3b20ac843fcb7d81ca61b5ab7078dfd3c688b2ada08a301afe48fe2b2b26d792

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Executes dropped EXE 4 IoCs

pid	Process
6076	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4048	CleanupConsole.exe
5624	OneSystemCare.exe

Loads dropped DLL 4 IoCs

pid	Process
6076	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
6076	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\OneSystemCare\ydwqk.dll	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-QGE2M.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-VE05I.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1634088332\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_362556834\deny_domains.list	msedge.exe
File created	C:\Program Files (x86)\OneSystemCare\is-GIRCC.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1634088332\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_362556834\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1634088332\LICENSE	msedge.exe
File created	C:\Program Files (x86)\OneSystemCare\is-LA9LS.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_1634088332\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_362556834\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5168_362556834\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-H8SHM.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-MMB90.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini	OneSystemCare.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\One System CarePeriod.job	OneSystemCare.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneSystemCare.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CleanupConsole.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5720	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4672-0-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2852-38-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/4672-53-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/4672-48-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2852-58-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2852-140-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneSystemCare.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{51679CCD-EA62-4672-8E05-32DD9D99239B}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5656	schtasks.exe
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5624	OneSystemCare.exe
Token: SeCreatePagefilePrivilege	5624	OneSystemCare.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5624	OneSystemCare.exe
4048	CleanupConsole.exe
4048	CleanupConsole.exe
5168	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5624	OneSystemCare.exe
4048	CleanupConsole.exe
4048	CleanupConsole.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4048	CleanupConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 6076	4672	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	84
PID 6076 wrote to memory of 2852	6076	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	97
PID 2852 wrote to memory of 4084	2852	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	98
PID 4084 wrote to memory of 5656	4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	104
PID 4084 wrote to memory of 1424	4084	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	109
PID 4048 wrote to memory of 5168	4048	CleanupConsole.exe	118
PID 5168 wrote to memory of 4664	5168	msedge.exe	119
PID 5168 wrote to memory of 5720	5168	msedge.exe	120
PID 5168 wrote to memory of 2296	5168	msedge.exe	121
PID 5168 wrote to memory of 2296	5168	msedge.exe	121
PID 5168 wrote to memory of 2296	5168	msedge.exe	121
PID 5168 wrote to memory of 3324	5168	msedge.exe	123
PID 5168 wrote to memory of 3324	5168	msedge.exe	123
PID 5168 wrote to memory of 3536	5168	msedge.exe	124
PID 5168 wrote to memory of 3536	5168	msedge.exe	124
PID 5168 wrote to memory of 3432	5168	msedge.exe	125
PID 5168 wrote to memory of 3536	5168	msedge.exe	124
PID 5168 wrote to memory of 3432	5168	msedge.exe	125
PID 5168 wrote to memory of 3432	5168	msedge.exe	125
PID 5168 wrote to memory of 2056	5168	msedge.exe	129
PID 5168 wrote to memory of 5024	5168	msedge.exe	128
PID 5168 wrote to memory of 2056	5168	msedge.exe	129
PID 5168 wrote to memory of 5024	5168	msedge.exe	128
PID 5168 wrote to memory of 1432	5168	msedge.exe	131
PID 4048 wrote to memory of 2932	4048	CleanupConsole.exe	135
PID 5168 wrote to memory of 3328	5168	msedge.exe	136
PID 5168 wrote to memory of 3328	5168	msedge.exe	136
PID 5168 wrote to memory of 3328	5168	msedge.exe	136
PID 5168 wrote to memory of 4636	5168	msedge.exe	137
PID 5168 wrote to memory of 4636	5168	msedge.exe	137
PID 5168 wrote to memory of 4636	5168	msedge.exe	137
PID 5168 wrote to memory of 4624	5168	msedge.exe	138
PID 5168 wrote to memory of 5180	5168	msedge.exe	139
PID 5168 wrote to memory of 4552	5168	msedge.exe	140
PID 4048 wrote to memory of 1752	4048	CleanupConsole.exe	141
PID 5168 wrote to memory of 4556	5168	msedge.exe	142
PID 5168 wrote to memory of 4556	5168	msedge.exe	142
PID 5168 wrote to memory of 4556	5168	msedge.exe	142
PID 5168 wrote to memory of 2092	5168	msedge.exe	145
PID 5168 wrote to memory of 2092	5168	msedge.exe	145
PID 5168 wrote to memory of 2092	5168	msedge.exe	145
PID 4048 wrote to memory of 3904	4048	CleanupConsole.exe	146
PID 5168 wrote to memory of 1120	5168	msedge.exe	147
PID 5168 wrote to memory of 1120	5168	msedge.exe	147
PID 5168 wrote to memory of 1120	5168	msedge.exe	147
PID 4048 wrote to memory of 4308	4048	CleanupConsole.exe	148
PID 5168 wrote to memory of 4900	5168	msedge.exe	149
PID 5168 wrote to memory of 4900	5168	msedge.exe	149
PID 5168 wrote to memory of 4900	5168	msedge.exe	149
PID 5168 wrote to memory of 2368	5168	msedge.exe	150
PID 5168 wrote to memory of 2368	5168	msedge.exe	150
PID 5168 wrote to memory of 5956	5168	msedge.exe	153
PID 5168 wrote to memory of 5956	5168	msedge.exe	153
PID 5168 wrote to memory of 5956	5168	msedge.exe	153
PID 4048 wrote to memory of 1056	4048	CleanupConsole.exe	155
PID 5168 wrote to memory of 2328	5168	msedge.exe	156
PID 5168 wrote to memory of 2328	5168	msedge.exe	156
PID 5168 wrote to memory of 2328	5168	msedge.exe	156
PID 5168 wrote to memory of 5640	5168	msedge.exe	157
PID 5168 wrote to memory of 5640	5168	msedge.exe	157
PID 5168 wrote to memory of 3936	5168	msedge.exe	158
PID 5168 wrote to memory of 3936	5168	msedge.exe	158
PID 5168 wrote to memory of 3936	5168	msedge.exe	158
PID 4048 wrote to memory of 4708	4048	CleanupConsole.exe	159

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\is-4E68O.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4E68O.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$70318,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe /LANG=en /SL5="$70318,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\is-7DO6M.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7DO6M.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$902E8,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe" /LANG=en /SL5="$70318,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4084
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe\" -Notify" /sc onlogon /TN "One System Care Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5656
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe' --scan" /sc ONCE /st 05:35 /sd 10/14/2026 /TN "One System Care Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1424

C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x314,0x7ffca398c188,0x7ffca398c194,0x7ffca398c1a0
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,17234471282917966758,7538036021135939491,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,922109336570644471,4519408815160587319,262144 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,7990234351208745968,8731388371912690897,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,13878724612291207063,15980341033814393050,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1939754234719188237,10639432416068413254,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,1123789215896880379,9045167242703427380,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,16990562459346391438,10252326118266723000,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,13262366073339920241,10536438886476719387,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,13262366073339920241,10536438886476719387,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5608,i,2667162397470315749,7573040772191897037,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6180,i,6733040273092371453,1040941294764547532,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4021926842704676162,13178005046252046823,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,4781307191565174011,1879463665070118536,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,11442292392455270149,5808091765019835401,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6364,i,16819811685216419056,5741582691133493106,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6452,i,16600317645662462837,4759394481266571694,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3636,i,15524901877162459768,2034967761697470267,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4728,i,6281602505893982566,2789007722210932707,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,12056479308929293694,8626106421815148810,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6796,i,1374416787521545510,11134888773902192514,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6240,i,2884717631607103396,2666947349534531492,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,14697643647977528640,13216389162386993491,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7528,i,2960083964093959939,3391029647060650247,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7592,i,3782847409958111168,15786232825534399263,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6520,i,9645556210259224559,9551695027703737024,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,1548982451150317929,5491398865273855703,524288 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:8
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7952,i,3330181429908030156,12494090555561351275,2097152 --field-trial-handle=2188,i,3660146060313443440,14220181537277969062,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
    3⤵
    PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_0A496BCA-EFB8-4F7F-969A-AA9D145FF72E&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4236

C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
"C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery