b4b190b7a49448f24bc7d799ba0fcaae0571d9daa33c4c5ce38788b8044b2ea7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Executes dropped EXE 4 IoCs

pid	Process
516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5996	CleanupConsole.exe
1048	OneSystemCare.exe

Loads dropped DLL 4 IoCs

pid	Process
516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OneSystemCare\is-LVP57.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-1T8EF.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-A5LQC.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_303421929\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files (x86)\OneSystemCare\is-UN4I2.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-4QUI1.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_303421929\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_379065528\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_379065528\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_303421929\keys.json	msedge.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\ydwqk.dll	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-2N9AQ.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_379065528\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_303421929\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2852_379065528\deny_full_domains.list	msedge.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini	OneSystemCare.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\One System CarePeriod.job	OneSystemCare.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CleanupConsole.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2600	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1880-0-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2768-38-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/1880-52-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2768-57-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2768-132-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9F64C28A-272B-4541-9EA0-6E493456D152}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2208	schtasks.exe
1892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1048	OneSystemCare.exe
Token: SeCreatePagefilePrivilege	1048	OneSystemCare.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5996	CleanupConsole.exe
5996	CleanupConsole.exe
1048	OneSystemCare.exe
2852	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5996	CleanupConsole.exe
5996	CleanupConsole.exe
1048	OneSystemCare.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5996	CleanupConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 516	1880	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	84
PID 516 wrote to memory of 2768	516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	90
PID 2768 wrote to memory of 5144	2768	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	91
PID 5144 wrote to memory of 2208	5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	99
PID 5144 wrote to memory of 1892	5144	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	104
PID 5996 wrote to memory of 2852	5996	CleanupConsole.exe	112
PID 2852 wrote to memory of 3520	2852	msedge.exe	113
PID 2852 wrote to memory of 2600	2852	msedge.exe	114
PID 2852 wrote to memory of 5884	2852	msedge.exe	115
PID 2852 wrote to memory of 5884	2852	msedge.exe	115
PID 2852 wrote to memory of 5884	2852	msedge.exe	115
PID 2852 wrote to memory of 3448	2852	msedge.exe	116
PID 2852 wrote to memory of 3448	2852	msedge.exe	116
PID 2852 wrote to memory of 2924	2852	msedge.exe	118
PID 2852 wrote to memory of 2924	2852	msedge.exe	118
PID 2852 wrote to memory of 5084	2852	msedge.exe	119
PID 2852 wrote to memory of 2924	2852	msedge.exe	118
PID 2852 wrote to memory of 5084	2852	msedge.exe	119
PID 2852 wrote to memory of 5084	2852	msedge.exe	119
PID 2852 wrote to memory of 4924	2852	msedge.exe	125
PID 2852 wrote to memory of 4424	2852	msedge.exe	126
PID 2852 wrote to memory of 4924	2852	msedge.exe	125
PID 2852 wrote to memory of 4424	2852	msedge.exe	126
PID 2852 wrote to memory of 5700	2852	msedge.exe	128
PID 5996 wrote to memory of 1732	5996	CleanupConsole.exe	135
PID 2852 wrote to memory of 4780	2852	msedge.exe	136
PID 2852 wrote to memory of 4780	2852	msedge.exe	136
PID 2852 wrote to memory of 4780	2852	msedge.exe	136
PID 2852 wrote to memory of 3196	2852	msedge.exe	137
PID 2852 wrote to memory of 3196	2852	msedge.exe	137
PID 2852 wrote to memory of 3196	2852	msedge.exe	137
PID 2852 wrote to memory of 1140	2852	msedge.exe	138
PID 2852 wrote to memory of 652	2852	msedge.exe	139
PID 2852 wrote to memory of 5076	2852	msedge.exe	140
PID 5996 wrote to memory of 2020	5996	CleanupConsole.exe	141
PID 2852 wrote to memory of 5328	2852	msedge.exe	142
PID 2852 wrote to memory of 5328	2852	msedge.exe	142
PID 2852 wrote to memory of 5328	2852	msedge.exe	142
PID 2852 wrote to memory of 844	2852	msedge.exe	143
PID 2852 wrote to memory of 844	2852	msedge.exe	143
PID 2852 wrote to memory of 3436	2852	msedge.exe	145
PID 2852 wrote to memory of 3436	2852	msedge.exe	145
PID 2852 wrote to memory of 3436	2852	msedge.exe	145
PID 5996 wrote to memory of 3868	5996	CleanupConsole.exe	146
PID 2852 wrote to memory of 3212	2852	msedge.exe	147
PID 2852 wrote to memory of 3212	2852	msedge.exe	147
PID 2852 wrote to memory of 3212	2852	msedge.exe	147
PID 5996 wrote to memory of 4620	5996	CleanupConsole.exe	148
PID 2852 wrote to memory of 4940	2852	msedge.exe	149
PID 2852 wrote to memory of 4940	2852	msedge.exe	149
PID 2852 wrote to memory of 4940	2852	msedge.exe	149
PID 2852 wrote to memory of 5396	2852	msedge.exe	150
PID 2852 wrote to memory of 5396	2852	msedge.exe	150
PID 2852 wrote to memory of 2020	2852	msedge.exe	153
PID 2852 wrote to memory of 2020	2852	msedge.exe	153
PID 2852 wrote to memory of 2020	2852	msedge.exe	153
PID 5996 wrote to memory of 2944	5996	CleanupConsole.exe	154
PID 2852 wrote to memory of 792	2852	msedge.exe	155
PID 2852 wrote to memory of 792	2852	msedge.exe	155
PID 2852 wrote to memory of 792	2852	msedge.exe	155
PID 2852 wrote to memory of 4388	2852	msedge.exe	156
PID 2852 wrote to memory of 4388	2852	msedge.exe	156
PID 2852 wrote to memory of 2476	2852	msedge.exe	157
PID 2852 wrote to memory of 2476	2852	msedge.exe	157

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\is-35EBD.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-35EBD.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$5024A,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe /LANG=en /SL5="$5024A,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\is-2K8AF.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2K8AF.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$90248,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe" /LANG=en /SL5="$5024A,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5144
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe\" -Notify" /sc onlogon /TN "One System Care Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2208
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe' --scan" /sc ONCE /st 05:38 /sd 10/14/2026 /TN "One System Care Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1892

C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ffa4405c188,0x7ffa4405c194,0x7ffa4405c1a0
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14471121440372878720,7103111048835116591,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,4733846736305353998,1742557116058196881,262144 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,14501783515413990484,16408192812775099049,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15915906065938005176,15719393487801382742,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,5046244336115271864,17615091553336063049,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,1260578556304715150,3270338131178871722,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,16230534684015857632,2315651264625760642,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,14116605954878825326,4004435827926536614,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,14116605954878825326,4004435827926536614,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5796,i,15624247468742642733,13965977130474936858,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6280,i,8529652853489032858,17106225721844465773,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,2494301348452472726,17855895947352943700,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,14737832944194619926,5716022388958920075,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,8556836380677572122,18426967027892002354,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3560,i,10609006018431450254,17783227316713105068,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3112,i,7122342683939836210,14667116587257978167,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5192,i,18008073142234537019,4568019019168852850,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3632,i,13832511353158317603,12622991646341075521,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6620,i,7250261982884176474,9063706404328362878,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,423988941571018816,9063690557025830008,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7080,i,6259685284588200667,13614693522683955673,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6400,i,7129131470744510938,7851031490936718439,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,1488850983591671110,15611758037443862367,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:8
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6416,i,10134875047131199396,10379549001298158868,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6468,i,4599073084471709457,15492284830460891110,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7472,i,10414408133058458564,3918264883646013695,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7524,i,4860465737384233738,1275742652033390908,524288 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7756,i,8092293220377803222,8559519569456419569,2097152 --field-trial-handle=1884,i,15331736619242967796,983387679204148092,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
    3⤵
    PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_881EF307-277F-40A2-B5D5-BE252E3E59E5&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4884

C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
"C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery