3b20ac843fcb7d81ca61b5ab7078dfd3c688b2ada08a301afe48fe2b2b26d792

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Size 4.1MB
Sample261014-e4ppaav16q
SHA256 3b20ac843fcb7d81ca61b5ab7078dfd3c688b2ada08a301afe48fe2b2b26d792
MD5 465c73ca0e13d459c15d83124a9ddc23
SHA1 d80d13948c9371cbe7e64d632eb3c781d6d9f1ab
SHA512 c525cd574cf626fd4dea45878f975b2849c0afb1d58d2011f50bbd8d632575509ef73684d87c6980262eef47cfe7f67f2466e6a9628f62306ef225eb45131ae5
SSDEEP 98304:ErIfJGonKVb3Gp+/ew74o0jVIUOr6kr+TQJ8XhnsaIDL:EUfCEpo7VOIRHvJ8saIDL
TLSH
T15916334663D64476E2244B74D8BD83407D23BD1C19E3E7AB6CB4E66E0AFB2C5CA31613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4588	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
1336	CleanupConsole.exe
2832	OneSystemCare.exe

Loads dropped DLL 4 IoCs

pid	Process
4588	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4588	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-EBP8C.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-72VCH.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-0GRGQ.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\ydwqk.dll	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-A1S8H.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-NC1MK.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-G1MFB.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini	OneSystemCare.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\One System CarePeriod.job	OneSystemCare.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1454907439\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_2143547968\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_2143547968\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CleanupConsole.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CleanupConsole.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CleanupConsole.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneSystemCare.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5228	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1204-0-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/1204-40-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/896-48-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/1204-61-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/896-66-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/896-141-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OneSystemCare.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{975619E9-27C8-4BC8-9F8F-69E9975E50FE}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
564	schtasks.exe
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2832	OneSystemCare.exe
Token: SeCreatePagefilePrivilege	2832	OneSystemCare.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
1336	CleanupConsole.exe
1336	CleanupConsole.exe
2832	OneSystemCare.exe
3360	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1336	CleanupConsole.exe
1336	CleanupConsole.exe
2832	OneSystemCare.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	CleanupConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4588	1204	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	90
PID 4588 wrote to memory of 896	4588	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	91
PID 896 wrote to memory of 3256	896	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	92
PID 3256 wrote to memory of 564	3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	93
PID 3256 wrote to memory of 1984	3256	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	99
PID 1336 wrote to memory of 3360	1336	CleanupConsole.exe	103
PID 3360 wrote to memory of 4852	3360	msedge.exe	104
PID 3360 wrote to memory of 4428	3360	msedge.exe	105
PID 3360 wrote to memory of 5228	3360	msedge.exe	106
PID 3360 wrote to memory of 4428	3360	msedge.exe	105
PID 3360 wrote to memory of 4428	3360	msedge.exe	105
PID 3360 wrote to memory of 6032	3360	msedge.exe	107
PID 3360 wrote to memory of 6032	3360	msedge.exe	107
PID 3360 wrote to memory of 2652	3360	msedge.exe	109
PID 3360 wrote to memory of 4340	3360	msedge.exe	110
PID 3360 wrote to memory of 2652	3360	msedge.exe	109
PID 3360 wrote to memory of 2652	3360	msedge.exe	109
PID 3360 wrote to memory of 4340	3360	msedge.exe	110
PID 3360 wrote to memory of 4340	3360	msedge.exe	110
PID 3360 wrote to memory of 4324	3360	msedge.exe	111
PID 3360 wrote to memory of 4324	3360	msedge.exe	111
PID 3360 wrote to memory of 4324	3360	msedge.exe	111
PID 3360 wrote to memory of 1060	3360	msedge.exe	112
PID 3360 wrote to memory of 1060	3360	msedge.exe	112
PID 3360 wrote to memory of 1060	3360	msedge.exe	112
PID 3360 wrote to memory of 3964	3360	msedge.exe	114
PID 3360 wrote to memory of 3964	3360	msedge.exe	114
PID 3360 wrote to memory of 1576	3360	msedge.exe	115
PID 3360 wrote to memory of 1576	3360	msedge.exe	115
PID 3360 wrote to memory of 5912	3360	msedge.exe	116
PID 3360 wrote to memory of 5912	3360	msedge.exe	116
PID 3360 wrote to memory of 5344	3360	msedge.exe	118
PID 3360 wrote to memory of 4544	3360	msedge.exe	121
PID 3360 wrote to memory of 4544	3360	msedge.exe	121
PID 3360 wrote to memory of 6040	3360	msedge.exe	122
PID 3360 wrote to memory of 6040	3360	msedge.exe	122
PID 1336 wrote to memory of 5284	1336	CleanupConsole.exe	124
PID 3360 wrote to memory of 5240	3360	msedge.exe	125
PID 3360 wrote to memory of 5240	3360	msedge.exe	125
PID 3360 wrote to memory of 5240	3360	msedge.exe	125
PID 1336 wrote to memory of 2756	1336	CleanupConsole.exe	126
PID 3360 wrote to memory of 3420	3360	msedge.exe	127
PID 3360 wrote to memory of 3420	3360	msedge.exe	127
PID 3360 wrote to memory of 3420	3360	msedge.exe	127
PID 3360 wrote to memory of 3480	3360	msedge.exe	128
PID 3360 wrote to memory of 3480	3360	msedge.exe	128
PID 3360 wrote to memory of 3480	3360	msedge.exe	128
PID 1336 wrote to memory of 2512	1336	CleanupConsole.exe	129
PID 3360 wrote to memory of 932	3360	msedge.exe	130
PID 3360 wrote to memory of 932	3360	msedge.exe	130
PID 3360 wrote to memory of 932	3360	msedge.exe	130
PID 3360 wrote to memory of 2436	3360	msedge.exe	131
PID 3360 wrote to memory of 3160	3360	msedge.exe	132
PID 3360 wrote to memory of 3532	3360	msedge.exe	133
PID 1336 wrote to memory of 4408	1336	CleanupConsole.exe	134
PID 3360 wrote to memory of 5284	3360	msedge.exe	135
PID 3360 wrote to memory of 5284	3360	msedge.exe	135
PID 3360 wrote to memory of 5284	3360	msedge.exe	135
PID 1336 wrote to memory of 5980	1336	CleanupConsole.exe	136
PID 3360 wrote to memory of 3540	3360	msedge.exe	137
PID 3360 wrote to memory of 3540	3360	msedge.exe	137
PID 3360 wrote to memory of 3540	3360	msedge.exe	137
PID 3360 wrote to memory of 2016	3360	msedge.exe	138
PID 3360 wrote to memory of 2016	3360	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\is-8FNG0.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8FNG0.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$4018C,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe /LANG=en /SL5="$4018C,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\is-64TQ7.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-64TQ7.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$A0068,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe" /LANG=en /SL5="$4018C,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe\" -Notify" /sc onlogon /TN "One System Care Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:564
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe' --scan" /sc ONCE /st 05:35 /sd 10/14/2026 /TN "One System Care Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1984

C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa4301c188,0x7ffa4301c194,0x7ffa4301c1a0
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16068572866000880681,2912669338166886043,262144 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,473945831980503134,16543470613713196502,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,6908148885738731309,3875736465476361913,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,2365991201317302814,2554260104174676289,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,11722956084107681060,1161902721542453812,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15527800984066342712,16971535476742362682,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,5017395185910660136,13782024924557672632,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,10719907624164593187,13001869542163090240,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,3570588538171802129,1691665099009263159,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,9764661841486829466,15192402553238670795,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1933996575735174248,6295105169252775374,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1933996575735174248,6295105169252775374,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9179177588056820133,15857825962706596344,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,7982946608842974376,14593653285042252792,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6688,i,7474866966242968798,13731787769161381368,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5132,i,11305607166642310652,13260226362262849961,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3676,i,7776202290511689159,3504325462819371662,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6652,i,4964923077784742577,14645060275378737674,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15443940712986314637,18369272511000541731,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1675888675431909650,7467946872567233754,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,1165606091942403895,16249351618690797207,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3144,i,4351459771547296505,10295307343253558729,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2456,i,11424183321020110242,4340393776964304642,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6960,i,13633160649094025436,910444201464258101,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4988,i,13023753775992579868,3219162530641425752,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4252,i,11444036218293910794,9537970085657291428,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4996,i,11834823655188825405,17101030061161098651,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,15893601618836103460,15727672533516882038,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:14
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7984,i,7220766674806188023,17961814537546496633,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6260,i,16808624932670472598,11936873587033300070,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6672,i,6868939224642563585,15562442578008937313,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8332,i,7589779719318522505,9232834842728267012,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8520,i,13969576599855189761,16305043617392685581,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8552,i,9155963856431664059,222027894978425637,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6648,i,4514322108995087731,833132463667592149,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8832,i,12461442862776245054,12483849969509767386,524288 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:14
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6680,i,13489024127620537393,7594703597398669666,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8920,i,9787538177486736745,15510657064419354709,2097152 --field-trial-handle=2272,i,8118371327092558437,17267963991226521189,262144 --variations-seed-version --mojo-platform-channel-handle=8904 /prefetch:1
    3⤵
    PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002721-US-244_625BEF3B-B0F3-473E-ABFC-18308FE98EDF&utm_source=331002721&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2612

C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
"C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CleanupConsole.exe

Path C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
Size 1.1MB
SHA256 4f68c3459b3189090fa9eb22dc0d3cacf4affce1c49b3221e905d8d78018d5e7
MD5 ef2fe64e0c2fef65942e634d595f46aa
SHA1 4b92863c3bdfdda4ffd1062aacee6323c24f02af
SHA512 abef82835e525dc93a54147d76dfea1b23e71b3b990fd4e84750cb93153175f7135e5cd7354094bb89aff2d41adc3600ad2bf19356b2175968d87124c2e28edc
SSDEEP 24576:XNvzpabVthaewMpj88DKVGRVd+Qvu+fmvxNbDNb/:mbhaQpj88LfmvxNbJ/
TLSH
T18635CF117982C432D1A205714CAEE7AE26BDBF208F2148CF73C42B1E9F75AD1A735697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSystemCare.exe

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
Size 3.3MB
SHA256 cb2c8e5e24e39d48ff49cf252aaf47ce78275a304e7b68f7390c43317e1de535
MD5 9e29b970621313e72935c853ed41f9f9
SHA1 4a4ed062d718789c48471e82f227ada07ee3d442
SHA512 d0f6a7f3d4897355a2cbeaa9bc36dd386f31cdd9b9835ec78ceda011aa1dc5a34789fe75feedc0dce6956611c3285a8c162dc6f444c970c47bb272be0bc3d8e8
SSDEEP 49152:LmIorm1VKYiSDlUXFfzfCVVgUmsruAZDwk4yOGoXryTLigSfM:tom1VK5SDlUXtCtZrujoOj7yTL
TLSH
T169F5AE311715B32ED02324B3662E26EA5015EF700BE48CBB67943A6BD6F87D2D63534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSystemCare.ini

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini
Size 833B
SHA256 79a63597f323ecec4e410f3fcf3cc4dfbab1bbb2a35ef4dd72379b9b3e370042
MD5 77a2738d5708a0b350cf9d23cd6b4f6f
SHA1 496c288626882492a555530f5a851074ec7fa41c
SHA512 67b880f298133700770e8023d17dca2336b507429f5c55055734a62a96672d64c455242b1ba55c8aa1bdd631903cd4d2e5715f64a6315f2f53926cab59811ae8
TLSH
T1AC01C2F94900487E85F5A03BD8F1636826E6DEC5CE103B7057C13589CFA511E97FA179
MD5 SHA1 SHA512 TLSH

Submit Download

OneSystemCare.ini

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini
Size 843B
SHA256 405d208ba86aaa60fd8c60bffaa1c13088fc48210954579ae7927818a0bfc65e
MD5 f87beb63c47b8bd39562b5fe818cfb03
SHA1 a61d58b747a76757dedba7a3e3df9cd3a1ae9497
SHA512 e2569975205baf715ed420e6acaf302540c55d8ae6268e15b7c53fac3820dac7f16467fcedbf34a22c351096cbd22ffaac583cb515ea26ac974204eeae5aa61c
TLSH
T14901EFF9490008BE86F1A03BD8B1236826E78EC58E102B7057C12989CFA511E96BA179
MD5 SHA1 SHA512 TLSH

Submit Download

OneSystemCare.exe

Path C:\ProgramData\dcbdb831-95af-4d21-874a-b8159552646c\OneSystemCare.exe
Size 929KB
SHA256 3eeffa9fa23e73186aded7269be31c251e7460cb866516f4acbea1415fab0184
MD5 b1b1114900528ad34decb187bc9092cd
SHA1 c6d774e827256e9c80aae0073926e852dee97899
SHA512 44fd8a8fb9f29a07e216823a6f1b48822f59e1ddf2a4592ad93c876f4e9a69a411a372035c7e0cf77e48f43384b1ec556b87b66afac9dd1eeb904aa76bd1637c
SSDEEP 12288:fUb9Xn7Mu3qI70c9viIROLTv33XNKSceZg0Y+vYNHKSy8YivuRWoUZMzJb/Ty7:fUJX7MA0c9vxkH3tKOfxlUnRaxTS
TLSH
T1E415CF37398A2932E787FD7E0BF3561E4AE118424722D69B6225CC37D15EFE091B1263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c175dfc-d694-4de6-b1a8-5c3faac33975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c175dfc-d694-4de6-b1a8-5c3faac33975.tmp
Size 38KB
SHA256 bb065971b92afe2eacb316a2c05e11567b56747a08b17c00a19ac50e657cf1ad
MD5 141a358f1993e005c6532d61d4ed4417
SHA1 a66dfe701d40151bc0520579c911b64ae4a2b39f
SHA512 20e2d1bd40879688fdf8c70cd5e18fc84670207ea4e811c993c0f110af98625f9d239a75af42d88e02be5e84b4dea6f655fce4c35d02255244212bfae9c93676
SSDEEP 768:8/UxvxjgC+I3vWxK3Bt2E57Y0GZxJsXBdK8EMSHUPpMs:pZj3+I3X70/JsXf7VSfs
TLSH
T1CE03D034E8619D6359FBE3A0360A73C7EEF415F3C4C14DA89AEA9B0C05872AD130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4de119b2-f724-4e93-92a5-49c96654a86c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4de119b2-f724-4e93-92a5-49c96654a86c.tmp
Size 37KB
SHA256 018d521a7397875b5ee1b00bf7d2ca5bb507f365c6a8a6ccb10d7fd56497184c
MD5 8f6e6ff28a197bf7a28d07829b5e9402
SHA1 00e3278924889a8e07e21fde8a2ed1efa104c188
SHA512 89cfd4455b09b02dee5a03a067a58ad6fe2e2bf24c1144f729b0984345fa3fdf0eec5aa1a1f36fb528684aa9f9c78cab235b97a04e512eb15cc89feb552ac8a2
SSDEEP 768:A/UxvxjgC+I3cwK3SE57Y0GZxJsXBdK8lWSHUPpMs:tZj3+I3m70/JsXf7USfs
TLSH
T16E03C034E8A05D775DF79390360A7397EEF446B3C5C55EA48AED6F0D028B2AD030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74f64cd5-9a27-4aae-b91c-b09b1fc70082.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74f64cd5-9a27-4aae-b91c-b09b1fc70082.tmp
Size 34KB
SHA256 df8797176c0fb96ca31ad588f4e7557bf4914279cf2ce2191e0e5ba45bc52783
MD5 cc3d5970b6bc66b86a22697506b9843d
SHA1 562b09c76337c82baee7cc20fcaf3f93da1c99c3
SHA512 03e124dfbfa38eabacde24971867120590bb47c8197e54b402bb216b0a3101ef0a352e05a3a5a8d231f05de55eef3af5f064e0251a1463fb556ca138fbdb8f2a
SSDEEP 768:xC38/K3Bt8E57Y0GZxJsXBdK8ZMykJqCG:xC3t70/JsXf7yyQc
TLSH
T1BBF2BF30E9A1DE7359FAD79176063683AEF452B3E5C44E58D5EADB0C0483ADE130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76da7904-ed7d-4bec-b80f-36f884591c2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\76da7904-ed7d-4bec-b80f-36f884591c2c.tmp
Size 37KB
SHA256 448a5ad88106299f73297bb130f812a22ad9c3e40796fa880a681f8ca2f16f60
MD5 8b3fb6dc397d2f9abd6fe2d71f687b61
SHA1 3554971f599647db4607935d57e46d54be16ab78
SHA512 ba4c188c74a730e52b6152d22dbb488ea6ba044dda5e8d7cef9c2b72f9bebfb42dbcb459ad7cc765bb1f39ce96b53c583c5f3012c7293af3171705bd39e731c4
SSDEEP 768:MFQE3qwgi4UBtKE57Y0GZxJsXBdK8ZMykJqCG:/E3x70/JsXf7yyQc
TLSH
T164037D31E9A0DF77ADFA9791B7057686AEE052B3C5C88DD8DAD99E4C00835DE0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

3247158f-c0ce-4b46-a314-fc9b09311b45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3247158f-c0ce-4b46-a314-fc9b09311b45.tmp
Size 12KB
SHA256 3acd15af60137909bd3d8673ebe1e50b5d6236f0bc82cda529383669e3d36b48
MD5 610f97dffc1aa0a5b388620d1a4e0373
SHA1 fe1230f56a1af09929f013fd767a0507a9985a2e
SHA512 f857b224be0786da286666f82ac6cdecc43149981f912de983fc3f965d0066965b8eca3e0142e0a51aba0cce679c80b337ffe832deda1207c58a99561488f21f
SSDEEP 192:sxRmRYCK/f+sQzZ4/6HpzoA8pw/nb6+WNvTIZYU2E9z0lG+IgDOVuvJ:sxRmBK/f+sQ94/6H0w/gUZy8ux
TLSH
T1D942A855AE28AA7B8CCBD21DBB55BF53D2F95032B0D11E48A6FC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a500cbf-e032-4150-8d2f-c1a62743b6a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a500cbf-e032-4150-8d2f-c1a62743b6a4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

99b37ea9-2c93-49ee-9bfb-ba252745318a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99b37ea9-2c93-49ee-9bfb-ba252745318a.tmp
Size 29KB
SHA256 8b46271fe30ce27e94351cb85690307592830fcb7be9d3b44b034919ce839f57
MD5 73f0f972b7573f2f931ae51fcc1df1be
SHA1 8e034742edf08b37753ef7b664db609fdb450906
SHA512 1a0a1122ca5474571f245b1d23e9e35910cb13c35a0a19d507a202e1893b338d0d363a883d8d8f002528708e253f7cc95106d12a1df97cf4fcaab08191683c56
SSDEEP 768:6Jajx+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE2gomBCro4ar:6Jajx+Eb/KWgm0fbbu1jaj2ghBZr
TLSH
T107D2DA7B740CCB7F4F900ADD9D197E9B6DA802CB9698CD8047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 68e3460c7bb7e8a42b4c9d5c64e03584031fe1406c6d3c6195aea779662d950c
MD5 3dd939c905804ddbe7e7b30091a62423
SHA1 8b12f6685ef277f0280e204cbda99f6c58c64896
SHA512 03b311bad726f678a8d6b289ddc870b103f0d6b1640c6d75e5a931e2f77a0d580275a11d3d42a48f0cab118ef2e51c94c68482bf7749ce4889e0b547b80c4e9a
TLSH
T14451E88241B18982FFBB0CB88BF10C87393446A1DCB31F1171A9D5F8B64E36750C947A
MD5 SHA1 SHA512 TLSH

Submit Download

b56b09ce-3dd0-4cdb-b958-aa169ababbe5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b56b09ce-3dd0-4cdb-b958-aa169ababbe5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3a5849bd-b260-4ac1-854b-2e287cdbc521.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a5849bd-b260-4ac1-854b-2e287cdbc521.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

54573dab-7258-4350-9830-e76249704157.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\54573dab-7258-4350-9830-e76249704157.tmp
Size 3KB
SHA256 b8b8e3d1ff8fe3fa4b3d97da46568474491eebc643b14132d9781e8c01bddf22
MD5 a8e24aba9576ed5cf3b9953cd61415f0
SHA1 fc8064bfa5fa69107539dd5bc187da10fb251972
SHA512 688b8b2d6edea6390a684d53206c46d62ba3b7def9cc625af0a14a7b5db457f786be5a59d817e3202f9d0549d5321c36f3fc7714d99ac87e698163c34efeb2c2
TLSH
T1B861B0F3C7E4826DDA0156F0AA146E1BDF5C0928432C3D5AC8E4AF1B93E24B1E18565E
MD5 SHA1 SHA512 TLSH

Submit Download

a5d70c61-911a-4be3-985b-f6a11b177237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5d70c61-911a-4be3-985b-f6a11b177237.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23d4f13278fd2950a2f69eb880cc990b597a9400b1d3e08a8015d84e373813e6
MD5 192c1dbcc9c4e8a075fc470c1cd64498
SHA1 e92f404a1e1ac5f305ec44450c6b2491a7b2c369
SHA512 a0a50bd3d14f81760a96470ab0a6651fbc674cb1de1eb38789739aa8cddd3c8b6fb15bc0f97236fac914d4ed5264b168e030d53eec12c3e3af642e9589fad4b7
SSDEEP 192:sxRFRYCK/f+sszZ4/62pzoA8pi/nH6+WNIYU21ftSlG+IgVVuvJ:sxRFBK/f+ss94/620i/UIdbux
TLSH
T11242B855AE28A93B8CCBD31DBB557F53D6F95032A0D51E48E6FC8A1C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c2765cc1f4a1452cf04429d78017a3b72412f4683b0fe1b10fbeb9553cdce9da
MD5 18048b5ac92a993d52933b08fd5fbb76
SHA1 1aefffb64e8a8ca487b5a15f23b5d117b4d29ec7
SHA512 10064e8a50ea5a2bd094b48ed03b23e3b102b3464f92ef223279639352256aba7d49404e0554c9edccef15ee37087e86fd26e9b05eea2b268d4d5131faa70a63
SSDEEP 48:K+1qZlbnzkDnAPIAdkKBB5TkNF06gbF5yxGIXKLKAL/IdKUEoHyW:KEKYKDySCGcKLKI/WKUESR
TLSH
T175913F21307B465339BD3A0C90A5979B568271A33029EB2F7BE950B64E6FE040DBD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a493c5a0-9887-4a72-b7bf-ccd87d1f9dc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a493c5a0-9887-4a72-b7bf-ccd87d1f9dc6.tmp
Size 12KB
SHA256 5fa9d0c736ee8ddc5814ec6a8fead2cd36ded4a7629f362edb9ae7047f371036
MD5 8e2b060c6ee05a8b76e7af6234e956dc
SHA1 d610a9a958258360a140b30f6f23f614a8deb89f
SHA512 1ce56df9f5ad94c8b9f7eebe2aad56e26e68413c08debc292e3301e3bf6da43ab23e476ed2580f0f5459d2f4698c362a8f753b1a84ea40d949cc546a07ea61ff
SSDEEP 192:sxRmRYCK/f+sQzZ4/6ipzoA8pi/nWMt6+WNv4v/YU2v9zSlG+IgDOVuvJ:sxRmBK/f+sQ94/6i0i/sA/F8ux
TLSH
T19C42C955AE28A97B8CCBD31DBB557F53D2F91032A0D11E48A6FC861C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6df3bde-a637-4cb1-a93c-09c797aa520c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a6df3bde-a637-4cb1-a93c-09c797aa520c.tmp
Size 11KB
SHA256 269edbf8ee85258617d0719e367cc26b419c0105558c5e995b7be0aef396738c
MD5 48b7560e26677bbb6ed718920ccb28c9
SHA1 2b6ee235bd4e11c9dc9af4c2fdf9807d5d634417
SHA512 54e44912fa2736802919ee155fb88968d76e68c2f88b99e42f87c377a22ac5a87c6c625ad5f5c3c71819c474ce9b7b1030b556aacdb3b900d2693ea65e843aec
SSDEEP 192:sxRmRYCK/f+svzZ4/62pzoA8pi/nT6+WNIYU21ftSlG+IgDcVuvJ:sxRmBK/f+sv94/620i/oIdqux
TLSH
T11942A855AE68A93B8CCBD31DBB55BF53D6F91032A0D51E48E6FC4A1C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b060efed-6a10-41f5-9174-7755e98c576e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b060efed-6a10-41f5-9174-7755e98c576e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31c2043a-8740-4e8e-a869-0d87f2122a27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\31c2043a-8740-4e8e-a869-0d87f2122a27.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc889923-245d-433a-a0b2-60cb3f6e274b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bc889923-245d-433a-a0b2-60cb3f6e274b.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

eb73257c-de7b-45ab-9e6a-50c6e5cc6b71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eb73257c-de7b-45ab-9e6a-50c6e5cc6b71.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e84e0114-2e82-410b-abbc-8d4258326239.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e84e0114-2e82-410b-abbc-8d4258326239.tmp
Size 39KB
SHA256 681d8a51089f2c757ad57c09cb57a9874624ba6f6d36f772e643e2ff56b7f23a
MD5 aa03fe92633da6433dccf436059e454d
SHA1 d92f19ecf17f497c93a9b75411aceb2695bf27ec
SHA512 2d4aacdc0c005b889e452b72806390d001f6c063452b914089f69ac560bed16526cf2cd85dc19f328cdb9b56dc0d9e80ea5f6020fcc3ca02e7178684d23c0c0f
SSDEEP 768:F/UxvxjgC+r3c6bK3Bt8E57Y0GZxJsXBdK8ZM+C:oZj3+r3m70/JsXf7y+C
TLSH
T12003CF34A8A5AD6358FBE350360A73C7EEB416B3D4C54E68CAEA9B0C05872DD170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee86750b-568d-444f-9485-7a1b98062c59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee86750b-568d-444f-9485-7a1b98062c59.tmp
Size 34KB
SHA256 c0a9d74e7b729458f26652e9f9a1a2ef65c0a6f8a178161eb56ffff5652d531d
MD5 965d616a9f1abbfc2f280dd52844463c
SHA1 e752e8f03d60eb659efa54dd686b2c5754725a1b
SHA512 5d6703a785caa21a8c983d733dd84d6d6c1b89b62b7cfe7b592c5064e665558b4949c29a9070a23501ae21c41055cf0e621f9c445d73d5ccf27539aad8ebfef4
SSDEEP 768:5C30AbK3Bt8E57Y0GZxJsXBdK8ZMykJqCG:5C3670/JsXf7yyQc
TLSH
T1F1F2BF30E9A1DE7359FAD79176063683AEF452B3E5C44E58D5EADB0C04836DE130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

815d25c3-129a-443b-b59c-7fac3f36dc01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\815d25c3-129a-443b-b59c-7fac3f36dc01.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4db1ba4b-6692-4b53-b337-85b7000da4a8.tmp

Path C:\Users\Admin\AppData\Local\Temp\4db1ba4b-6692-4b53-b337-85b7000da4a8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd6636e3-64f4-4538-8d67-2cbe9e7d2981.tmp

Path C:\Users\Admin\AppData\Local\Temp\bd6636e3-64f4-4538-8d67-2cbe9e7d2981.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8FNG0.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Size 1.2MB
SHA256 a7980ea6e8a1c3ea2affb2b5bc12d1d553e6f08bd24995e1f61dd80c56eb9506
MD5 5576331531ea628d83b90682bce03f18
SHA1 a98be9b662b84319f35fdb81f1596086091d582d
SHA512 3d7c1f4599ecab98ee24756f199e367d83e6c2a1d7dfd6438331b387ae81ca4ec26025230e66e4800e2813493dc000ac9738292165c5018a9f5b855ada560852
SSDEEP 24576:ntdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt51Tx9vM:tqTytRFk6ek17+
TLSH
T1DC452922A3D24437D5731F759C6BC2946C367E202EA4E54A7EF89E0C0E79B81BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-DTMOQ.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

ydwqk.dll

Path C:\Users\Admin\AppData\Local\Temp\is-DTMOQ.tmp\ydwqk.dll
Size 1.6MB
SHA256 2c4658c487114e36e2b9e75bf1c97dc034ce080dc6bc5f3a45e83aeb573dd631
MD5 fc4b0ea55c7632a0cd000bef5e658243
SHA1 71c8eaa31613a14faaa4634f0d402cb3b8285456
SHA512 54744d9031736e57e03c2567c59586d8c0bbbf0743022ed1c8719a12c7347f4206341314b31a7656f42d1a201ddb4ef75d39be2681aed2e48c627e742068e149
SSDEEP 24576:jrqDgaHzs9aPn2OMIcp6d0Wm0dbgbT5osoP3:81YwP2LzoCSFso
TLSH
T12075D023B4828432C172133019BB7F7516FF9A2907B149CB9398AA74AF345D36B36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_1071033580\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CallBanner.png

Path C:\Users\Admin\AppData\Roaming\One System Care\CallBanner.png
Size 44KB
SHA256 a3724642f134a3503a79f71ca938dcafeeba72465f62e0fb575d32245f294a39
MD5 9ab57370d71f7f15e72d9471c5881d59
SHA1 66754aa273efa3d84c9aaa285eacbb7b2740060e
SHA512 65d9438c1cfef610d7a75b5f3aec5e79d0a57e00cdb6d79fd9e13219456f202661c333aed7f8240767e81c2472990c21e0a3bd41a81b6bb0ee36c1f4066a94c9
SSDEEP 768:Lce52r5Qe2I4UqTCr5F2nvH/eIWL2MwMIHBvrADJM3aWt502fcRWJ3CcZ3XWqxm9:552r5QeHVXF2HeIwF+vrADJM3aCVfcRz
TLSH
T1C423A27B96212C3B0AA341F870B5BB4DF6E6C101EB43C25489FA5BD7A3C5E629D7241C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\English.json
Size 40KB
SHA256 1cba9726d30faaf69c4a79b0323d422513fb9b107e288d57d23e1562b62ce41b
MD5 73628eeb89155df245626ed656035b5a
SHA1 12f23d4312c2f1ac661bd6d7f7ed55683b516d35
SHA512 773df6696ff5c7975b2731c4139ed89cd67ca5a93ba1b2a0d9cb435e6111891c7a3cb84ae7fb9c1e9ae51bfff207c070d82034290cdd822ed22a6dc56c754278
SSDEEP 768:pInAwZtNOfOyl3iPlqP04eUH3d7GNafVXLZZheRv5B:pInANnkQJtkafV7oh5B
TLSH
T1F103E08BB697C2DD0E80F247812E760A01FF2EC408A9615A78E985B12FC5479B5BE40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Parameters.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\Parameters.json
Size 910B
SHA256 e1cadab805a5b25c6a6b3d332278412034290c9a8991e089c25c08243ef73915
MD5 edf16921760f499b89226e8a7f9e42dc
SHA1 34adaff0aa75e4f23c44da8956b8955e7803b7a9
SHA512 4fa3c14fadd3110ce28f10961e3df39701878382df1efef5e2b4c637c57b762fb36882a29c134988939e9e4fb8507c1e3ca2bbe9e8797d2735355bbd3d3a245f
TLSH
T1E511EBDFA7BD30005D1C0A133F9355040905ED11C7CB0F44B1A02CF00776652F597129
MD5 SHA1 SHA512 TLSH

Submit Download

is-O5RVO.tmp

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\is-O5RVO.tmp
Size 39KB
SHA256 3d79643b0364e95a5d2c23414f22d9621f7d4d9abbd0b674f5328d5dd9be5d69
MD5 301aae525b1b00130e5ff774f20f4efd
SHA1 b89b6c9c88f740fdc5c6bcd4c17cbbc78fe8338a
SHA512 158af32bc0844c088f9131ca3185e2a51ffab594108181347240e1d85d60a53f8928cc036b16f16ddda725c4b7aec5a909bfca892908d9b94b2d9e1ef995db40
SSDEEP 768:pInAwZtNOhAOyl3iPlq85M/JsihcTgVSHb5Zp23m/gccubvf6OQ1:pInAfAnkQkU3Vy9e3Ogcccq
TLSH
T13503F11B3C53B8C54A875D6B820F6E5A80329DE50434906A273D50B97FCAD3A88BF71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpLang.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\tmpLang.json
Size 26KB
SHA256 3d997792150da91ac71f443d3f384eead455ab017d7622f0b18e3a6d344fe75a
MD5 76ca06abcd5b5c252bd10fe465993e83
SHA1 249126aac09f7262ac1adf460742ee8cae101dea
SHA512 be5ea6b7fe2d7e20d6c070971d71748177efa531fc4c6de8fc36e8d61b2fddc203eeeeda646efa5991072c8f97d17774bf0997c1ed6922e6533c9b573bf58ab0
SSDEEP 384:nod5cvfuDZEjHpn6rAlFWbFOEGZD9qCMFs/I68wETQOZ8pi6wLHRM3P5PfAk6:od5cvfY6tn6rAKSwsw68w0Z8sG3P5Ph6
TLSH
T191C2F02B9B240C9F45F8B19CA5026B762CAF306CD3660B0D5A8DB05EEF1E9951F3116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpParam.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\tmpParam.json
Size 515B
SHA256 8dcc3d35795a6c59bf78fdab7c145e5707fe43bfe6bcfba874774a2f6e145dac
MD5 803042060cf01d934d48a614f0c22eff
SHA1 f03e0120c86e9c4637cfa8a2026c7a061b53b479
SHA512 c195261046fd07d3433409619b8ce20f3cbfe6c63e17d5016e4561b79f52988a24ea883bec323d856cf88a4f13f1c0a1202e1ffe456560e9b27e84b95068e832
TLSH
T119F09006AF0DBB1B673A46903605899530201F4F247D8CA2BBB7E4CCB1D983512987D9
MD5 SHA1 SHA512 TLSH

Submit Download

20261014i-0530.log

Path C:\Users\Admin\AppData\Roaming\OneSystemCare\log\20261014i-0530.log
Size 5B
SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
MD5 3bab25a3e651a9e4a00473d2257b99f9
SHA1 1419458f2696be8daeade77ddad380cd0c871fdb
SHA512 ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff
MD5 SHA1 SHA512

Submit Download

Launch One System Care.lnk

Path C:\Users\Admin\Desktop\Launch One System Care.lnk
Size 1KB
SHA256 56d98a25147a27eaf5ac602be221b684be25a2838afbd1fd1963d7c319ba9b6a
MD5 78ca046b5627af1451d8fe54c8f91567
SHA1 1382140a10affec70773ba25f69c11a2fdca37fe
SHA512 579c45052cd6d1102f7bcf3c1a4c34d2ed2b9b70dbc25b6914bd1cd1212c0b68e2174736726dd292e2b26309749a9864c2d5d144f10c11f3fbfcbb44b38b193e
TLSH
T17D11AF7626DE872ED3B3833356714660E673F8157BD94E0B408722C40922B077DA6F6E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1454907439\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_2143547968\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/896-48-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/896-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/896-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1204-40-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1204-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1204-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1336-143-0x000000001C470000-0x000000001C58E000-memory.dmp

Download

memory/1336-148-0x000000001C470000-0x000000001C58E000-memory.dmp

Download

memory/1336-146-0x000000001C470000-0x000000001C58E000-memory.dmp

Download

memory/2832-147-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-150-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-153-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-154-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-155-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-156-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-151-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-152-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/2832-145-0x00000000175E0000-0x000000001793B000-memory.dmp

Download

memory/3256-140-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3256-67-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3256-64-0x0000000073F70000-0x0000000074113000-memory.dmp

Download

memory/3256-63-0x0000000073F70000-0x0000000074113000-memory.dmp

Download

memory/3256-62-0x0000000073F70000-0x0000000074113000-memory.dmp

Download

memory/4588-37-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-32-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-44-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-43-0x00000000744D2000-0x00000000744D4000-memory.dmp

Download

memory/4588-41-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4588-42-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/4588-46-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4588-36-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-35-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-27-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-28-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-29-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-31-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-33-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-34-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-47-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-30-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-19-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-20-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-21-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-23-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-24-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-25-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-26-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-22-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-16-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-17-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-18-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-14-0x00000000744D2000-0x00000000744D4000-memory.dmp

Download

memory/4588-15-0x00000000744D0000-0x0000000074673000-memory.dmp

Download

memory/4588-6-0x0000000002310000-0x0000000002311000-memory.dmp

Download