69150d79edd91e8474af86f2a559359ca0de40e8ecf626ab524e59fd728474cc

Analysis

max time kernel
104s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

onestartpdfdirect.msi
Size

3.8MB
MD5

904366068865fa2d5ce89b23afc4f065
SHA1

8542dfd1a378928a507e56c7ba07adf8c45f1373
SHA256

f7d5e33b15325633b1bd6f1628b0c28f8a94517ad8f77614390f7538fae9eee6
SHA512

7823507afdc8783945eef59c5bd6fb78283e94b041fba7d468a7d4314800558b32712454ad1f227c85e5142d214723152f9795c714fae3670d13c41ecd0b9ae2
SSDEEP

49152:dgTfz0A+biU50unDNyGAvmq6KGk/cHrOGGY8Wea/xwuy2QxNwCsec+4VGWSlnfYC:QKUvN6TkkHQ2tVvO3PfY4

Score

6^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneStartChromium = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --existing-window"	onestart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneStartUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --update"	onestart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneStartAutoLaunch_E782F387E217800A520B08130778A3F6 = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --no-startup-window --from-registry /prefetch:5"	onestart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneStartChromium = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --existing-window"	onestart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneStartUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --update"	onestart.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	5524	msiexec.exe
6	5524	msiexec.exe
8	5524	msiexec.exe
55	2768	MsiExec.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
55	2768	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	onestart.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	onestart.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	onestart.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	onestart.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	onestart.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	onestart.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 5 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	onestart.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	onestart.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	onestart.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	onestart.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	onestart.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe
File created	C:\Program Files\chrome_url_fetcher_5924_1161254519\oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3	onestart.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\_platform_specific\win_x64\widevinecdm.dll	onestart.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\manifest.json	onestart.exe
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe
File created	C:\Program Files\chrome_url_fetcher_7156_1843897788\oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3	onestart.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\_platform_specific\win_x64\widevinecdm.dll.sig	onestart.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\LICENSE	onestart.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\_metadata\verified_contents.json	onestart.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\manifest.fingerprint	onestart.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI5CB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB575.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E5FA047E-618C-43F5-85D8-F26180FD1CF5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB74D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b4f8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b4f8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB612.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB652.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB897.tmp	msiexec.exe

Executes dropped EXE 51 IoCs

pid	Process
3000	onestart_installer.exe
3820	setup.exe
4752	setup.exe
3752	setup.exe
3236	setup.exe
5924	onestart.exe
4624	onestart.exe
4008	onestart.exe
6008	onestart.exe
1412	onestart.exe
5552	onestart.exe
6260	onestart.exe
6272	onestart.exe
6356	onestart.exe
6364	onestart.exe
6408	setup.exe
6480	onestart.exe
6540	onestart.exe
6580	onestart.exe
6636	onestart.exe
6660	onestart.exe
6688	onestart.exe
5336	onestart.exe
4908	onestart.exe
7156	onestart.exe
6416	onestart.exe
4020	onestart.exe
2416	onestart.exe
5280	onestart.exe
5980	onestart.exe
2324	onestart.exe
6796	onestart.exe
6188	onestart.exe
5460	onestart.exe
2876	onestart.exe
4648	onestart.exe
1896	onestart.exe
448	onestart.exe
6696	onestart.exe
320	onestart.exe
1640	onestart.exe
4984	onestart.exe
7036	onestart.exe
6636	onestart.exe
1128	onestart.exe
7120	onestart.exe
5224	onestart.exe
1424	onestart.exe
1256	onestart.exe
7012	MSI5CB7.tmp
4912	onestart.exe

Loads dropped DLL 64 IoCs

pid	Process
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
3968	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
5924	onestart.exe
4624	onestart.exe
4008	onestart.exe
5924	onestart.exe
1412	onestart.exe
6008	onestart.exe
1412	onestart.exe
6008	onestart.exe
6008	onestart.exe
6008	onestart.exe
6008	onestart.exe
6008	onestart.exe
6008	onestart.exe
6008	onestart.exe
5552	onestart.exe
5552	onestart.exe
6260	onestart.exe
6272	onestart.exe
6260	onestart.exe
6356	onestart.exe
6364	onestart.exe
6480	onestart.exe
6540	onestart.exe
6580	onestart.exe
6480	onestart.exe
6636	onestart.exe
6660	onestart.exe
6688	onestart.exe
6636	onestart.exe
5336	onestart.exe
4908	onestart.exe
5336	onestart.exe
7156	onestart.exe
6416	onestart.exe
7156	onestart.exe
4020	onestart.exe
2416	onestart.exe
4020	onestart.exe
2416	onestart.exe
4020	onestart.exe
4020	onestart.exe
4020	onestart.exe
4020	onestart.exe
4020	onestart.exe
4020	onestart.exe
5280	onestart.exe
5280	onestart.exe
5980	onestart.exe
2324	onestart.exe
6796	onestart.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5524	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI5CB7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009677f1a6e4fdfbc60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009677f1a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009677f1a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9677f1a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009677f1a600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	onestart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	onestart.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	onestart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	onestart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	onestart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	onestart.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	onestart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	onestart.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
5032	taskkill.exe
4416	taskkill.exe
7016	taskkill.exe
2896	taskkill.exe
5572	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	onestart.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879957927569421"	onestart.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.svg\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\ = "OneStart HTML Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\Application	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\ = "OneStart PDF Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.pdf	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.svg\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.xht\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\130.0.6723.139\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe,10"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\Application	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.htm	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.shtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.xhtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationName = "OneStart"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.html	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.xhtml\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.html\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.svg	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\Application\AppUserModelId = "OneStart.HYJFRHQG376INUNV6BGLCOTUPE"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.mhtml\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.webp\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\AppUserModelId = "OneStart.HYJFRHQG376INUNV6BGLCOTUPE"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\AppUserModelId = "OneStart.HYJFRHQG376INUNV6BGLCOTUPE"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.mhtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.htm\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.pdf\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe,0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationCompany = "OneStart.ai"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\CLSID	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\130.0.6723.139\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationName = "OneStart"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.html\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.pdf\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.mhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationCompany = "OneStart.ai"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\Application\AppUserModelId = "OneStart.HYJFRHQG376INUNV6BGLCOTUPE"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.htm\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.xht	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.webp	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.shtml\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.xhtml	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\OneStart.ai\\OneStart\\Application\\onestart.exe,11"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\Application\ApplicationDescription = "Access the Internet"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\.xht\OpenWithProgids\OSBHTML.HYJFRHQG376INUNV6BGLCOTUPE	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\OSBPDF.HYJFRHQG376INUNV6BGLCOTUPE\shell\open	setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3260	msiexec.exe
3260	msiexec.exe
5520	chrome.exe
5520	chrome.exe
7012	MSI5CB7.tmp
7012	MSI5CB7.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5524	msiexec.exe
Token: SeSecurityPrivilege	3260	msiexec.exe
Token: SeCreateTokenPrivilege	5524	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5524	msiexec.exe
Token: SeLockMemoryPrivilege	5524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5524	msiexec.exe
Token: SeMachineAccountPrivilege	5524	msiexec.exe
Token: SeTcbPrivilege	5524	msiexec.exe
Token: SeSecurityPrivilege	5524	msiexec.exe
Token: SeTakeOwnershipPrivilege	5524	msiexec.exe
Token: SeLoadDriverPrivilege	5524	msiexec.exe
Token: SeSystemProfilePrivilege	5524	msiexec.exe
Token: SeSystemtimePrivilege	5524	msiexec.exe
Token: SeProfSingleProcessPrivilege	5524	msiexec.exe
Token: SeIncBasePriorityPrivilege	5524	msiexec.exe
Token: SeCreatePagefilePrivilege	5524	msiexec.exe
Token: SeCreatePermanentPrivilege	5524	msiexec.exe
Token: SeBackupPrivilege	5524	msiexec.exe
Token: SeRestorePrivilege	5524	msiexec.exe
Token: SeShutdownPrivilege	5524	msiexec.exe
Token: SeDebugPrivilege	5524	msiexec.exe
Token: SeAuditPrivilege	5524	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5524	msiexec.exe
Token: SeChangeNotifyPrivilege	5524	msiexec.exe
Token: SeRemoteShutdownPrivilege	5524	msiexec.exe
Token: SeUndockPrivilege	5524	msiexec.exe
Token: SeSyncAgentPrivilege	5524	msiexec.exe
Token: SeEnableDelegationPrivilege	5524	msiexec.exe
Token: SeManageVolumePrivilege	5524	msiexec.exe
Token: SeImpersonatePrivilege	5524	msiexec.exe
Token: SeCreateGlobalPrivilege	5524	msiexec.exe
Token: SeCreateTokenPrivilege	5524	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5524	msiexec.exe
Token: SeLockMemoryPrivilege	5524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5524	msiexec.exe
Token: SeMachineAccountPrivilege	5524	msiexec.exe
Token: SeTcbPrivilege	5524	msiexec.exe
Token: SeSecurityPrivilege	5524	msiexec.exe
Token: SeTakeOwnershipPrivilege	5524	msiexec.exe
Token: SeLoadDriverPrivilege	5524	msiexec.exe
Token: SeSystemProfilePrivilege	5524	msiexec.exe
Token: SeSystemtimePrivilege	5524	msiexec.exe
Token: SeProfSingleProcessPrivilege	5524	msiexec.exe
Token: SeIncBasePriorityPrivilege	5524	msiexec.exe
Token: SeCreatePagefilePrivilege	5524	msiexec.exe
Token: SeCreatePermanentPrivilege	5524	msiexec.exe
Token: SeBackupPrivilege	5524	msiexec.exe
Token: SeRestorePrivilege	5524	msiexec.exe
Token: SeShutdownPrivilege	5524	msiexec.exe
Token: SeDebugPrivilege	5524	msiexec.exe
Token: SeAuditPrivilege	5524	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5524	msiexec.exe
Token: SeChangeNotifyPrivilege	5524	msiexec.exe
Token: SeRemoteShutdownPrivilege	5524	msiexec.exe
Token: SeUndockPrivilege	5524	msiexec.exe
Token: SeSyncAgentPrivilege	5524	msiexec.exe
Token: SeEnableDelegationPrivilege	5524	msiexec.exe
Token: SeManageVolumePrivilege	5524	msiexec.exe
Token: SeImpersonatePrivilege	5524	msiexec.exe
Token: SeCreateGlobalPrivilege	5524	msiexec.exe
Token: SeCreateTokenPrivilege	5524	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5524	msiexec.exe
Token: SeLockMemoryPrivilege	5524	msiexec.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
5524	msiexec.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5924	onestart.exe
5924	onestart.exe
5924	onestart.exe
5924	onestart.exe
5520	chrome.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
5524	msiexec.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5520	chrome.exe
5924	onestart.exe
5924	onestart.exe
5924	onestart.exe
5924	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe
7156	onestart.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3968	3260	msiexec.exe	91
PID 3260 wrote to memory of 3968	3260	msiexec.exe	91
PID 3260 wrote to memory of 3968	3260	msiexec.exe	91
PID 3260 wrote to memory of 1784	3260	msiexec.exe	107
PID 3260 wrote to memory of 1784	3260	msiexec.exe	107
PID 3260 wrote to memory of 2768	3260	msiexec.exe	109
PID 3260 wrote to memory of 2768	3260	msiexec.exe	109
PID 3260 wrote to memory of 2768	3260	msiexec.exe	109
PID 3260 wrote to memory of 3000	3260	msiexec.exe	110
PID 3260 wrote to memory of 3000	3260	msiexec.exe	110
PID 3000 wrote to memory of 3820	3000	onestart_installer.exe	112
PID 3000 wrote to memory of 3820	3000	onestart_installer.exe	112
PID 3820 wrote to memory of 4752	3820	setup.exe	113
PID 3820 wrote to memory of 4752	3820	setup.exe	113
PID 1048 wrote to memory of 4600	1048	notification_helper.exe	117
PID 1048 wrote to memory of 4600	1048	notification_helper.exe	117
PID 3820 wrote to memory of 3752	3820	setup.exe	118
PID 3820 wrote to memory of 3752	3820	setup.exe	118
PID 3752 wrote to memory of 3236	3752	setup.exe	119
PID 3752 wrote to memory of 3236	3752	setup.exe	119
PID 3820 wrote to memory of 5924	3820	setup.exe	121
PID 3820 wrote to memory of 5924	3820	setup.exe	121
PID 5924 wrote to memory of 4624	5924	onestart.exe	122
PID 5924 wrote to memory of 4624	5924	onestart.exe	122
PID 4624 wrote to memory of 4008	4624	onestart.exe	123
PID 4624 wrote to memory of 4008	4624	onestart.exe	123
PID 3000 wrote to memory of 1392	3000	onestart_installer.exe	124
PID 3000 wrote to memory of 1392	3000	onestart_installer.exe	124
PID 1392 wrote to memory of 5520	1392	cmd.exe	125
PID 1392 wrote to memory of 5520	1392	cmd.exe	125
PID 5520 wrote to memory of 4468	5520	chrome.exe	126
PID 5520 wrote to memory of 4468	5520	chrome.exe	126
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 1252	5520	chrome.exe	127
PID 5520 wrote to memory of 3156	5520	chrome.exe	128
PID 5520 wrote to memory of 3156	5520	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\onestartpdfdirect.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1D70FE440FB31510473F0C8B1D00297 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F0E76EDFA9482B9949B6809266E6ABE4
  2⤵
  - Blocklisted process makes network request
  - Downloads MZ/PE file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe
  "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe" "install" "15" "2" "1" "1"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\ONESTART.PACKED.7Z" "install" "15" "2" "1" "1"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7d0a68148,0x7ff7d0a68154,0x7ff7d0a68160
      4⤵
      Executes dropped EXE
      PID:4752
  - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7d0a68148,0x7ff7d0a68154,0x7ff7d0a68160
        5⤵
        Executes dropped EXE
        
        PID:3236
  - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
      "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --from-installer --no-startup-window
      4⤵
      Adds Run key to start application
      Checks computer location settings
      Checks system information in the registry
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5924
    - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2aa77c38,0x7ffb2aa77c44,0x7ffb2aa77c50
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4624
      - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x1c8,0x1cc,0x1d0,0x12c,0x1d4,0x7ff64ac6fe98,0x7ff64ac6fea4,0x7ff64ac6feb0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2096,i,3998606392477589422,13773687976622289941,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1864,i,3998606392477589422,13773687976622289941,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1412
    - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2400,i,3998606392477589422,13773687976622289941,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5552
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ""%LOCALAPPDATA%\OneStart.ai\OneStart\Application\130.0.6723.139\Installer\setup.exe" --adv-import"
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\130.0.6723.139\Installer\setup.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\130.0.6723.139\Installer\setup.exe" --adv-import
        6⤵
        Executes dropped EXE
        
        PID:6408
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ""C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --close-all-browsers"
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --close-all-browsers
        8⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2aa77c38,0x7ffb2aa77c44,0x7ffb2aa77c50
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ff64ac6fe98,0x7ff64ac6fea4,0x7ff64ac6feb0
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6688
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "taskkill /f /im onestart.exe"
        7⤵
        
        PID:3576
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im onestart.exe
        8⤵
        Kills process with taskkill
        
        PID:5032
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "taskkill /im chrome.exe"
        7⤵
        
        PID:7132
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:4416
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "taskkill /im chrome.exe"
        7⤵
        
        PID:4788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:7016
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "taskkill /im chrome.exe"
        7⤵
        
        PID:3564
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1412
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:2896
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "taskkill /f /im chrome.exe"
        7⤵
        
        PID:4412
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:5572
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\First Run""
        7⤵
        
        PID:5356
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Preferences""
        7⤵
        
        PID:5784
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Secure Preferences""
        7⤵
        
        PID:5768
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "rmdir "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Sessions" /s /q"
        7⤵
        
        PID:5004
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "xcopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Sessions" "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Sessions" /s /e /i /y"
        7⤵
        
        PID:7076
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions" "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Sessions" /s /e /i /y
        8⤵
        
        PID:5204
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Bookmarks""
        7⤵
        
        PID:6544
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "xcopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Bookmarks" "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y"
        7⤵
        
        PID:6728
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Bookmarks" "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y
        8⤵
        
        PID:6716
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Favicons""
        7⤵
        
        PID:6272
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "xcopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Favicons" "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y"
        7⤵
        
        PID:5336
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons" "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y
        8⤵
        
        PID:6804
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\Favicons-journal""
        7⤵
        
        PID:6792
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "xcopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Favicons-journal" "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y"
        7⤵
        
        PID:4220
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal" "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y
        8⤵
        
        PID:7160
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\History""
        7⤵
        
        PID:6672
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "xcopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\History" "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y"
        7⤵
        
        PID:6916
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History" "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y
        8⤵
        
        PID:4968
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "del /F "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\History-journal""
        7⤵
        
        PID:3180
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c "xcopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\History-journal" "%LOCALAPPDATA%\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y"
        7⤵
        
        PID:6552
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal" "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\" /s /e /i /y
        8⤵
        
        PID:6208
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ""C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --existing--window"
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --existing--window
        8⤵
        Adds Run key to start application
        Checks computer location settings
        Checks system information in the registry
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2ae17c38,0x7ffb2ae17c44,0x7ffb2ae17c50
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2124,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=2036,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2436,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5280
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ""%LOCALAPPDATA%\OneStart.ai\OneStart\Application\onestart.exe" --update"
        9⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --update
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3996,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4004,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4744,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4956,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5724,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5756,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:320
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5820,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5956,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5776,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4940,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6248,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6256,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6580,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:2
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5072,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5008,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:2
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
        
        "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5108,i,12155170203033396777,17502856007445885762,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
        9⤵
        Executes dropped EXE
        
        PID:4912
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ""C:\Program Files\Google\Chrome\Application\chrome.exe" https://onestart.ai/chr/startup?fhnid=76414529"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://onestart.ai/chr/startup?fhnid=76414529
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb2ae1dcf8,0x7ffb2ae1dd04,0x7ffb2ae1dd10
        5⤵
        
        PID:4468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1908,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1904 /prefetch:2
        5⤵
        
        PID:1252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2188,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2212 /prefetch:3
        5⤵
        
        PID:3156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2352 /prefetch:8
        5⤵
        
        PID:5916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:3556
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4324,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4336 /prefetch:2
        5⤵
        
        PID:4520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4724,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4288 /prefetch:1
        5⤵
        
        PID:1860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4896,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:5424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5020,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5052 /prefetch:1
        5⤵
        
        PID:4048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5072,i,13358973321311533480,3639992638070321348,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:1320
- C:\Windows\Installer\MSI5CB7.tmp
  "C:\Windows\Installer\MSI5CB7.tmp" /HideWindow cmd.exe /c "rmdir /s /q "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\""
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:7012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4536

C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x1cc,0x1d0,0x1d4,0x1a8,0x1d8,0x7ff6317f7758,0x7ff6317f7764,0x7ff6317f7770
  2⤵
  PID:4600

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --existing-window
1⤵
PID:5456
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --existing-window
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6260
- - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
    C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb2aa77c38,0x7ffb2aa77c44,0x7ffb2aa77c50
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --update
1⤵
PID:5784
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --update
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --existing-window
1⤵
PID:5224
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --existing-window
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6480
- - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
    C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2aa77c38,0x7ffb2aa77c44,0x7ffb2aa77c50
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6540
  - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
      C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ff64ac6fe98,0x7ff64ac6fea4,0x7ff64ac6feb0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --update
1⤵
PID:4724
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --update
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --no-startup-window --from-registry /prefetch:5
1⤵
PID:6828
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --no-startup-window --from-registry /prefetch:5
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5336
- - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
    C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb2aa77c38,0x7ffb2aa77c44,0x7ffb2aa77c50
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --existing-window
1⤵
PID:1676
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --existing-window
  2⤵
  - Executes dropped EXE
  PID:6188
- - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
    C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2ae17c38,0x7ffb2ae17c44,0x7ffb2ae17c50
    3⤵
    - Executes dropped EXE
    PID:5460
  - - C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
      C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x14c,0x150,0x154,0x148,0x158,0x7ff64ac6fe98,0x7ff64ac6fea4,0x7ff64ac6feb0
      4⤵
      Executes dropped EXE
      PID:2876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --update
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
  C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --update
  2⤵
  - Executes dropped EXE
  PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c "rmdir /s /q "C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\""
1⤵
PID:3592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c
1⤵
- System Location Discovery: System Language Discovery
PID:5900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b4f9.rbs

Filesize
778KB

MD5
824fe54b5a8295f9375f329aa160cd98

SHA1
41afb7635a308178a64bff4adbbff8708519a548

SHA256
f5331c5b26d9a0832490ddb404e15b6dfcf2b8ae1e391e6ffe164d7dcae842c1

SHA512
9a705562335a7480ee4d8fe7f0082f700dffd5c178ac792a6538254650b2d17d5e449a5dc81b283239a49803f773636d20f4a5c7a7826d0a1786031b7fd1d9bc

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping7156_337491392\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Program Files\chromium_installer.log

Filesize
439B

MD5
ff75fe74d165531a1770251a2383a6f2

SHA1
b969dd983c2d2f4625c0f87b2d408c68c82eb5c2

SHA256
e253845f908c2c644d82ddf50411d04cc6cec900888f5981e2e6957c3668e461

SHA512
bd7392bda829e7d3b5329ce0fa6d819053343db0a6591465c4d17baafd64960cccd5ae1ceb426b6b31bc2034298731ed84c244c773c0b99d1ab30fb586a714b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_92EDC502ED2DCA77FBA738595B424D4A

Filesize
1KB

MD5
ced82772136b7cbdf90fae4fd2375563

SHA1
70a05f2db4f259578803d948ba8390791108811d

SHA256
277ecc5879c2014602244ebd490d028c1187eff68dd75bff961f564604f56aab

SHA512
5eb1d9659996872dfa78bdd85630bddf442a1b4b5341739b23c96f3b341b48e80af19313b4931d44e27cb2b32c2b0bcb720cd0b56e38bf2133189457ea05a73c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
eb5f1c1833631eb2d639f73970f05224

SHA1
1591b4005f3a02a73efaaa66ca281e118a1f734a

SHA256
5ec2eecc598557e27a7edaa76ccc315f62ebe33ef0167bd42d590d4f8d535a0e

SHA512
f275e3c774947c52a55b4de2d6a610997d01c3be7933f27ee7fb5f2061b869a975d5bed1a4c403fc6e878b001d4ccc15254641cc15a9cc851cc11eb64a75f133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_92EDC502ED2DCA77FBA738595B424D4A

Filesize
540B

MD5
89cfe1eee7bd312dd66f0d928d02ff66

SHA1
527a7bbe729c3958d6807feadabb37d2914cea86

SHA256
500065d89bd6632cf947c7d10e58a34f0f66e0e338671bb9d0538e61353ead3f

SHA512
059f9dc39b6d5b1e10807c3760f149a6f55e4766e1c055d5ce21c7bc7ddb998a58d98d16ecc5cdca0d51864a6a9cf81081b1b0d479cf720b85b7cd0eb4950af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
2dd38954734ba35937868229075b7399

SHA1
1cbb0d3c68bd2b448df5af7a95bc6eccf061b248

SHA256
76df5801f8f0481ea786cee4ee54afc2fe701cfb07ff3f4d50c4a1ce6d5fefe8

SHA512
f127ff13b76d0e2d7cc9778b84173c7ffbeaa0f7e606290e2fecec1310542c2cfa15a6f93d81cf55d4349867b35d57d1138d9c02844811f3f58fca7d17b4b3de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a25349293e27bc6087fbc8e3c7ff0ee3

SHA1
80a0f7ba91bce27eccf942f47f05ce6f175f3878

SHA256
576caa302dad778d34f1813e3f35e7fa7f22e0210409a169ab42e16e6a7fbfa1

SHA512
abe77b4fdc9efb25c5f9a8a59414ec1e26f175a5dbd137925010a1a941c0b3ac2b3c0f8bc16e2e5fc7998ab9872f4d04bd70f70ebcf36dd7da4c198c3e5245b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
225f8f1a8a1792a90adf936dbb437437

SHA1
4aa30ec5d71ba188a6f6c26cdacb4b4cb147b58b

SHA256
570d4388987a7f549a0727b92d40b90a6b5f85d0092d10b9068fee64c04328d8

SHA512
f1b9bfffe265606251cdb29302a35f0a68618dda0c3e67c1fcaff83f9918e9aee8dedb0f751cc68e0f6de87abdf1faa4847853e6ad6024a6a81348de4ad8f5fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
3713182cbbc06f690877d9cd17e92805

SHA1
c62dc09b56e2ebd0d019b9cbaeee771659823aac

SHA256
681aa7140469c5f7c4512e1e9053767564e9aaeb90a32c8bcfa2a517b549ebef

SHA512
36d5532b79196ad11280594c660ca5d5eeb8dba1d5227e50e59cff9814fef862d80c8d7bef515f2a9af2f3d11418b17b010000e4d7f51c4d6ebe11a57e7951b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d7fb44461f638707feb898549cb05b27

SHA1
ffa74e8c975a64a5295c48299532b0410f82a917

SHA256
fda610755ae936724f1cab7b1e2047c8339c91a5d74395cd6098abafa1fc9090

SHA512
f683705819759e7ca35eae8c93e5c939352e5b855e3f2ad6b25bbbb78f885263e5def83c3d5c2848f2ebd2bd033cd8c9203749a09e763fac9f54eed8f751bb07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5121a53ffa77a555ff4dcbc565b062d0

SHA1
0daf842d6bca1f56c7d2ae887100465a78c4ea5a

SHA256
11fac70bcd88165f9b950671cd01b73af1fb2fec208971a9e6b9b2d647117cf3

SHA512
1c5eef5fa525ffb289718047e96fec094578876add0e832cf5c486aa931f0adc20bb93fbe07cfee10de4286171c0e23fa2dbe50d564ed5a72b08f3e729ea973f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
87186ef28454676be80b9f8ae2edf78f

SHA1
75f1bb0f81b8529fdf791c4826d7b828d78ed536

SHA256
c0bab67241e88a62d74770409faf1a9abb24b992af3a634f661ffedd7411e8b3

SHA512
438be68813f3b5ee77937fd62dc7ec2e9e72789b17c2f7bd20ab53fcc186e2517b2a848eea6c25c2197e1337d8b70f30339cbd2f7959945e33f46a79ed05e55d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e751a26af631dee5a9c67ef9051ecc6c

SHA1
86a0a1204f8eb63830fb7bb77e923b9f7ddc6080

SHA256
9a8735eb7913ea93fde4482e7cb047cd5c804fbf5d4b4b31b981e2237e9451b7

SHA512
6c4d7ca0f2999e88492a05868d282fc763aef4db6e5c2aab5edd6d55822e212d04fcd4dee0fb217e8a24b7a8846ec3ab382918fb1831469a16b461b94d70683e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581345.TMP

Filesize
48B

MD5
489dd12ceab9daa92fd8dd38ea170ac3

SHA1
0561eeedee5657babd1ce4b889340aca0a6d820f

SHA256
ec523150d8f49c67acdf337eea65d6e0cbd85eb2191972c6f4fd0561270b2ee9

SHA512
3a71cf533d614549ac04b62dbfaac11ef5a9dc07a8e4e5a1547e562eafcdc52e71c2a8c214e1d27bd4284d31989a495fadb7aaf700d1a72f4bf63ed98d3e9fb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
2235abf9883ba1b6fa733e1b75dedbba

SHA1
286f95071b99b0d71d00eb49d204c37a5c837b05

SHA256
0833f102cf2edc4d25a9cf4549ca26130fe7c78862c209d43b86295c326561b8

SHA512
5516561ccc497879a2d59a33568a018beef751e1d9d6427c6779d1714a48eb844c8ce9eb9f242df6bbed597efb81640612c09ac9908f43bc7e51d5e977b2a349

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
8f4f40ec2d668c56f22a52ca10d27012

SHA1
702f10f8a5ef13719f7c1ef0d6959610220e4cfc

SHA256
75fda5a7be9f99332c78df21e42fb4947d6a9167c3e75af3faae5e17f85a15db

SHA512
939b1a944c561d386990155aa649e6e19f60adc7b7a4d210c16110c4a9c62460227bd30d1273031331fb65c5d918959677b7566d3987c351c1fed6e07a9a44b8

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart Installer\CR_97C80.tmp\setup.exe

Filesize
4.7MB

MD5
3b35223e82e6229a01bd5ba59344fe4f

SHA1
36e89d073829bea48759ee22404e96d7cafe82ac

SHA256
9dbbfd32aae901e36a0a62f1212e0d564a08790d333ebd745a7ddaa5ef119e71

SHA512
335b3baab22de5b5152d92e65e387e5e5e6480c33c2a17f1f3f35cdaba847bcd51ea281af29231604ab54cd337d937b2c76dd6a1b4bc0f6c4797ee485be855fa

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\.data\OneStart.json

Filesize
267B

MD5
eaa733f4f3ff4fea7e1e7b345c1851ef

SHA1
67710a152b43573c969a11971bf8023358ecff44

SHA256
eaeec512671781ab0dbc346807c7e92f4a18f546fb1db25c5dbb15ae9cb3012a

SHA512
2abe680b3454c39c7d46e94072014b1ebbee1e45e9f33f2a7c2a61a6f4151ab37e2c3b75ca9bd3770b9687a0477f72c8e5319e6b8f3394f4c951581e450fd4e4

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\.data\OneStart.json

Filesize
222B

MD5
f918aab6e485f5b69e9aa481e2130a10

SHA1
6fe911f9605582f564bbc928c4511a2dd4692c39

SHA256
fec46395eeffcc618055e65dabc891a6fa0cd43d23c54e3c9f19de365be4364a

SHA512
d33fcbdb3bd1673ac275249cb8773d58a073c3648ff39c1e6cdd214f065ff707d79aaa448b4eea9f65fd444ff41a7baab1f8f24a3cafdc22a3421dc232d9c83e

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\130.0.6723.139\chrome_elf.dll

Filesize
1.3MB

MD5
3cb7be47cb8e31770fa67369a8fdc282

SHA1
4632c95becb67cc90eb945d6e9fba3f877e23909

SHA256
01669593df12bf3685360375382dcb0bac145e107d0de2d4221aa07fd07aab31

SHA512
5985411d4ae4c2b947cc42125f898e56b4f1c86bcd65e052a3974fe437c5b04157997dc7c361c3f0cb64ae5c6dbdc39738eb62e5b5fdbb44f19ec2ecb477d676

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\master_preferences

Filesize
159B

MD5
746e45d4be2d95012aff9a0716e811f6

SHA1
3af1bef7086d7512f800084fc7c95fe994c6a459

SHA256
5269f6e042e298253d298cbe4a10efece8276bf8058a679dd81a9fa6fe91c060

SHA512
33a491d07d6360655d2df4191458cbb57e6fef8c583b7b049ec016ca43e5436711dceefdaf10335a90df5fe1c7328a51530bcc87fd1268352b385532d11c2412

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe

Filesize
3.2MB

MD5
c1472f63dfe29605b1df91c38f01ebc1

SHA1
5734a64a8f00c43a1ee68dc66473987d11f8289d

SHA256
81d38ae7e80393c70fed131f7b6d98fb0bf3c1dbe897655a365d9bfe35a88280

SHA512
80d2c33556e7e3cbdb008252266bec3556780053dd2f0e5fb51ab544691f3eec23cc1f01e8f1364efc12cad0858d31f71dec2eb5d58f1f9918bf4ca46ca24b67

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad\settings.dat

Filesize
40B

MD5
b5b96a47467680afcfecea16cf8e514e

SHA1
915fa6ddc7070c3e55fe6367b404d6cc95a98798

SHA256
8371ef862c31dbbc1574fee6f4ddf36d2b3b62cf9d72d5d9bc379d2d2606d257

SHA512
f6b0917ebbb74e886c415aa6fbd356d288e3f3831409300ba7857608d69f52d6c466d6a8415749435653b4c995e8a1f6e9806cb7f60eea0e0ff1a783ab22c1ad

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\2e4be333-8421-466d-9190-3c6a9c976250.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a675eec42d7b5101baae3fd440b2e082

SHA1
9b15bf20f704502a8b13a22023a3cd986c29b510

SHA256
015b56a264efe2f133e279550f254daef93553d545cfae08da681139be54b9e8

SHA512
37d998ac04ebf6b11b402ab88b20832df2a735fcfa452f75b039b1fcdf865b649a1fd8da717e2280803b45976b47c2dfc7a9e840f2f1d3081821a1240e487dfc

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
474062ceb63d4d9940c4ac3f39e41dd5

SHA1
b1951e557f5fd25b3c3c95aa4fccd4d17766bab9

SHA256
56dfd92705d6ec77424997277891cd7a9ae4e186c875aa1ac5b0fc2f7c62760d

SHA512
9b721dfa8f4f421edf9f11c4aef20432bb384a17757b11b21729245484a890b44ccfd1cd85641ae45e9995ed4bed40adcbbf195c828b453798412e398fe59285

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58afb3.TMP

Filesize
48B

MD5
673bec056bdd0992a5658f05cbaa6bc3

SHA1
65edb203f62e232e390de61ddecca575fd4ef5c5

SHA256
2254530ef42112c63efb14f58c3bc9ba2a7f7421d6c037cca1e06f129c3b55eb

SHA512
6cde6a20c848e370d0c3896ae42222d919c8c280438b31a83e38a5093acd7a00129a9f60b937185668f674d02d6f790763f8a348b690c6e787335b66160e2bab

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3e4f4eaa7826fcdf331e686786540603

SHA1
4f0499f1bcc6e7872f954465779f9d804426949b

SHA256
e4bb3e202d61549b4c40a7f8ce547f35ac5e222c106fb8e05c0d43430d4a2b2b

SHA512
f5e7d4aba56c4f9e49274244e49a1d67f44ab6e6731e7a34d21fc97f0c2a85095547465685b99e0d6493538138cabe440b2702fedf30aa423ac576801194b60a

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1b08b329413254e3600053fcb0110d1b

SHA1
e1c9539aa6fc0776abdd69dd092d9ab1ecfc3f03

SHA256
734d860e064501a61bd749432085214891d64c34fda7a462591f80299abec41f

SHA512
5244771065aced3f914775c522bfe297c29c049652c1edb9fedb0080a38dab80c46a385b8ce5f39a297d6d44753b5ab617e179e8edeef7860d965ceb451fcb65

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Preferences

Filesize
9KB

MD5
73387973a8000f597e7337d29745dd63

SHA1
52ba8a6825107ed70f6cdd07b2ac26393a973d94

SHA256
4f1ad80b674bf6f45430c3b2af644254bb2d3a5f29015882e0f18708c129c2a8

SHA512
ba44d372cd5a7235350d570e27cef10ae2cf966e7c9abe3fe1aa208cd533288f1fab3c4291fac19fb57f1f9aeaddfed63c87878af09a42e746c50da5e0fdf3a9

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Preferences

Filesize
8KB

MD5
11a442491ab830b29a76880c93c41ff1

SHA1
b9a19f2217b80e9486422bed43385aaf05a811dd

SHA256
4a22bd98733599e482530a0f8a9486b43adff65aec2765a653fdec14f0f1d70b

SHA512
4777ce05f1fd4ada92802424094ad368864f805747a9836e0978b68908805fca659d8dbe97d33a7440fd8c08278b5c39aacc73329c17815c048463c21e9af24e

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Preferences

Filesize
10KB

MD5
ec0b2988e8188d242c1ecb1e82a5f235

SHA1
1e01ced74f144bf730cb5aa275b4df1c73a10797

SHA256
bcc0fd054686a7eece754d7e5650589a1754f1961d228f9e705327d48bd52fad

SHA512
56c2b13bedb3d23b4e425475fa25c20494d8d8958e8ebac7411176936135aba16712325788f04ed7cf453865e239377fab8e5298e159b118337bc6113fb96fd0

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Preferences

Filesize
10KB

MD5
d71a02eba2df6fbd646bf5bee75af989

SHA1
f202280d9d0404e94837a90d2b58c3a97f24590d

SHA256
211694abfcc23bb8ba90ddc0974bccdde30d3b9f69b3946853ba2d6893525d36

SHA512
184d3a24a370057e486d7545fd796b6bfa989aef15ff1eecaaeb6a7941a38272f2974ba582fb6306d6d99da0296e68a1e0567bf205571552a515a438b56dde96

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Preferences~RFe580eb1.TMP

Filesize
2KB

MD5
fc89fbe84b188834642e6b4d06353058

SHA1
e4af17af95e28897a7dc27272eee8a19c4cdd405

SHA256
47683bd7da7759bc38ad68d937fea63963b1f7d068a768d2de8c536795447979

SHA512
32d640a125a6d0e05c3f869e47c2be17aa02ebb74bcaf49c8eb30fd4095b04cd27c01ef72543a0e0b31f1010c0066d8ff1092b305460072676df16d3999f73ce

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Secure Preferences

Filesize
10KB

MD5
ce18ddf41b43e2db12914f8a9ba6293d

SHA1
40b5f38e8fb1e439e790500d0bc22603fa6be391

SHA256
f8557362756c43d0a025b2c17e149a612cb4f2f3d8b11b586f549228339f86c2

SHA512
9d2aab4f845b495be8e77a31b1de8403af6662bbf8d93a67cbb212d63d856c7ec8160506928d8196e40219cd3a79fa1ce78fc756e490093d5ae83036f110b66c

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Secure Preferences~RFe587fba.TMP

Filesize
6KB

MD5
a9cd2a7dd2574b07e15177f11e3493b4

SHA1
afeef0302922d9625cda93f0c4fda253df79300d

SHA256
bafded69e9ac68644589f218c6ebf8992cda1670f217edefe3e42e510c5721a7

SHA512
89e4aea5aa4fdc86619f3e1125aa644eb87477296abcc71ae2a725378e00014152f2ae76dbdff7d2530a55e9af9c6edf526dbe65b6164be8aeab91901ac8421e

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
add24e08367dea2f7075c9c2fe3785b4

SHA1
1cca3c9718264b7fb28d4bf68fd65ecfd6a10c58

SHA256
62302bd5e371f0f0e3c4792d2153ee88d657111f6842acb916c7afd76ea47374

SHA512
dc72fce02d0eb3fb5a5f2887320e9b67cf09258fed74d426b07ee758f8c4ef4c24ecafb0048489d1cb13b4e0bba0b6742cf55bbb4ffec54d0ac0a0c2a72e0393

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aa35.TMP

Filesize
48B

MD5
b0c6ed2bc0d2a89deb0b25c70b8e88e7

SHA1
148db9b0693108f94f9c6def5d692c0b4c9371d8

SHA256
c6541907a14bee2969937b52f25c185c011434ea690c9f157e86ec0d353a1eff

SHA512
c0eeef6a55562b438710b1ec0e870b1842655f6acca22525810ab6c21e9ccb9967bc6f1a0c91fccc0379ab597452b7f54a0864eef236d6fabf1c5815b16ab755

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Default\f241d348-20fa-48a4-9e67-535ba19d8173.tmp

Filesize
163KB

MD5
70e5d4e286c45331931c22dbf5b15a9b

SHA1
bb4dbee62f4410666033d8bbf658227c80a3ad9a

SHA256
6fd93aa2e71ae66df17c2e84e719d27df69762375894522d80c95d7c82393793

SHA512
bb3931d23042265b7f9c0e4f35470fed8e3279cf677aa7b98ddcf19e110e1ea61b36778890b322bd0fa111023f6097cf4dfe185cf54c89a8e5b2ac3ff5283913

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Local State

Filesize
1KB

MD5
47c7fa93626e029f7a121557b671a552

SHA1
dd71cd2e615fc425dd2d9a54afd7d7bc4bfbaff2

SHA256
4a15e200eae8014c66acfb69e1bb4dd1ce733c557e0f6bfd98174f44c21ffcb8

SHA512
f9c99f9d3d5539febc7da0c2dfc7fc87aad55db8ff1ce538b6145d3b5b6589a83086c051be538e03a4e25fb3e0fdf5535b95ea0a913279aa33ed9d16e29f9e0a

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Local State

Filesize
3KB

MD5
0a77a6557997ce41c508efd0dd039964

SHA1
fd18ea615a8243f922a5c12ec7d2ba8048dd2fc6

SHA256
dd58809314b84a22754ae9d09496f75735c0a635dd55e144040ab3c9e9a4aba7

SHA512
aeb03c5bdf8c41f544ca137a84608ebb3d4ffa2668e4f8b150ef600a44fa8cec6cb6458cf8c06f18dee7c74a1b9e72645055d2b73b994bd37ecf10b8518bd3ff

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Local State

Filesize
3KB

MD5
bde1c09223f26169ae2735fa8c2dac9f

SHA1
f66d1dd586cd544505ff4d31a0e35ffb80258800

SHA256
e3b6bdd97b414362ca1d970526372d4ff2252b79ef841f420029345ac0214b31

SHA512
befee92406a0d9dfde917d6af9ccb38f33422abd6261469434806ce956b8d8dc0d1a4c7a00bd5e52067209aae66dcbfd3821babb9867cc1c80184b0a0264119e

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Local State

Filesize
3KB

MD5
7407cd5ce093231fca6eb5d3390d2757

SHA1
4940d924b0ed93e3218da1cdf181774a32388457

SHA256
7a61ffdf76007e8abf0910ce2b853dc9ce89ffdc141526b63193eef6f3747bb4

SHA512
e394bf2a755f84512a7e5f64a3dba234bac5d9bef7514249287d67cd314a4a5b68f91bb45dc9ccf91dd37c2a51f8e075e516dfc1424211138daf0c3a7d9e0315

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Local State

Filesize
3KB

MD5
cd0508a438045039f3ff503e62b06d0b

SHA1
bb986f3254c46441283f120beed634d6f37ab389

SHA256
278b4c5a0337a97558edc40e7a1d4f26ff14d042c4f57089fcb44277815e4c45

SHA512
c99f3f34d8265b2f77604f6776ec968ceb8a29709ea3c18e1b33cd8f83b125888c4f11e0e75b2c2da9b9b9c0b1614523dffa9b3dd543961f78730a9d609e158e

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\Local State~RFe580431.TMP

Filesize
909B

MD5
2646c5ef2f317f0f05c75e09b57d3b5d

SHA1
ac3f61aadc8b59e9ed0ae1a8b2db52544095d394

SHA256
87278074183bc2b2866e0082a049437ac62fc006ee776d4ecdcf41f0cc5d6a0e

SHA512
5d9cd01a5a74cb67f393549c9254d2e5f5585454db1d9f6513cc8c4a6f8d8cd767fc73782848b6cb3bf3f2ada3855a3078721c44a0fcf6f239ff2e6b80529a9f

Download Submit
C:\Users\Admin\AppData\Local\OneStart.ai\OneStart\User Data\component_crx_cache\oimompecagnajdejgnnjijobebaeigek_1.a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\69a40360-36ec-4bc1-88c3-986d2d135a16.tmp

Filesize
14.3MB

MD5
a8eaa7ef923ef70d318d8ba608846197

SHA1
47f59ef225138249a55ebc83b6d30009cea0c345

SHA256
028d9afa1be75587f0fbc15e52b3a8bd34f55847430b28874ec6c7603d5de898

SHA512
1d2c27bbb96f363ff0894e4114b717b6b795cb9e451b5225e33f5ad619edebd899a3b4dbab4f1d6c9e40ad6dc9ffa36989f43fc043cbcf78c58f267707a6c132

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6D60.tmp

Filesize
997KB

MD5
ee09d6a1bb908b42c05fd0beeb67dfd2

SHA1
1eb7c1304b7bca649c2a5902b18a1ea57ceaa532

SHA256
7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752

SHA512
2dd2e4e66d2f2277f031c5f3c829a31c3b29196ab27262c6a8f1896a2113a1be1687c9e8cd9667b89157f099dfb969ef14ae3ea602d4c772e960bc41d39c3d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6F1A.tmp

Filesize
1.1MB

MD5
e83d774f643972b8eccdb3a34da135c5

SHA1
a58eccfb12d723c3460563c5191d604def235d15

SHA256
d0a6f6373cfb902fcd95bc12360a9e949f5597b72c01e0bd328f9b1e2080b5b7

SHA512
cb5ff0e66827e6a1fa27abdd322987906cfdb3cdb49248efee04d51fee65e93b5d964ff78095866e197448358a9de9ec7f45d4158c0913cbf0dbd849883a6e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir7156_33941467\eaec5833-6a7e-4e6c-96e5-ff5e45f1c77c.tmp

Filesize
29KB

MD5
a6d80ceda18b0ae95e6d654ce734faaa

SHA1
8b200fd36f2fa75ff6b628108693003b8f0b0d6c

SHA256
38595bee7b8ee336b3113b83a8e575b26c9c060607fa645f1de7b892e3267fc7

SHA512
c8e865e1ca74697a27e0faa68289d81331efe198776224d6a189946efc6738bcbed7e706070b6bdc3ff7485e80f45659ebd35a59eb844a47d28bf19b62d70648

Download Submit
C:\Windows\Installer\MSIB7FA.tmp

Filesize
777KB

MD5
367d9c1fb0e917819a12e6492a88c6b9

SHA1
e8144a631337cc47f87c9a171f95cb955b5e0656

SHA256
b5bbb9a1899dadf2ba6ccf0c88868c6c1200f7a095f6e1dbc686da7ccc271452

SHA512
c8645c60b9e5ca4c73968eb7975ecd77e7828e74f95680ee8120cc2823027a3fe6f9f14b162d84c12c6e552f45712260f93bb85637ddcf22d619e9376a1b20d3

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
d89f7685b9e85c1ef15db3744b4f883c

SHA1
815a9aed1ec6e550372edea4eb379929f7d1d3d2

SHA256
64e028a389960e170577f0bad52f88ff3dba6c117522d98bad5f48fbec8bacdc

SHA512
4a8b0c7e39af612e1b6a9293d415a559dafdf68b7c3c2acf1bf2f651567b96212ed49f208230cb6382a43d62ccaf6c7694bdf6914facd675ed6265573c6f61b9

Download Submit
\??\Volume{a6f17796-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9af46ed3-42a9-42d9-976f-019763e21dbb}_OnDiskSnapshotProp

Filesize
6KB

MD5
c544d304bc4b86d326a0fa632aea5ed7

SHA1
2a63cc1f619b9076681153b4c72124d0c282c831

SHA256
f64f10765812a3f77ed823d465c6fcd9fadd728987c72af090ed5bd8c19cca09

SHA512
2f418b4141275d3f138537000df806f77bf8063d7bd50fc24ef6d8538c79ce8f0aba4b8111074d59206d675e2ff5e0f1be655af50c9e00089fd0e61b92670dd5

Download Submit
memory/5552-229-0x00007FFB485D0000-0x00007FFB485D1000-memory.dmp

Filesize
4KB

Download
memory/5552-230-0x00007FFB494D0000-0x00007FFB494D1000-memory.dmp

Filesize
4KB

Download