b4b190b7a49448f24bc7d799ba0fcaae0571d9daa33c4c5ce38788b8044b2ea7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Size 4.1MB
Sample261014-e585bav18p
SHA256 b4b190b7a49448f24bc7d799ba0fcaae0571d9daa33c4c5ce38788b8044b2ea7
MD5 56bb25e3f41034cea891babcd5d7748d
SHA1 95f162c67e709d2d518c852278847edaa86d485e
SHA512 241637565dfdca71067cb799487a48e5f230f952eb725347ebaee77be7f87cee58cc1aa8360de6805df56920bd620deab8da1c8fe63a51fea810940a3fb6ef5a
SSDEEP 98304:6rIfJGonKVb3Gp+/ew74o0jVIUOr6kr+TQJ8XhnsaID:6UfCEpo7VOIRHvJ8saID
TLSH
T1BF16334663D24476E2244B74D8BD83407D23BD1C19E3E7AB6CB4E66E0AFB2C5CA31613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4168	CleanupConsole.exe
768	OneSystemCare.exe

Loads dropped DLL 4 IoCs

pid	Process
4516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\OneSystemCare\ydwqk.dll	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-LPJAS.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-707PR.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-OV2A1.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini	OneSystemCare.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-E65BB.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-8LUQR.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-G9EQF.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\One System CarePeriod.job	OneSystemCare.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5316_1493468347\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5316_984015511\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5316_984015511\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CleanupConsole.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CleanupConsole.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneSystemCare.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CleanupConsole.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/2888-39-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/4624-49-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/2888-62-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/4624-66-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/4624-139-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OneSystemCare.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{3CE67887-3CEA-4D8E-BEBF-D0BFD75D0287}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2736	schtasks.exe
3288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	768	OneSystemCare.exe
Token: SeCreatePagefilePrivilege	768	OneSystemCare.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4168	CleanupConsole.exe
4168	CleanupConsole.exe
768	OneSystemCare.exe
5316	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4168	CleanupConsole.exe
4168	CleanupConsole.exe
768	OneSystemCare.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	CleanupConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4516	2888	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	89
PID 4516 wrote to memory of 4624	4516	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	90
PID 4624 wrote to memory of 3900	4624	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	91
PID 3900 wrote to memory of 2736	3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	93
PID 3900 wrote to memory of 3288	3900	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	95
PID 4168 wrote to memory of 5316	4168	CleanupConsole.exe	102
PID 5316 wrote to memory of 4432	5316	msedge.exe	103
PID 5316 wrote to memory of 3796	5316	msedge.exe	105
PID 5316 wrote to memory of 4668	5316	msedge.exe	104
PID 5316 wrote to memory of 3796	5316	msedge.exe	105
PID 5316 wrote to memory of 3796	5316	msedge.exe	105
PID 5316 wrote to memory of 1704	5316	msedge.exe	106
PID 5316 wrote to memory of 1704	5316	msedge.exe	106
PID 5316 wrote to memory of 5764	5316	msedge.exe	108
PID 5316 wrote to memory of 5764	5316	msedge.exe	108
PID 5316 wrote to memory of 2736	5316	msedge.exe	109
PID 5316 wrote to memory of 5764	5316	msedge.exe	108
PID 5316 wrote to memory of 2736	5316	msedge.exe	109
PID 5316 wrote to memory of 2736	5316	msedge.exe	109
PID 5316 wrote to memory of 236	5316	msedge.exe	110
PID 5316 wrote to memory of 244	5316	msedge.exe	111
PID 5316 wrote to memory of 236	5316	msedge.exe	110
PID 5316 wrote to memory of 236	5316	msedge.exe	110
PID 5316 wrote to memory of 244	5316	msedge.exe	111
PID 5316 wrote to memory of 244	5316	msedge.exe	111
PID 5316 wrote to memory of 5160	5316	msedge.exe	112
PID 5316 wrote to memory of 5160	5316	msedge.exe	112
PID 5316 wrote to memory of 4568	5316	msedge.exe	114
PID 5316 wrote to memory of 4568	5316	msedge.exe	114
PID 5316 wrote to memory of 1368	5316	msedge.exe	115
PID 5316 wrote to memory of 1368	5316	msedge.exe	115
PID 5316 wrote to memory of 3980	5316	msedge.exe	117
PID 5316 wrote to memory of 4896	5316	msedge.exe	118
PID 5316 wrote to memory of 4896	5316	msedge.exe	118
PID 5316 wrote to memory of 1764	5316	msedge.exe	119
PID 5316 wrote to memory of 1764	5316	msedge.exe	119
PID 4168 wrote to memory of 1176	4168	CleanupConsole.exe	123
PID 5316 wrote to memory of 5676	5316	msedge.exe	124
PID 5316 wrote to memory of 5676	5316	msedge.exe	124
PID 5316 wrote to memory of 5676	5316	msedge.exe	124
PID 4168 wrote to memory of 3340	4168	CleanupConsole.exe	125
PID 5316 wrote to memory of 2068	5316	msedge.exe	126
PID 5316 wrote to memory of 2068	5316	msedge.exe	126
PID 5316 wrote to memory of 2068	5316	msedge.exe	126
PID 5316 wrote to memory of 5412	5316	msedge.exe	127
PID 5316 wrote to memory of 5412	5316	msedge.exe	127
PID 5316 wrote to memory of 5412	5316	msedge.exe	127
PID 4168 wrote to memory of 5276	4168	CleanupConsole.exe	128
PID 5316 wrote to memory of 1204	5316	msedge.exe	129
PID 5316 wrote to memory of 1204	5316	msedge.exe	129
PID 5316 wrote to memory of 1204	5316	msedge.exe	129
PID 5316 wrote to memory of 5788	5316	msedge.exe	130
PID 5316 wrote to memory of 5604	5316	msedge.exe	131
PID 5316 wrote to memory of 5764	5316	msedge.exe	132
PID 4168 wrote to memory of 5968	4168	CleanupConsole.exe	133
PID 5316 wrote to memory of 1696	5316	msedge.exe	134
PID 5316 wrote to memory of 1696	5316	msedge.exe	134
PID 5316 wrote to memory of 1696	5316	msedge.exe	134
PID 4168 wrote to memory of 5144	4168	CleanupConsole.exe	135
PID 5316 wrote to memory of 3460	5316	msedge.exe	136
PID 5316 wrote to memory of 3460	5316	msedge.exe	136
PID 5316 wrote to memory of 3460	5316	msedge.exe	136
PID 5316 wrote to memory of 5444	5316	msedge.exe	137
PID 5316 wrote to memory of 5444	5316	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\is-841N0.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-841N0.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$70216,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe /LANG=en /SL5="$70216,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\is-7H3D1.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7H3D1.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$400A4,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe" /LANG=en /SL5="$70216,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe\" -Notify" /sc onlogon /TN "One System Care Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2736
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe' --scan" /sc ONCE /st 05:38 /sd 10/14/2026 /TN "One System Care Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3288

C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffe4a2dc188,0x7ffe4a2dc194,0x7ffe4a2dc1a0
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4073927950865915455,1569193634634928762,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,5678394034789543716,2835435723318946870,262144 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8897109603211072459,12550059779844772165,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,9432772004223046619,14520522705648736811,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,2757830247884136595,8343615166103980736,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,18345467721957298224,7976880281997465180,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,9429221592012747868,1861633897977526268,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:9
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,3901557319964560697,1850804749709654285,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15667320457528416087,1515991490659495404,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14266372916342024141,12000102122609857185,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15664312207457595337,3035677463247995877,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15664312207457595337,3035677463247995877,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,5205154070515300252,4896959399976945312,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13023726032468792114,14308684306318278663,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6360,i,5768687570183992787,14886908063396729903,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5228,i,9006162892118630701,9479309415395956215,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6104,i,10890047109883115520,18184292869079651134,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6852,i,16747354639039807769,16688111447860483247,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,2923086265331311503,14142525704868321584,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,182879830365140502,18093821739578244758,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,12044201719494536928,12846370450683442733,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3240,i,6663366241911514268,18053211461012605651,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7084,i,1567529431895678891,6200722334716110965,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7052,i,17609214239544518557,5657417609774803611,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4620,i,6086600099019319381,16856943111171696951,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5124,i,17639023437687026829,15397550383125634822,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7500,i,16456202887480503296,8712364337491134271,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7792,i,4707954890814991490,9453939649338758586,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8068,i,13120983112933767447,4727979036178621717,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5884,i,4239271195381240027,11867020739940303514,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8208,i,8053526772408183318,13886443201260985862,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8256 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,17325088016141378976,9880605918664809604,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8576,i,13833521634598946961,10513670021532205756,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8416,i,11163472003554548993,4653774045299672998,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6188,i,317721508238599888,17309774271806484673,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8456,i,12496692876409091933,144367674535671344,2097152 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8940,i,7228757464044958086,2554402511185399616,524288 --field-trial-handle=2308,i,13128781119986694541,4084799072557668047,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:14
    3⤵
    PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002113-US-351_73EF795F-5D60-4701-9041-2A97AE7D2FA9&utm_source=331002113&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:916

C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
"C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CleanupConsole.exe

Path C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
Size 1.1MB
SHA256 4f68c3459b3189090fa9eb22dc0d3cacf4affce1c49b3221e905d8d78018d5e7
MD5 ef2fe64e0c2fef65942e634d595f46aa
SHA1 4b92863c3bdfdda4ffd1062aacee6323c24f02af
SHA512 abef82835e525dc93a54147d76dfea1b23e71b3b990fd4e84750cb93153175f7135e5cd7354094bb89aff2d41adc3600ad2bf19356b2175968d87124c2e28edc
SSDEEP 24576:XNvzpabVthaewMpj88DKVGRVd+Qvu+fmvxNbDNb/:mbhaQpj88LfmvxNbJ/
TLSH
T18635CF117982C432D1A205714CAEE7AE26BDBF208F2148CF73C42B1E9F75AD1A735697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSystemCare.exe

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
Size 3.3MB
SHA256 cb2c8e5e24e39d48ff49cf252aaf47ce78275a304e7b68f7390c43317e1de535
MD5 9e29b970621313e72935c853ed41f9f9
SHA1 4a4ed062d718789c48471e82f227ada07ee3d442
SHA512 d0f6a7f3d4897355a2cbeaa9bc36dd386f31cdd9b9835ec78ceda011aa1dc5a34789fe75feedc0dce6956611c3285a8c162dc6f444c970c47bb272be0bc3d8e8
SSDEEP 49152:LmIorm1VKYiSDlUXFfzfCVVgUmsruAZDwk4yOGoXryTLigSfM:tom1VK5SDlUXtCtZrujoOj7yTL
TLSH
T169F5AE311715B32ED02324B3662E26EA5015EF700BE48CBB67943A6BD6F87D2D63534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSystemCare.ini

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini
Size 833B
SHA256 79a63597f323ecec4e410f3fcf3cc4dfbab1bbb2a35ef4dd72379b9b3e370042
MD5 77a2738d5708a0b350cf9d23cd6b4f6f
SHA1 496c288626882492a555530f5a851074ec7fa41c
SHA512 67b880f298133700770e8023d17dca2336b507429f5c55055734a62a96672d64c455242b1ba55c8aa1bdd631903cd4d2e5715f64a6315f2f53926cab59811ae8
TLSH
T1AC01C2F94900487E85F5A03BD8F1636826E6DEC5CE103B7057C13589CFA511E97FA179
MD5 SHA1 SHA512 TLSH

Submit Download

OneSystemCare.ini

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini
Size 843B
SHA256 405d208ba86aaa60fd8c60bffaa1c13088fc48210954579ae7927818a0bfc65e
MD5 f87beb63c47b8bd39562b5fe818cfb03
SHA1 a61d58b747a76757dedba7a3e3df9cd3a1ae9497
SHA512 e2569975205baf715ed420e6acaf302540c55d8ae6268e15b7c53fac3820dac7f16467fcedbf34a22c351096cbd22ffaac583cb515ea26ac974204eeae5aa61c
TLSH
T14901EFF9490008BE86F1A03BD8B1236826E78EC58E102B7057C12989CFA511E96BA179
MD5 SHA1 SHA512 TLSH

Submit Download

OneSystemCare.exe

Path C:\ProgramData\dcbdb831-95af-4d21-874a-b8159552646c\OneSystemCare.exe
Size 929KB
SHA256 3eeffa9fa23e73186aded7269be31c251e7460cb866516f4acbea1415fab0184
MD5 b1b1114900528ad34decb187bc9092cd
SHA1 c6d774e827256e9c80aae0073926e852dee97899
SHA512 44fd8a8fb9f29a07e216823a6f1b48822f59e1ddf2a4592ad93c876f4e9a69a411a372035c7e0cf77e48f43384b1ec556b87b66afac9dd1eeb904aa76bd1637c
SSDEEP 12288:fUb9Xn7Mu3qI70c9viIROLTv33XNKSceZg0Y+vYNHKSy8YivuRWoUZMzJb/Ty7:fUJX7MA0c9vxkH3tKOfxlUnRaxTS
TLSH
T1E415CF37398A2932E787FD7E0BF3561E4AE118424722D69B6225CC37D15EFE091B1263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53520158-3774-4cd9-a6f4-e4b7d1d7bee1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53520158-3774-4cd9-a6f4-e4b7d1d7bee1.tmp
Size 38KB
SHA256 c3866e14d3ad4838e9be463df016460fb2a9a2b070a6ccfed8bfc8f05f077795
MD5 f4096f0da8d20bfff4d24e5563608794
SHA1 330b95fccb870ad17270934190fb8ac62a4b63de
SHA512 b5225fe325c7c02caaa02e972c64a2bde2e3242900615c0aa94eb8d13aed517792717e7a34902d6096a9e02568176d42897ef59a67fe393f023ce3d43fe992e1
SSDEEP 768:3a/UxvxjgC+b31vbcZ0rfZWsYoNYoBBw4Ot5AEl94BHYjepAFTN/:3fZj3+b31TBVa5AEncHYj2AFB/
TLSH
T13203BF38D86599238CF7E785B70B738BAEF154A3A9825ED48DD82D1E0E4724E170B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

568f49de-e244-4164-8ba9-259c3fde9f3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\568f49de-e244-4164-8ba9-259c3fde9f3c.tmp
Size 34KB
SHA256 f69661206647bf7ff7c1a5231ca2405b4794772bcbee366d6f49bc1842e0cbdd
MD5 12c5d3d4a6684c6d9c7706dd36028091
SHA1 701b2a6f913fe47699d1469845ee5599ed902eda
SHA512 fabdfd7f8554a5c760476246d2d0a0122bb51de6a81a68ae55e956a9a4ed9f2a063a61bf39aafc92f5dc8c9b1879ebb70d9bbdf607017defcbaae28d691634bc
SSDEEP 768:9zAf3GCxqdcZ0rfZWsYoNYosBw4Ot5AEl94BHYjHpykJW:xAf3GSxBVa5AEncHYjJyQW
TLSH
T10DF2BE74EC71D9638CFAE785FA0736465EF19173F9811E84D8D8AA1E0D8329E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72d7d6e4-b2a8-493f-a251-a50e0fab40d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72d7d6e4-b2a8-493f-a251-a50e0fab40d1.tmp
Size 34KB
SHA256 8e3d6464042436a37a171911754078d62ac69e7934a22dea09e255138e96d3fc
MD5 2de4bc033aef0d48ac2733a252d86d51
SHA1 f1d9607613bb9723820e880e74b2f692f77e54b5
SHA512 bff6a5ddad351207d53e86778a1884532f32ce9a69453035c12d8dc78cefc3386de1e8ed85c46f0e0e2ad65838ecdf15aa21e1ac4dc4b3167776feb5bc8c7843
SSDEEP 768:XAf35CxpZcZ0rfZWsYoNYosBw4Ot5AEl94BHYjHpykJW:XAf35SSBVa5AEncHYjJyQW
TLSH
T1BDF2AE74EC71D9638CFAE785FA0736465EF19173F9811E84D9D8AA1E0D8329E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dc85cf0-f189-471d-a32f-fc8c17b2e4c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4dc85cf0-f189-471d-a32f-fc8c17b2e4c8.tmp
Size 105KB
SHA256 ebf0f1691f49d860fa202d63b050ce2cad38a0496d2658dba8550bd94b28fce4
MD5 7e383905ea5e52c72981148e0ba96a63
SHA1 69b00ea95b83255ffb3f785258efe9e2849602af
SHA512 9017a3852bc1710a7236871d7d43724c12d99f4aac743e58adc0ed0e10a6b4d51529c2fd094425d056a04de8831ea1cbb443ebf8f28e3ebce5c3178e7f66be02
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T1F0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

21605947-4579-45a7-b43a-599c074a96b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21605947-4579-45a7-b43a-599c074a96b8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70b3213d-a287-4d86-9af2-57a9ac38a9b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70b3213d-a287-4d86-9af2-57a9ac38a9b4.tmp
Size 29KB
SHA256 7cb5d3c76a4a4c2cac792b32e49640da0a38d21d14e24fa16eb51860d071edb4
MD5 475698ef37092bb98d989c8583ec2034
SHA1 e139a22d34c6b44ece1253cdc7fead69a2f251bc
SHA512 826814a66bb0a97002c16f5d47974ac8f4c917259f44d750a66b874e5984d4796a5eeb26cf7b121ba138222edd04c7707c8e312d9df35b001f29b0c7d74e2b57
SSDEEP 768:XIDmF17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVICDIljEroTcDz:XIDmFDEbdoWgvHfnvu1jafCDmjPTcf
TLSH
T1FED2DB7B640DCB7F4F800ADDEC297A9B6DA802CB9698C94047FA941C02D6BEF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

727e9fb7-a416-4bd6-ba5a-d6380abb336c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\727e9fb7-a416-4bd6-ba5a-d6380abb336c.tmp
Size 12KB
SHA256 238500b5e28964c541bab3b01ec62a2a60d599de46155613b8cbec544d09fef7
MD5 423afdd4f2c8be621dcdd096c8010f1d
SHA1 da1af411e131bdc808917fbae0f3e62a5c111050
SHA512 e57cfda05c1b889c3015e6b1574deec799d737e1fbc0477b929b322347024199ff66607e9830b8822bc6f341b950551cbe17a79be7a8416c561c4ccb0a13d122
SSDEEP 192:sxR7RMCl/f5smiZylOlzoA8pw/nD6+WNv3XZYir4BGFGqIgDiVuCJ:sxR71l/f5smkOOIw/4/ZbQue
TLSH
T11542C855AD28A93B8CCBE21DFB55BF53D2F9513260911E48A6FC891C14EB6DD630380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

745e4d19-156a-4d2c-a6c6-4a860359c68b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\745e4d19-156a-4d2c-a6c6-4a860359c68b.tmp
Size 11KB
SHA256 6b62062c07060eceb3ac2dd6691ec20dbaf84a9b27d802d059fef3890e721180
MD5 d0d04fe684676a8e45c1d91b962ac9d4
SHA1 04cc01413ea4c72433c64f0c21b593795b28fe5a
SHA512 18954e55edc9320420b918734eb51fb49cf15b90f46567320e3a664718f2e4cdaea141c6f37fe6457be11cef3960842c28b67b17a64f2e3fa01065a447d3ceb6
SSDEEP 192:sxR7RMCl/f5sbiZyl1lzoA8pi/nL6+WNIYiVEcFGqIgDQVuCJ:sxR71l/f5sbkO1Ii/wIV+ue
TLSH
T16642C715AE28A93B8CCBD21DFB55BF53D2F95032A0911E48A6FC891C08EB6DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74bf3cce-a2c0-41d8-86bd-d5e4602c4e51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74bf3cce-a2c0-41d8-86bd-d5e4602c4e51.tmp
Size 12KB
SHA256 f02eaf9fbd99e42c09c8399e6062ed3938a961f44ee818826ed539d6b49670cc
MD5 422ece4e97d11406feff2722af73fb6d
SHA1 af60774b8af0f4920a881a96b39435c95342a6c3
SHA512 a0842c20b6d2283849e94c02ceb8301125fbc14730d33ea7258190442d90c7aaaf897fc326cfc6245ff689e1c043526b8e336188d9a5cb11bf03f0391a154761
SSDEEP 192:sxR7RMCl/f5smiZyltlzoA8pi/nr6+WNvpR/YiB4cFGqIgDiVuCJ:sxR71l/f5smkOtIi/Q//dQue
TLSH
T1AA42D915AD28A93B8CCBD20DFB557F53D2F9513261911E48A6FC8A1C04EB6DD630380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8aa50328-a46b-4f51-8d42-1b97c9f2c078.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8aa50328-a46b-4f51-8d42-1b97c9f2c078.tmp
Size 11KB
SHA256 1f86f758019c3a298ab100df3370e9fceb63f5ed53493158dc94e7dc0348c60b
MD5 d1063509ea7e77e63e155040beabfbcb
SHA1 611cd387b243b8a8de9b056909a4b704bed4549a
SHA512 845c6508cbbcc875ad5d85be72ae055e0b0186811c703dac718d719206a27a55d4dab51e3ec623087647d36910d02678cac03dfec9cf70158bb2a3c4825bf782
SSDEEP 192:sxRMRMCl/f5sKiZyl1lzoA8pi/nD6+WNIYiVEcFGqIgVVuCJ:sxRM1l/f5sKkO1Ii/4IVbue
TLSH
T19842B615AE28A93B8CCBD21DFB65BF53D2F95132A0951E48E6FC891C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 78bc65551938d5983eca9d7fe0f4f367cb35db69d5c4735c6f4ffe620c8e174f
MD5 520ac586eab637eb5544139a6803ba72
SHA1 8da2898f00d5ed1129d6c8cd2bbd998af436c973
SHA512 9f88750d365dfd672f52051d753f2f8aff858a8537c4c415017ef191aa82fc660813261190f28c715515b57163a0088adf49d7e63fd7cbb3c04e53489952b0c4
TLSH
T12F5195418A643841FF440232B2D16CAFBAB15584EC835EE309F8E6B4ADB336C71778C4
MD5 SHA1 SHA512 TLSH

Submit Download

751137f1-a3ed-44e4-a068-54dae010923c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\751137f1-a3ed-44e4-a068-54dae010923c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

64ab2134-b953-402c-a9b4-9c5e54e46c36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64ab2134-b953-402c-a9b4-9c5e54e46c36.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a757b36f-7dee-46c1-93e2-b2bf8d47637d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a757b36f-7dee-46c1-93e2-b2bf8d47637d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f595e6f9-fb3b-42fc-8a92-29a7e29107bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f595e6f9-fb3b-42fc-8a92-29a7e29107bd.tmp
Size 2KB
SHA256 f40e7dca98e9fe9f260f2d2222e66a1f35a5d9b6efc23dbf8ea1e063482f2f34
MD5 0138b3556ae1d9ed4dc003f49ab131d9
SHA1 2b8f102e74d8d9d61be5fe7e28fac27164e01a28
SHA512 6fcf8ad7000f8bf1b8faf355e55fee4241ad9a88afdb9652e4cf36ace9c51581fc0505cd51acf88754eaf2ba2c1bac23f65c94bcbda57ea2067b81e9e91677bc
TLSH
T12451B1F7C3F8866DC90195F0A6146E1BCF5C0918435C3D5EC9E4AF1B93E24B1D245A5E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bdfd3caaf6de1be2c644ad8ebac28813ec42fc38503d9a2966616bb360f7d4e1
MD5 1b78ff86503ebcdd01832040582b60cc
SHA1 8681470858810c1f9e0f120edb664df7b80b45fd
SHA512 c1b5da9683c91e50580023b5603f5df4bdd086be346fb143aec0eebfaca84793273973a57069be5115da38c0e523fabdc445a9e84936fef56067108b00811034
SSDEEP 24:KEsles3sys6Bs/EsmsCsL/sysn1s6ISsOsLKpsEhBsYsL1bsUsbSds1jsQzsCs48:KUoIvK1+cTy1tIlKOA4XyVnIRKs4cw
TLSH
T158912F21313A1241383E3519A0E5AF6E438671A77078E97B7BFA10A68E6FF040DBD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c882ad4b-f36e-4aae-8072-5d0ba618ca79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c882ad4b-f36e-4aae-8072-5d0ba618ca79.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

aa1611a8-cf00-442b-9ada-3e0c58f8361b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aa1611a8-cf00-442b-9ada-3e0c58f8361b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a44b945c-9e82-4fd1-a47d-8dfe37de9b16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a44b945c-9e82-4fd1-a47d-8dfe37de9b16.tmp
Size 37KB
SHA256 ff2ac7a9447dc13519ad0aabba8e046c73977bbbe79e4bda114486e252e31990
MD5 76fd0a53efb71c046f87e7c8af2d4eb6
SHA1 ee6d10174d0cb3f9e605be74a8307f1def717299
SHA512 5091c12936e2aa950278bfb66384ff7362bf0124a636909803b891cf9d213d99e0807fdd0ff5a8c6276329a00df057d4c53267849b7dfa70051cbe3b2ff1f2ea
SSDEEP 768:lzfFQ43xwgECx8B0bcWsYoNYohBw4Ot5AEl94BHYjHpykJW:pi43USABVa5AEncHYjJyQW
TLSH
T1B9038C75DCA1CA67ACF69BC5FB06364A9EF151A3E9859DC4E9C86D0D08831DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4e33e80-8c6c-49f7-9afc-235f5ab80eb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c4e33e80-8c6c-49f7-9afc-235f5ab80eb1.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e59c0253-8d97-4756-8832-0d16fdcb0623.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e59c0253-8d97-4756-8832-0d16fdcb0623.tmp
Size 38KB
SHA256 814d956b040dcd7f37d39965812ceafe54b159ec6f565cac48b2c8fc6bd72dc0
MD5 8f4852887bb2a59388eb3a5af86a5ecd
SHA1 a3a8d431486b34e065abff2ec6b108bfc5b36fc0
SHA512 5277a423ecbfce1e8f74ee3398edbfab722987cafeea94be2c45be4e4122301787ce97cf8f52897b0b18b453b11320d28502c189270c6cd0428d3f30894106bc
SSDEEP 768:z/UxvxjgC+b3B6cZ0rfZWsYoYBw4Ot5AEl94BHYj/3AFTN/:GZj3+b3hBVa5AEncHYj/AFB/
TLSH
T10D03BF39ECA59923CCF7E785770B7347AEF19463A5812ED489DC2E1E0A8725D1307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51339574-9641-4502-9bd6-1829b62043c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\51339574-9641-4502-9bd6-1829b62043c1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5d0278ae-f9ef-40ed-bc8b-81ab0087da46.tmp

Path C:\Users\Admin\AppData\Local\Temp\5d0278ae-f9ef-40ed-bc8b-81ab0087da46.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

85c01fd5-0d7f-4837-8660-a9c67838471c.tmp

Path C:\Users\Admin\AppData\Local\Temp\85c01fd5-0d7f-4837-8660-a9c67838471c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-841N0.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Size 1.2MB
SHA256 a7980ea6e8a1c3ea2affb2b5bc12d1d553e6f08bd24995e1f61dd80c56eb9506
MD5 5576331531ea628d83b90682bce03f18
SHA1 a98be9b662b84319f35fdb81f1596086091d582d
SHA512 3d7c1f4599ecab98ee24756f199e367d83e6c2a1d7dfd6438331b387ae81ca4ec26025230e66e4800e2813493dc000ac9738292165c5018a9f5b855ada560852
SSDEEP 24576:ntdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt51Tx9vM:tqTytRFk6ek17+
TLSH
T1DC452922A3D24437D5731F759C6BC2946C367E202EA4E54A7EF89E0C0E79B81BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F2PE3.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

ydwqk.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F2PE3.tmp\ydwqk.dll
Size 1.6MB
SHA256 2c4658c487114e36e2b9e75bf1c97dc034ce080dc6bc5f3a45e83aeb573dd631
MD5 fc4b0ea55c7632a0cd000bef5e658243
SHA1 71c8eaa31613a14faaa4634f0d402cb3b8285456
SHA512 54744d9031736e57e03c2567c59586d8c0bbbf0743022ed1c8719a12c7347f4206341314b31a7656f42d1a201ddb4ef75d39be2681aed2e48c627e742068e149
SSDEEP 24576:jrqDgaHzs9aPn2OMIcp6d0Wm0dbgbT5osoP3:81YwP2LzoCSFso
TLSH
T12075D023B4828432C172133019BB7F7516FF9A2907B149CB9398AA74AF345D36B36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5316_941321523\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CallBanner.png

Path C:\Users\Admin\AppData\Roaming\One System Care\CallBanner.png
Size 44KB
SHA256 cc0d57ebb766f8814057f1a5cbb78d35770dc0d47c1db97c5541dd5364b064ed
MD5 13fe22aeb32743837224ed89c91e7996
SHA1 797fadba191ee4aa209096fffea29880c3c0d546
SHA512 34e82dbd558775132a12720f2c411172ccd3e7173baf5c9117242a020fefb59b72d5108e9a9377a1057d55e62d0299fbbe6090ec38f569f359c5d1cbe074dcaf
SSDEEP 768:Lce52r5Qe2I4UqTCr5F2nvH/eIWL2MwMIHBvrADJM3aWt502fcRWJ3CcZ3XWqxmc:552r5QeHVXF2HeIwF+vrADJM3aCVfcRK
TLSH
T16623A27B96212C3B0AA341F870B5BB4DF6E6C101EB43C25489FA5BD7A3C5E629D7241C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\English.json
Size 40KB
SHA256 1cba9726d30faaf69c4a79b0323d422513fb9b107e288d57d23e1562b62ce41b
MD5 73628eeb89155df245626ed656035b5a
SHA1 12f23d4312c2f1ac661bd6d7f7ed55683b516d35
SHA512 773df6696ff5c7975b2731c4139ed89cd67ca5a93ba1b2a0d9cb435e6111891c7a3cb84ae7fb9c1e9ae51bfff207c070d82034290cdd822ed22a6dc56c754278
SSDEEP 768:pInAwZtNOfOyl3iPlqP04eUH3d7GNafVXLZZheRv5B:pInANnkQJtkafV7oh5B
TLSH
T1F103E08BB697C2DD0E80F247812E760A01FF2EC408A9615A78E985B12FC5479B5BE40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Parameters.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\Parameters.json
Size 910B
SHA256 e1cadab805a5b25c6a6b3d332278412034290c9a8991e089c25c08243ef73915
MD5 edf16921760f499b89226e8a7f9e42dc
SHA1 34adaff0aa75e4f23c44da8956b8955e7803b7a9
SHA512 4fa3c14fadd3110ce28f10961e3df39701878382df1efef5e2b4c637c57b762fb36882a29c134988939e9e4fb8507c1e3ca2bbe9e8797d2735355bbd3d3a245f
TLSH
T1E511EBDFA7BD30005D1C0A133F9355040905ED11C7CB0F44B1A02CF00776652F597129
MD5 SHA1 SHA512 TLSH

Submit Download

is-5M0KS.tmp

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\is-5M0KS.tmp
Size 39KB
SHA256 3d79643b0364e95a5d2c23414f22d9621f7d4d9abbd0b674f5328d5dd9be5d69
MD5 301aae525b1b00130e5ff774f20f4efd
SHA1 b89b6c9c88f740fdc5c6bcd4c17cbbc78fe8338a
SHA512 158af32bc0844c088f9131ca3185e2a51ffab594108181347240e1d85d60a53f8928cc036b16f16ddda725c4b7aec5a909bfca892908d9b94b2d9e1ef995db40
SSDEEP 768:pInAwZtNOhAOyl3iPlq85M/JsihcTgVSHb5Zp23m/gccubvf6OQ1:pInAfAnkQkU3Vy9e3Ogcccq
TLSH
T13503F11B3C53B8C54A875D6B820F6E5A80329DE50434906A273D50B97FCAD3A88BF71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpLang.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\tmpLang.json
Size 26KB
SHA256 3d997792150da91ac71f443d3f384eead455ab017d7622f0b18e3a6d344fe75a
MD5 76ca06abcd5b5c252bd10fe465993e83
SHA1 249126aac09f7262ac1adf460742ee8cae101dea
SHA512 be5ea6b7fe2d7e20d6c070971d71748177efa531fc4c6de8fc36e8d61b2fddc203eeeeda646efa5991072c8f97d17774bf0997c1ed6922e6533c9b573bf58ab0
SSDEEP 384:nod5cvfuDZEjHpn6rAlFWbFOEGZD9qCMFs/I68wETQOZ8pi6wLHRM3P5PfAk6:od5cvfY6tn6rAKSwsw68w0Z8sG3P5Ph6
TLSH
T191C2F02B9B240C9F45F8B19CA5026B762CAF306CD3660B0D5A8DB05EEF1E9951F3116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launch One System Care.lnk

Path C:\Users\Admin\Desktop\Launch One System Care.lnk
Size 1KB
SHA256 807213a2bdcb229ecc11364c2272c9571fffe84968ed36ee06973da77f4ebaea
MD5 8325fa5fb44e18f18f5c4e043f347b04
SHA1 0712dde6b8e6e8493e86fc583e58980b10c5084d
SHA512 d9aeed27ab7498ef4f09d637c5e350b94e28f732ebf1be74caf2e290ef6ca0c44af0b94b3d723a49c9e3b67000bb5df4bd9d17e89f263cf2219f1504d5e177b1
TLSH
T1C111AF240ACDAB2BE777833257B546A1E753F916FA850E0A408721D80832F077D5AF5E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5316_1493468347\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5316_984015511\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/768-156-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-152-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-155-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-144-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-145-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-146-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-154-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-153-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/768-149-0x0000000017E20000-0x000000001817B000-memory.dmp

Download

memory/2888-39-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2888-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2888-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3900-63-0x0000000073640000-0x00000000737E3000-memory.dmp

Download

memory/3900-65-0x0000000073640000-0x00000000737E3000-memory.dmp

Download

memory/3900-138-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3900-64-0x0000000073640000-0x00000000737E3000-memory.dmp

Download

memory/3900-67-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4168-148-0x000000001D130000-0x000000001D24E000-memory.dmp

Download

memory/4168-147-0x000000001D130000-0x000000001D24E000-memory.dmp

Download

memory/4168-150-0x000000001D130000-0x000000001D24E000-memory.dmp

Download

memory/4516-31-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-15-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-38-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-26-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-29-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-30-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-32-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-24-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-36-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-34-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-35-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-25-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-33-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-37-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-48-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-40-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4516-27-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-28-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-47-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/4516-16-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-19-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-20-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-21-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-45-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-22-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-23-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-18-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-17-0x0000000073BA0000-0x0000000073D43000-memory.dmp

Download

memory/4516-14-0x0000000073BA2000-0x0000000073BA4000-memory.dmp

Download

memory/4516-44-0x0000000073BA2000-0x0000000073BA4000-memory.dmp

Download

memory/4516-43-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/4516-6-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/4624-49-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4624-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4624-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download