f5c7bc4a19ba7bd5347bb6084035
  • wslib.dllsigned by CN=Bitdefender SRL, OU=DEVSUP LABS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\WSLib.dll
    sha256 70cb4a1a9b304df6d8e1136a0bde56495da739717688df3c899c2ca8295ab624
  • oemsdk.dllsigned by CN=Bitdefender SRL, OU=DEVSUP LABS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\oemsdk.dll
    sha256 153d22a5ced32d271aba9f99b9b759a9c8dd154f64606a3019a6075e30253379
  • oemsdk.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\oemsdk.dll
    sha256 a89ff370de061eea40e2a3dc5e2cdf927366816a9e34ad48eada836079ead8f6
  • wslib.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\WSLib.dll
    sha256 73bbe688109a7eb59ea67f1136f0cd7f4b085b6c6f5cf07bea686b883b00af71
  • bdnc.dllsigned by CN=Bitdefender SRL, OU=DEVSUP LABS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bdnc.dll
    sha256 f913ae739839a98d1c011088c9a708c04412987a6557d7c842e73ea1d3d11ec8
  • dciservice.exesigned by CN=LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.), O=LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.), L=Saint-Laurent, S=Quebec, C=CA, SERIALNUMBER=1166242868, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Quebec, OID.1.3.6.1.4.1.311.60.2.1.3=CAValidran during the lab session
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
    sha256 ab34f73e4ebe630dcecfabf72c8055e8f0e4bb300bcf3bbab56dc4771175bfeb
  • vsdk.dllsigned by CN=Bitdefender SRL, OU=DEVSUPP DRIVERS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vsdk.dll
    sha256 0db418e8d7b407caffb3f0e40d3715de95c4a7d41c6eb580dc77ec63c9b5411d
  • bdnc.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\bdnc.dll
    sha256 778f4cfdd07536b44a07b442207030a2125615643ab437c06112fc0cbead605c
  • vsdk.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\vsdk.dll
    sha256 29194d8966a4a2f6c892d4829c306f572d588d9eb9b0abbb8a5a2a9fe4e36ebb
  • dciservice.exe
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\DCIService.exe
    sha256 ac65f5d90994f9ac644f4710fede7d55f6f0bd6a4b806382c0ea7d6f1638d31f
  • lavasoft.companion.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Companion.dll
    sha256 4d349ebbf0f931fd779dccc023b993c3b6ecb6c11f1f5dc9f95617eb2c468f7b
  • mitm_install_tool_dci.exesigned by CN=Bitdefender SRL, OU=DEVSUP LABS, O=Bitdefender SRL, L=Bucharest, C=ROValidran during the lab session
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\mitm_install_tool_dci.exe
    sha256 52f86fd85adbf72322dba04aeb1759069e85d890798aa9c4c287c7765d344554
  • mitm_install_tool_dci.exe
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\mitm_install_tool_dci.exe
    sha256 1e6c3d017adc4b8feb63693df6ddd5e3ce73fa8ec4f3f0c6f502898a83b12527
  • vlflt.syssigned by CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vlflt.sys
    sha256 bde372760ce17347365ce53db8aa83769f66376ce7c9e00045024c828fc8e525
  • bddci4.syssigned by CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci4.sys
    sha256 65631ccf1d4a3fcd089e15cc74a9b95b66feda043d246a7420a85a7403f520e7
  • ucrtbase.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\ucrtbase.dll
    sha256 f3f8c443d2af8d03ecf1de83f4df65a0346d3e38b5057e02c474494a1dd13cf5
  • vlflt.sys
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\vlflt.sys
    sha256 05f1cb4c0529a98b03dab55730d893486fbca78ca89017dd235aaba64f953e74
  • sqlite.interop.dllsigned by CN=LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.), O=LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.), L=Saint-Laurent, S=Quebec, C=CA, SERIALNUMBER=1166242868, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Quebec, OID.1.3.6.1.4.1.311.60.2.1.3=CAValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll
    sha256 e98a8c66c338f991924f4fc34e9234e04d9392849cd3ad748b88d3dcb9328753
  • bddci4.sys
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\bddci4.sys
    sha256 d2cde49859bb8f01cc7b6661d5d5dcdf6eb30bb52a4b8a3d73a888a6e5a2fe48
  • ucrtbase.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\ucrtbase.dll
    sha256 d9ec16e7ccae05099f04b078e290e6ad5562a0dbd2fd43881943bb8b7b62c3bc
  • messaging_ipc.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\messaging_ipc.dll
    sha256 0397ef496189ba749612b892df207743c68a2ce5f31fccb430f664e14d33dcee
  • bddci_core4.dllsigned by CN=Bitdefender SRL, OU=DEVSUPP DRIVERS, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci_core4.dll
    sha256 39296ec87b27aeac0c1f41df6ce604d31a769ff1760835e102c5a3a7a1d1d50e
  • bddci_core4.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\bddci_core4.dll
    sha256 710580176290f3a5923f7c86cbb817517a4092dba82e1be13243f90efc220db8
  • messaging_ipc.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\messaging_ipc.dll
    sha256 81428fa9fb9ea92578d8cca6a3e14a01712306d6136a54112653d5980df05930
  • sqlite.interop.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll
    sha256 5497dc9bc8378eae6fbcd25fefba82e786c363fe1ec063e475a43861b4ffb49b
  • messaging.dllsigned by CN=Bitdefender SRL, OU=Devsupp Test, O=Bitdefender SRL, L=Bucharest, C=ROValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\messaging.dll
    sha256 2b14fe3a950e173ddc3fb959277ae0bea37fedd401cb539774f5df7e8d3f0529
  • newtonsoft.json.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
    sha256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
  • messaging.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\messaging.dll
    sha256 e9f9af0b4e199fd687b554e7039dcf6ce8b319c81533973918754909ee63a1e2
  • msvcp140.dllsigned by CN=Microsoft Windows Software Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\msvcp140.dll
    sha256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
  • wcinstaller.exesigned by CN=LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.), O=LAVASOFT SOFTWARE CANADA (7270356 CANADA INC.), L=Saint-Laurent, S=Quebec, C=CA, SERIALNUMBER=1166242868, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Quebec, OID.1.3.6.1.4.1.311.60.2.1.3=CAValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\WCInstaller.exe
    sha256 6157bb210c92b7a55822162cbe09bd4c2eb05003cce9014797d62dc0911072fe
  • msvcp140.dllsigned by CN=Microsoft Windows Software Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\msvcp140.dll
    sha256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
  • lavasoft.notifications.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Notifications.dll
    sha256 75fcc97ebc0ba4ee8ebfdd043a8fa6c6e57bd9fdead6a1dae052dd86ea709e4f
  • wsutils.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\WSUtils.dll
    sha256 41d87e72d1bfd669494b2c80bbab208c86572ecb7bb8afa542a16384db905ac0
  • wsutils.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\win32\WSUtils.dll
    sha256 a8c1b7bd27a8fa73e0510a4b570a5772a9824bccd3fc9d0d19c8ee01595c5feb
  • vccorlib140.dll
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\vccorlib140.dll
    sha256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
  • concrt140.dllsigned by CN=Microsoft Windows Software Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\concrt140.dll
    sha256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376

Drivers

  • vlflt
  • BdDci4

Services

  • CompanionService (Auto)C:\Program Files (x86)\Lavasoft\Web Companion\Application\CompanionService.WinService.exe
  • DCIService (Auto)C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe

Run keys

  • Web CompanionC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize

After the reboot

Started on its own

  • webcompanion.exe started by explorer.exe

Autostart entries

  • run key: Web CompanionC:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
  • service: CompanionServiceC:\Program Files (x86)\Lavasoft\Web Companion\Application\CompanionService.WinService.exe
  • service: DCIServiceC:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe

What it talked to

Destinations

  • 34.117.13.33:443asked by dciservice.exe12 connections
  • 104.16.149.130:443asked by webcompanion.exe5 connections
  • 34.117.254.173:443asked by dciservice.exe5 connections
  • 34.120.85.253:443asked by dciservice.exe4 connections
  • 104.16.149.130:443asked by webcompanioninstaller.exe3 connections
  • 104.16.148.130:443asked by webcompanioninstaller.exe2 connections
  • 104.18.26.149:443asked by webcompanion.exe2 connections
  • 104.18.27.149:443asked by webcompanion.exe2 connections
  • 104.18.27.149:443asked by webcompanioninstaller.exe2 connections
  • 127.0.0.1:53105asked by dciservice.exe2 connections
  • 127.0.0.1:53103asked by dciservice.exe2 connections
  • 127.0.0.1:53130asked by dciservice.exe2 connections
  • 127.0.0.1:53133asked by dciservice.exe2 connections
  • 127.0.0.1:50827asked by dciservice.exe2 connections
  • 23.217.9.73:443asked by dciservice.exe2 connections
  • 104.16.148.130:443asked by webcompanion.exe
  • 104.16.212.94:443asked by webcompanion.exe
  • 104.16.213.94:443asked by webcompanion.exe
  • 104.18.26.149:443asked by companionservice.winservice.exe
  • 104.18.27.149:443asked by companionservice.winservice.exe
  • 104.19.159.224:443asked by webcompanion.exe
  • 104.19.208.152:443asked by webcompanion.exe
  • 23.215.223.142:443asked by dciservice.exe
  • 23.53.127.174:443asked by dciservice.exe
  • 64.18.87.82:443asked by webcompanion.exe

DNS

  • flwadw.comasked by webcompanion.exe
  • avanquest-2a28367b-4e34-46a7-94ff-d7feb50efe64.2d7dd.cdn.bitdefender.netasked by dciservice.exe
  • featureflags.lavasoft.comasked by webcompanion.exe
  • elb-nvi-gcp.nimbus.bitdefender.netasked by dciservice.exe
  • elb-ore-gcp.nimbus.bitdefender.netasked by dciservice.exe
  • flwadw.comasked by companionservice.winservice.exe
  • nimbus.bitdefender.netasked by dciservice.exe
  • us.nimbus.bitdefender.netasked by dciservice.exe
  • acscdn.lavasoft.comasked by webcompanion.exe
  • acscdn.lavasoft.comasked by webcompanioninstaller.exe
  • acs.lavasoft.comasked by webcompanioninstaller.exe
  • acs.lavasoft.comasked by webcompanion.exe
  • ecm.adaware.comasked by webcompanion.exe
  • featureflags.lavasoft.comasked by webcompanioninstaller.exe
  • flwadw.comasked by webcompanioninstaller.exe
  • geo.lavasoft.comasked by webcompanion.exe
  • geo.lavasoft.comasked by webcompanioninstaller.exe
  • partners.webcompanion.comasked by webcompanion.exe
  • sg-bitmask.adaware.comasked by webcompanion.exe
  • wcdownloader.lavasoft.comasked by webcompanioninstaller.exe
  • wc-partners.lavasoft.comasked by webcompanion.exe
  • webcompanion.comasked by webcompanion.exe